v0.0.11-beta.9 — invite-a-friend flow, audit-poster PNG fix, Supply Chain green

0.0.11-beta.9

Features

• Invite a friend from /audit (#435) — the come back better card gains an invite modal: paste a comma/space/newline-separated list of friend emails (validated inline, capped at 10 per submit, deduped against your own address) and they're emailed an audit invite from failproof.ai with you Cc'd. Anonymous users are routed through sign-in first so there's a sender identity. Replaces the placeholder "1 of 3 invited" perks bar.

Fixes

• Supply Chain (OSV-Scanner) CI gate is green again (#446) — the dependency tree resolved a vite@8.0.14 (two advisories, incl. CVSS 8.2) and undici@7.27.2 (7 advisories) transitively. Both are now pinned via package.json overrides (vite@8.0.16, undici@7.28.0) to dedupe the whole tree. OSV-Scanner now reports "No issues found".
• /audit poster PNG export rendering (#435) — swapped the poster export from html2canvas to html-to-image, fixing broken dashed borders, a stray square cutting through the wordmark, and clone/flex misalignment that left content anchored off-center. The poster now rasterizes through the browser's native renderer, so masks, gradients, and font metrics match what's on screen.
• Dashboard restraint (#435) — dropped the decorative ━━ glyph prefix and amber slipping-count badge from every navbar tab, and calmed the /project/[name] page chrome (flat back chip, mono title, single meta line, calm sessions list).
• Correct CLI binary name in /audit install commands (#435) — the per-policy and [install all] rows emitted failproof policy add …; the shipped binary is failproofai, so a copied command would fail. Fixed at all call sites plus the docs example.
• CodeRabbit review follow-ups (#435) — invite flow now routes 401s back through sign-in and never leaks upstream error text to the client/telemetry; share-fallback telemetry no longer reports success on failure; transient /api/auth/status failures preserve prior auth state; new :focus-visible outlines on all new interactive controls.

Dependencies

• Consolidated Dependabot bumps #436–#445 (#446) — next 16.2.9, eslint 10.5.0, @tailwindcss/postcss + tailwindcss 4.3.1, @anthropic-ai/sdk 0.104.2, vitest 4.1.9, lucide-react 1.18.0, @tanstack/react-virtual 3.14.3, posthog-node 5.37.1, eslint-config-next 16.2.9.
• Add html-to-image@^1.11.13 for the audit-poster export (#435).

Docs

• Update docs/dashboard.mdx for the new 5-section audit flow and the invite a friend flow (#435).

Published to npm under the beta dist-tag (npm i failproofai@beta).