v2.9.2

2.9.2 (2026-10-02)

Fixed

• admin: remove dead /signin, /signup and /help links from the admin footer (7bfaf44)
• admin: remove dead /signin, /signup and /help links from the admin footer (aab901e)
• driver: log out clears the server session and stays inside the iOS wrapper (d732822)
• driver: log out clears the server session and stays inside the iOS wrapper (149ffc4)
• health: return 503 only when the database is unreachable (ad025a2)
• health: return 503 only when the database is unreachable (a7a406f)
• tracking: inactive drivers cannot start a shift (75bf59c)
• tracking: inactive drivers cannot start a shift (eefe1ba)
• tracking: tell the driver when the server keeps rejecting their location (35842c1)
• tracking: tell the driver when the server keeps rejecting their location (9f67ee2)

Security

• admin: require a staff caller in the admin create-order actions (e4d2c50)
• bump transitive overrides for advisories published 09-18..09-30 (856ecd5)
• catering: only staff may create orders for another client (64e540e)
• harden role resolution and profile role writes (0448b0a)