fix: grpc CVE, copilot review feedback, sslmode default restored

- google.golang.org/grpc v1.79.1 → v1.79.3 (fixes CVE-2026-33186)
- Fix overlay cloneNode bug: closeSidebar referenced detached node
  (use onclick assignment instead of cloneNode pattern)
- Safe-area-inset: bottom padding accounts for iOS home indicator
- Tables: display:block + overflow-x:auto directly (no wrapper needed)
- Remove overflow-x-hidden from docs container (was clipping tables)
- Restore sslmode=disable as default for local dev (sslmode=require
  broke docker-compose dev workflow; warning still logs in production)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: michaelmcnees

go.mod

@@ -142,6 +142,6 @@ require (
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect
-	google.golang.org/grpc v1.79.1 // indirect
+	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )

go.sum

@@ -350,8 +350,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d h1:t/LOSXPJ9R0B6fnZNyALBRfZBH0Uy0gT+uR+SJ6syqQ=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
-google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
+google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

site/src/components/DocsSidebar.astro

@@ -93,7 +93,7 @@ function isParentActive(item: NavItem): boolean {
 <div id="sidebar-overlay" class="fixed inset-0 z-40 bg-black/50 hidden lg:hidden" aria-hidden="true"></div>
 
 <!-- Mobile sidebar drawer -->
-<aside id="docs-sidebar-mobile" class="fixed top-16 left-0 bottom-14 md:bottom-0 z-50 w-72 bg-surface-container-lowest border-r border-outline-variant transform -translate-x-full transition-transform duration-200 lg:hidden overflow-y-auto">
+<aside id="docs-sidebar-mobile" class="fixed top-16 left-0 z-50 w-72 bg-surface-container-lowest border-r border-outline-variant transform -translate-x-full transition-transform duration-200 lg:hidden overflow-y-auto" style="bottom: calc(3.5rem + env(safe-area-inset-bottom, 0px));">
   <nav class="py-6 px-4" aria-label="Documentation sidebar mobile">
     {docsNav.map((group) => (
       <div class="mb-8">
@@ -192,12 +192,9 @@ function initSidebar() {
     overlay.classList.add('hidden');
   }
 
-  const newOverlay = overlay.cloneNode(true);
-  overlay.parentNode?.replaceChild(newOverlay, overlay);
-  newOverlay.addEventListener('click', closeSidebar);
-
+  overlay.onclick = closeSidebar;
   mobileSidebar.querySelectorAll('a').forEach((a) => {
-    a.addEventListener('click', closeSidebar);
+    a.onclick = closeSidebar;
   });
 }
 initSidebar();

site/src/components/Nav.astro

@@ -81,11 +81,7 @@ function initNav() {
   const overlay = document.getElementById('sidebar-overlay');
   if (!btn || !docsSidebar || !overlay) return;
 
-  // Remove old listeners by cloning
-  const newBtn = btn.cloneNode(true);
-  btn.parentNode?.replaceChild(newBtn, btn);
-
-  newBtn.addEventListener('click', () => {
+  btn.onclick = () => {
     const isOpen = !docsSidebar.classList.contains('-translate-x-full');
     if (isOpen) {
       docsSidebar.classList.add('-translate-x-full');
@@ -94,7 +90,7 @@ function initNav() {
       docsSidebar.classList.remove('-translate-x-full');
       overlay.classList.remove('hidden');
     }
-  });
+  };
 }
 initNav();
 document.addEventListener('astro:after-swap', initNav);

site/src/layouts/Docs.astro

@@ -24,8 +24,8 @@ const { prev, next } = getPrevNext(currentPath);
 
 <Base title={`${title} - Mantle Docs`}>
   <Nav />
-  <div class="mx-auto max-w-[1280px] px-4 sm:px-6 overflow-x-hidden">
-    <div class="flex min-h-screen pt-16 pb-16 md:pb-0">
+  <div class="mx-auto max-w-[1280px] px-4 sm:px-6">
+    <div class="flex min-h-screen pt-16 pb-20 md:pb-0">
       <DocsSidebar currentPath={currentPath} />
 
       <!-- Main content -->

site/src/pages/index.astro

@@ -12,7 +12,7 @@ import Footer from '../components/Footer.astro';
 ---
 <Base title="Mantle — Headless AI Workflow Automation">
   <Nav isHome={true} />
-  <main id="main-content" class="pb-16 md:pb-0">
+  <main id="main-content" class="pb-20 md:pb-0">
     <Hero />
     <Features />
     <HowItWorks />

site/src/styles/global.css

@@ -318,18 +318,11 @@ body {
 }
 
 /* Tables — horizontally scrollable on small screens */
-.prose .table-wrapper {
-  overflow-x: auto;
-  -webkit-overflow-scrolling: touch;
-  margin-top: 1.5em;
-}
-
-.prose .table-wrapper table {
-  margin-top: 0;
-}
-
 .prose table {
+  display: block;
   width: 100%;
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
   border-collapse: collapse;
   margin-top: 1.5em;
   font-size: 0.875rem;