@dpuse/dpuse-shared 0.3.840 → 0.3.851

package/README.md

@@ -28,13 +28,17 @@ In addition, DPUse provides [Tools](https://www.dpuse.app) used by the applicati
 
 <!-- OPENING_END -->
 
+<!-- USAGE_START -->
+
 ## Usage
 
-<!-- USAGE_START -->
+This package is published to the [public npm registry](https://www.npmjs.com/package/@dpuse/dpuse-shared). Install it with:
 
-This connector is automatically uploaded to the DPUse Engine cloud once released and becomes instantly available to all new browser app instances, with existing instances notified of the update.
+```bash
+npm install @dpuse/dpuse-shared
+```
 
-You may view or clone this repository for your own purposes, such as building a new, similar connector, though there is currently no process to accept third-party connectors into DPUse at this stage. Cloned or forked code is unsupported and isn't guaranteed to remain compatible with the DPUse Engine as it evolves.
+To work on the source instead, clone this repository. Cloned or forked code is unsupported and isn't guaranteed to remain compatible with the DPUse Engine as it evolves.
 
 ```bash
 git clone https://github.com/dpuse/dpuse-shared.git
@@ -234,13 +238,24 @@ _Note: Sonda's Vite reports currently exclude CSS files, since Vite does not gen
 
 ## Security & Quality
 
-### CodeQL
-
-[CodeQL](https://github.com/dpuse/dpuse-shared/security/code-scanning) static analysis runs on every push to `main` and on a weekly schedule, scanning TypeScript, JavaScript, Rust, and GitHub Actions workflow files for security vulnerabilities and coding errors.
-
-### SonarCloud
-
-[SonarCloud](https://sonarcloud.io/summary/new_code?id=dpuse_dpuse-shared) performs continuous code quality and security analysis on every push, detecting bugs, code smells, and security vulnerabilities in the TypeScript source.
+### Checks & Settings
+
+Read from the repository each time this README is generated, so the status is current as of the latest release.
+
+|Check or setting|Status|What it does|
+|:-|:-|:-|
+|[CodeQL](https://github.com/dpuse/dpuse-shared/security/code-scanning)|✅ GitHub Actions, JavaScript/TypeScript|Static analysis for security vulnerabilities and coding errors, on every push and pull request to `main` and weekly.|
+|[SonarCloud](https://sonarcloud.io/summary/new_code?id=dpuse_dpuse-shared)|✅ On|Code quality and security analysis on every push: bugs, code smells and vulnerabilities.|
+|Unit tests|✅ On|Run in CI on every push to `main`.|
+|Property-based tests|✅ fast-check|Fuzz testing: many random inputs per test to find edge cases, run with the unit tests.|
+|npm audit|✅ On|Fails CI when any dependency has a known vulnerability.|
+|[Socket.dev](https://socket.dev)|✅ On|Flags supply chain risk in dependencies: malicious packages, typosquatting and suspicious behaviour that may not yet have a CVE.|
+|Dependabot alerts|✅ On|Alerts when a dependency has a known vulnerability, using the GitHub Advisory Database.|
+|Dependabot security updates|❌ Off|Opens pull requests that update vulnerable dependencies.|
+|Dependabot version updates|❌ Off|Opens pull requests for new dependency versions.|
+|Secret scanning|✅ On|Detects credentials, such as API keys and tokens, committed to the repository.|
+|Push protection|✅ On|Blocks pushes that contain credentials.|
+|Private vulnerability reporting|✅ On|Lets anyone report a vulnerability privately. See [Reporting Vulnerabilities](#reporting-vulnerabilities).|
 
 ### Code Health
 
@@ -255,31 +270,21 @@ _Note: Sonda's Vite reports currently exclude CSS files, since Vite does not gen
 |Unused files|0.0%|
 |Unused exports|0.0%|
 |Duplicated code|0.0%|
-|Functions over the complexity limits|4 of 83|
+|Functions over the complexity limits|0 of 83|
 |Unused dependencies|0|
 |Circular dependencies|0|
 |Hotspots (complex and often changed)|1|
 
-### Vulnerability Scanning
-
-Two complementary tools continuously monitor dependencies for known vulnerabilities:
-
-- [npm audit](https://docs.npmjs.com/cli/v8/commands/npm-audit) runs on every push to `main` via the CI workflow, failing the build if any high or critical severity vulnerabilities are detected.
-- [GitHub Dependabot](https://docs.github.com/en/code-security/dependabot) automatically raises pull requests to update vulnerable dependencies, drawing on the GitHub Advisory Database which combines NVD and npm-specific advisories.
-
-### Supply Chain Security
-
-[Socket.dev](https://socket.dev) monitors all dependencies for supply chain risk — detecting malicious packages, dependency confusion, typosquatting, and suspicious behaviour that may not yet have a CVE.
-
 ### Reporting Vulnerabilities
 
 Please do not open public GitHub issues for security vulnerabilities. Use [GitHub private vulnerability reporting](https://github.com/dpuse/dpuse-shared/security/advisories/new) instead. See [SECURITY.md](./SECURITY.md) for the full disclosure policy, contact details, and expected response times.
 
 ### OpenSSF 🚧
 
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14952/badge)](https://www.bestpractices.dev/projects/14952)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/dpuse/dpuse-shared/badge)](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-shared)
 
-This project is working towards the [OpenSSF Best Practices](https://www.bestpractices.dev) Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. Currently the [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-shared) provides an independent automated assessment of the project's security practices and is an ongoing area of improvement.
+This project is working towards the [OpenSSF Best Practices](https://www.bestpractices.dev) Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. Currently the [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-shared) provides an independent automated assessment of the project's security practices and is an ongoing area of improvement. Apart from the Best Practices badge above, the remaining Scorecard gaps need multi-person review or a pull-request workflow, which this solo-maintained project doesn't use.
 
 ## Contributing
 
@@ -291,6 +296,6 @@ For security vulnerabilities, see [Reporting Vulnerabilities](#reporting-vulnera
 
 This project is licensed under the MIT License, permitting free use, modification, and distribution.
 
-[MIT](./LICENSE) © 2026-present Jonathan Terrell
+[MIT](./LICENSE) © 2026 Jonathan Terrell
 
 <!-- GOVERNANCE_END -->

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@dpuse/dpuse-shared",
-    "version": "0.3.840",
+    "version": "0.3.851",
     "private": false,
     "description": "Common constants, types and utilities used across all DPUse projects.",
     "license": "MIT",
@@ -170,12 +170,12 @@
         "valibot": "^1.5.0"
     },
     "devDependencies": {
-        "@dpuse/dpuse-development": "^0.3.741",
+        "@dpuse/dpuse-development": "^0.3.747",
         "@dpuse/eslint-config-dpuse": "^1.0.123",
-        "@types/node": "^26.6.2",
+        "@types/node": "^26.6.3",
         "@vitest/coverage-v8": "^5.0.2",
         "eslint": "^10.11.0",
-        "fallow": "^3.28.0",
+        "fallow": "^3.29.0",
         "fast-check": "^4.10.2",
         "prettier": "^3.9.9",
         "sonda": "^0.14.0",