* security(deps): resolve high-severity npm audit advisories via minimatch override
All 9 high-severity advisories stemmed from a single transitive chain:
eslint/eslint-config-next tooling depend on a vulnerable minimatch
(<=10.0.2) that pulls in brace-expansion <=5.0.7 (GHSA-mh99-v99m-4gvg,
DoS via unbounded expansion). These are dev/build-time only packages,
not shipped in the runtime image.
Bumping eslint itself would require a semver-major jump (9.x -> 10.x).
Instead, pin minimatch to ^10.0.3 via package.json overrides, which
drops the vulnerable brace-expansion dependency entirely (newer
minimatch uses @isaacs/brace-expansion). Verified npm audit reports 0
vulnerabilities and both npm run lint and npm run build still pass.
* ci(app): add non-blocking npm audit step to lint-and-build job
Surface high-severity advisories in CI logs without gating merges on
build-time dev-dependency findings a solo dev can triage async.
---------
Co-authored-by: James Maes <jmaes@dmdbrands.com>
Lay the foundation the rest of the north-star content cleanup depends on:
- Add CONTENT-POLICY.md capturing the site's three hard guardrails (not
available today, no invented data as real, in-development status must
be discoverable) so future page rewrites keep the site honest-but-ambitious.
- Add src/lib/status.ts as the typed, single source of truth for what's
genuinely available now (build/run nunciod + nuncio-cli from source,
IMAP/SMTP sync, FTS5 search, MBOX/EML/JSON export, WORM audit chain) vs.
what's still on the roadmap (JMAP, CalDAV, CardDAV, live filter firing,
at-rest encryption, HTML sanitization, Desktop/TUI/MCP clients), seeded
from docs/ROADMAP.md in the engine repo.
- Add StatusBadge (shipped | in-progress | planned | available-now) and an
AvailableNow convenience wrapper for marking individual claims on a page.
- Add DevStatusRibbon, a site-wide banner rendered from layout.tsx linking
to the public roadmap, so every route carries the in-development signal.
- Header: add a Roadmap nav link and replace the "Download Latest Release"
CTA with "Notify Me at Launch" (temporarily pointed at GitHub until a
#notify section exists).
Also unblock the lint gate itself, which had never been runnable in this
repo (no eslint.config.* existed): add the missing flat config, and
downgrade eslint from ^10.7.0 to ^9.39.5 since eslint-config-next 16.1.6's
bundled plugins (eslint-plugin-react et al.) have no release compatible
with ESLint 10 yet. Fix the react/no-unescaped-entities errors that lint
surfaced once it could actually run.
james.maesandJames Maes