- Cap the two wildly oversized bento source PNGs so Next can't serve giant variants:
occupy-wallets 1200x837/393K -> 700x488/167K, neroswap 1584x672/1.8M -> 700x297/404K.
(bauhaus/vegan are already 512px and self-cap; privacy-labs was already small.)
- Fix the bento <Image> sizes: object-contain height-constrains the image so it renders
~360px wide in either span; 66vw/100vw made Next serve up to ~750-1200w. Now
'(max-width:768px) 90vw, 33vw'.
- Bump turbo 2.7.4 -> 2.9.16 (GHSA-hcf7-66rw-9f5r, GHSA-3qcw-2rhx-2726). pnpm audit
now clean.
The data-URI logo still had LCP ~5s with zero network request, proving the
bottleneck is render delay (JS), not the image. So:
- page.tsx is now a Server Component. The hero, tagline, buttons, ServicesPreview,
PortfolioGrid, and FounderSignature render as static server HTML (they had no
client features, so they now hydrate to nothing).
- Splash state machine + header/nav/background gating + nebula position + scroll
restoration moved into a small client island (home-shell.tsx) that takes the
static content as children. Nebula reads the title via getElementById.
- Dedupe @types/react to 19 across the workspace (pnpm override) so the
server->client children boundary type-checks.
Build was failing because the new MDX post tried to `import` the
SuchMoonLaunchStoreButtons component — next-mdx-remote/rsc doesn't
support imports inside .mdx; components must be passed via the
`components` prop. Wire the helper into [slug]/page.tsx and drop the
import line from the .mdx.
Dependency bumps to clear the 14 outstanding Dependabot advisories
(9 high, 4 moderate, 1 low):
- apps/web/next: ^15.5.15 → ^15.5.18 (covers 12 next.js advisories)
- pnpm overrides: pin postcss ^8.5.14 (clears 1117015 XSS via </style>)
- pnpm overrides: pin fast-uri ^3.1.2 (clears 1117870 + 1117884 path
traversal / host confusion)
pnpm audit: 14 vulnerabilities → 0.
Forces flatted, minimatch, picomatch, ajv, and brace-expansion to
patched versions across the transitive graph (ESLint, Tailwind, and
Playwright toolchains). Both prod and full audits now report no
known vulnerabilities.
- Brand Motion card rewritten with concrete capability language
- Revenue-share card clarified: no upfront fees, no retainers, low % after launch
- Recent Work section added with Occupy Wallets as the first case study
- Bumped next to ^15.5.15 to patch 2 high and 3 moderate advisories
- Added pnpm override for yaml ^2.8.3 to resolve the transitive next-mdx-remote
stack-overflow advisory. Production audit now reports no known vulnerabilities.
- Add README.md with tech stack, project structure, and dev setup
- Add TODO_ACCESS.md with Lighthouse audit results and priority fixes
- Add start script to root package.json
- Add start task to turbo.json
jwinterm