@dpuse/dpuse-shared 0.3.838 → 0.3.849

package/README.md

@@ -28,8 +28,6 @@ In addition, DPUse provides [Tools](https://www.dpuse.app) used by the applicati
 
 <!-- OPENING_END -->
 
-## Usage
-
 <!-- USAGE_START -->
 
 This connector is automatically uploaded to the DPUse Engine cloud once released and becomes instantly available to all new browser app instances, with existing instances notified of the update.
@@ -234,24 +232,42 @@ _Note: Sonda's Vite reports currently exclude CSS files, since Vite does not gen
 
 ## Security & Quality
 
-### CodeQL
-
-[CodeQL](https://github.com/dpuse/dpuse-shared/security/code-scanning) static analysis runs on every push to `main` and on a weekly schedule, scanning TypeScript, JavaScript, Rust, and GitHub Actions workflow files for security vulnerabilities and coding errors.
-
-### SonarCloud
-
-[SonarCloud](https://sonarcloud.io/summary/new_code?id=dpuse_dpuse-shared) performs continuous code quality and security analysis on every push, detecting bugs, code smells, and security vulnerabilities in the TypeScript source.
-
-### Vulnerability Scanning
-
-Two complementary tools continuously monitor dependencies for known vulnerabilities:
-
-- [npm audit](https://docs.npmjs.com/cli/v8/commands/npm-audit) runs on every push to `main` via the CI workflow, failing the build if any high or critical severity vulnerabilities are detected.
-- [GitHub Dependabot](https://docs.github.com/en/code-security/dependabot) automatically raises pull requests to update vulnerable dependencies, drawing on the GitHub Advisory Database which combines NVD and npm-specific advisories.
-
-### Supply Chain Security
-
-[Socket.dev](https://socket.dev) monitors all dependencies for supply chain risk — detecting malicious packages, dependency confusion, typosquatting, and suspicious behaviour that may not yet have a CVE.
+### Checks & Settings
+
+Read from the repository each time this README is generated, so the status is current as of the latest release.
+
+|Check or setting|Status|What it does|
+|:-|:-|:-|
+|[CodeQL](https://github.com/dpuse/dpuse-shared/security/code-scanning)|✅ GitHub Actions, JavaScript/TypeScript|Static analysis for security vulnerabilities and coding errors, on every push and pull request to `main` and weekly.|
+|[SonarCloud](https://sonarcloud.io/summary/new_code?id=dpuse_dpuse-shared)|✅ On|Code quality and security analysis on every push: bugs, code smells and vulnerabilities.|
+|Unit tests|✅ On|Run in CI on every push to `main`.|
+|Property-based tests|✅ fast-check|Fuzz testing: many random inputs per test to find edge cases, run with the unit tests.|
+|npm audit|✅ On|Fails CI when any dependency has a known vulnerability.|
+|[Socket.dev](https://socket.dev)|✅ On|Flags supply chain risk in dependencies: malicious packages, typosquatting and suspicious behaviour that may not yet have a CVE.|
+|Dependabot alerts|✅ On|Alerts when a dependency has a known vulnerability, using the GitHub Advisory Database.|
+|Dependabot security updates|❌ Off|Opens pull requests that update vulnerable dependencies.|
+|Dependabot version updates|❌ Off|Opens pull requests for new dependency versions.|
+|Secret scanning|✅ On|Detects credentials, such as API keys and tokens, committed to the repository.|
+|Push protection|✅ On|Blocks pushes that contain credentials.|
+|Private vulnerability reporting|✅ On|Lets anyone report a vulnerability privately. See [Reporting Vulnerabilities](#reporting-vulnerabilities).|
+
+### Code Health
+
+[![Fallow code health](https://img.shields.io/badge/fallow-A%20%2890%29-brightgreen)](./code-health-reports/fallow/index.md)
+
+[Fallow](https://github.com/fallow-rs/fallow) analyses the TypeScript source on each release for unused code, duplication, complexity, and dependency hygiene. See the [full Fallow report](./code-health-reports/fallow/index.md) for every finding.
+
+|Measure|Value|
+|:-|-:|
+|Health score|90.0 (A)|
+|Maintainability (average)|93.1|
+|Unused files|0.0%|
+|Unused exports|0.0%|
+|Duplicated code|0.0%|
+|Functions over the complexity limits|0 of 83|
+|Unused dependencies|0|
+|Circular dependencies|0|
+|Hotspots (complex and often changed)|1|
 
 ### Reporting Vulnerabilities
 
@@ -259,9 +275,10 @@ Please do not open public GitHub issues for security vulnerabilities. Use [GitHu
 
 ### OpenSSF 🚧
 
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14952/badge)](https://www.bestpractices.dev/projects/14952)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/dpuse/dpuse-shared/badge)](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-shared)
 
-This project is working towards the [OpenSSF Best Practices](https://www.bestpractices.dev) Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. Currently the [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-shared) provides an independent automated assessment of the project's security practices and is an ongoing area of improvement.
+This project is working towards the [OpenSSF Best Practices](https://www.bestpractices.dev) Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. Currently the [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-shared) provides an independent automated assessment of the project's security practices and is an ongoing area of improvement. Apart from the Best Practices badge above, the remaining Scorecard gaps need multi-person review or a pull-request workflow, which this solo-maintained project doesn't use.
 
 ## Contributing
 
@@ -273,6 +290,6 @@ For security vulnerabilities, see [Reporting Vulnerabilities](#reporting-vulnera
 
 This project is licensed under the MIT License, permitting free use, modification, and distribution.
 
-[MIT](./LICENSE) © 2026-present Jonathan Terrell
+[MIT](./LICENSE) © 2026 Jonathan Terrell
 
 <!-- GOVERNANCE_END -->

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@dpuse/dpuse-shared",
-    "version": "0.3.838",
+    "version": "0.3.849",
     "private": false,
     "description": "Common constants, types and utilities used across all DPUse projects.",
     "license": "MIT",
@@ -170,12 +170,12 @@
         "valibot": "^1.5.0"
     },
     "devDependencies": {
-        "@dpuse/dpuse-development": "^0.3.740",
+        "@dpuse/dpuse-development": "^0.3.746",
         "@dpuse/eslint-config-dpuse": "^1.0.123",
-        "@types/node": "^26.6.2",
+        "@types/node": "^26.6.3",
         "@vitest/coverage-v8": "^5.0.2",
         "eslint": "^10.11.0",
-        "fallow": "^3.28.0",
+        "fallow": "^3.29.0",
         "fast-check": "^4.10.2",
         "prettier": "^3.9.9",
         "sonda": "^0.14.0",