* security(deps): resolve high-severity npm audit advisories via minimatch override
All 9 high-severity advisories stemmed from a single transitive chain:
eslint/eslint-config-next tooling depend on a vulnerable minimatch
(<=10.0.2) that pulls in brace-expansion <=5.0.7 (GHSA-mh99-v99m-4gvg,
DoS via unbounded expansion). These are dev/build-time only packages,
not shipped in the runtime image.
Bumping eslint itself would require a semver-major jump (9.x -> 10.x).
Instead, pin minimatch to ^10.0.3 via package.json overrides, which
drops the vulnerable brace-expansion dependency entirely (newer
minimatch uses @isaacs/brace-expansion). Verified npm audit reports 0
vulnerabilities and both npm run lint and npm run build still pass.
* ci(app): add non-blocking npm audit step to lint-and-build job
Surface high-severity advisories in CI logs without gating merges on
build-time dev-dependency findings a solo dev can triage async.
---------
Co-authored-by: James Maes <jmaes@dmdbrands.com>
Add a Trivy job to the Docker build workflow that scans the built image
for CRITICAL/HIGH CVEs, uploads SARIF to GitHub code scanning, and fails
only on CRITICAL findings so a solo maintainer isn't blocked by HIGH-only
noise. Split top-level workflow permissions down to contents:read and
elevate packages:write / security-events:write per job instead of at the
workflow level. Strip npm/npx/yarn/corepack from the Docker runtime stage
since they are never invoked at runtime (node server.js only) and were
the source of the only CRITICAL/HIGH findings in the current image.
Co-authored-by: James Maes <jmaes@dmdbrands.com>
Replace the decorative "Notify me at launch" email form (local state only,
no backend) with an honest CTA: watch the GitHub repo for releases, or see
the roadmap. Add a proper GitHub brand mark (GithubIcon) since lucide-react
has no GitHub glyph, and use it everywhere a link claims to go to GitHub,
including the header CTA that previously said "Notify Me at Launch" while
actually linking to GitHub.
Re-verify competitor pricing cited across the /vs comparison pages: correct
stale Airmail, Canary Mail, Spark Mail, and Microsoft 365 figures against
current vendor pricing, soften Superhuman's now multi-tiered pricing to a
non-committal range, and add a "pricing as of 2026, check the vendor" caveat
next to every competitor price on the hub and detail pages.
Reframe the /vs comparison hub and all 9 competitor pages from
head-to-head "beats X today" claims into honest design/architecture
positioning against the vision (local-first daemon, one gRPC contract
for future clients, NSQL rules, WORM audits), gated per-row by real
status instead of blanket "Yes" checks, with Notify-me/GitHub/roadmap
CTAs replacing "Download Latest Release".
Reframe the docs section: keep and correct what's genuinely real
(build-from-source quickstart, NSQL grammar matched to the actual
parser, export formats/flags matched to the real CLI, the WORM ledger,
automatic corruption recovery), mark account-setup/interfaces/mcp/
html-rendering as planned with an "intended experience" framing, add
a pre-alpha notice to the docs landing page, and scrub fabricated
benchmarks, invented crypto/feature claims, and real-looking personal
names/emails.
Rewrite the dedicated feature pages and three shared hub components to
sell the vision without claiming shipped status for unbuilt work.
- interfaces: reframe the four interfaces as one-contract vision; CLI
is available-now, GUI/TUI/MCP are planned. Drop "100% parity" and
"Featured/Most Popular" badges and the fake per-platform download CTA.
- features: full feature matrix now carries a StatusBadge per row and
drops every unmeasured benchmark ("<10ms", "microsecond", "100,000+")
and as-shipped claims for JMAP push, Sixel, and full feature parity.
- SecurityHub/security: keep OS keyring and the WORM audit ledger as
available-now (both real and verifiable today); reframe at-rest
encryption, memory zeroization, HTML sandboxing, and the updater as
planned/in-progress design goals instead of delivered guarantees. Add
the real vulnerability-reporting policy and correct the ReDoS defense
description (static pattern rejection, not an invented 50ms timeout).
- McpIntegrationHub/mcp: MCP is a planned Phase-5 client that doesn't
exist yet; relabel the config sample as a non-functional preview and
drop language implying an agent can connect today.
- NsqlPlayground/nsql: keep the interactive grammar demo but genericize
the sample email away from real names/domains, drop invented
latency/RAM readouts from the in-browser toy evaluator, and frame rule
execution against live mail as in-progress/planned (real: parser,
validator, dry-run, and the webhook/audit engine internals).
- about: align the manifesto pillars with real status via StatusBadge;
replace the third-party credit list's unverified per-maintainer name
attributions with plain repository links to avoid misattributing real
people.
- privacy: correct the claim that the local database is encrypted at
rest (only credentials are, via the OS keyring); scope network/AI
claims to what's actually implemented.
- terms: clarify Nuncio is source-only pre-alpha software with no
hosted service, and point the disclaimer at the security page.
Rewrite the home page hero and section components to sell the vision
without implying the product is installable today.
- Hero: replace Download/Latest Release CTAs with Notify-me, Follow-the-
build (GitHub), and See-the-roadmap; badge unshipped trust claims.
- DownloadsSection: convert from a release-download panel into a
follow-the-build / notify-me-at-launch section, plus the real
build-from-source instructions.
- FourExperiencesSection: mark the CLI available-now and the desktop
GUI/TUI/MCP client as planned via StatusBadge; drop fake "Most
Popular" badges and dead download links.
- ParityMatrixSection: reframe "100% parity" as the architecture's
design goal (one gRPC contract, no drift) and drive per-capability
status from real engine state instead of a blanket parity checkmark.
- ShellInteractivePreview: label the CLI/TUI/GUI/MCP mockup as a
product preview, replace the real inbox with genericized sample
content, and drop invented timing/benchmark numbers.
- ManifestoPillarsSection/ComparisonSection/DocsTeaserSection: reframe
shipped-sounding claims (encryption, AI policy, benchmarks) as vision
or badge them against the real status list.
Lay the foundation the rest of the north-star content cleanup depends on:
- Add CONTENT-POLICY.md capturing the site's three hard guardrails (not
available today, no invented data as real, in-development status must
be discoverable) so future page rewrites keep the site honest-but-ambitious.
- Add src/lib/status.ts as the typed, single source of truth for what's
genuinely available now (build/run nunciod + nuncio-cli from source,
IMAP/SMTP sync, FTS5 search, MBOX/EML/JSON export, WORM audit chain) vs.
what's still on the roadmap (JMAP, CalDAV, CardDAV, live filter firing,
at-rest encryption, HTML sanitization, Desktop/TUI/MCP clients), seeded
from docs/ROADMAP.md in the engine repo.
- Add StatusBadge (shipped | in-progress | planned | available-now) and an
AvailableNow convenience wrapper for marking individual claims on a page.
- Add DevStatusRibbon, a site-wide banner rendered from layout.tsx linking
to the public roadmap, so every route carries the in-development signal.
- Header: add a Roadmap nav link and replace the "Download Latest Release"
CTA with "Notify Me at Launch" (temporarily pointed at GitHub until a
#notify section exists).
Also unblock the lint gate itself, which had never been runnable in this
repo (no eslint.config.* existed): add the missing flat config, and
downgrade eslint from ^10.7.0 to ^9.39.5 since eslint-config-next 16.1.6's
bundled plugins (eslint-plugin-react et al.) have no release compatible
with ESLint 10 yet. Fix the react/no-unescaped-entities errors that lint
surfaced once it could actually run.
dependabot[bot]
james.maesandJames Maes