@dpuse/dpuse-tool-d3 0.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +261 -0
- package/dist/dpuse-tool-d3.es.js +1150 -0
- package/dist/dpuse-tool-d3.es.js.map +1 -0
- package/dist/types/eslint.config.d.ts +3 -0
- package/dist/types/src/index.d.ts +9 -0
- package/dist/types/src/palette.d.ts +15 -0
- package/dist/types/src/sankeyDiagram.d.ts +24 -0
- package/dist/types/tests/importIndex.test.d.ts +1 -0
- package/dist/types/tests/sankeyDiagram.test.d.ts +1 -0
- package/dist/types/vite.config.d.ts +2 -0
- package/dist/types/vitest.config.d.ts +2 -0
- package/package.json +78 -0
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Jonathan Terrell
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
ADDED
|
@@ -0,0 +1,261 @@
|
|
|
1
|
+
# DPUse D3 Tool
|
|
2
|
+
|
|
3
|
+
[](./LICENSE)
|
|
4
|
+
|
|
5
|
+
A TypeScript wrapper for D3 that implements the Data Positioning chart-rendering interface, starting with a Sankey
|
|
6
|
+
diagram renderer built on `d3-sankey` and `d3-selection`.
|
|
7
|
+
|
|
8
|
+
## Installation
|
|
9
|
+
|
|
10
|
+
There's no need to install this tool manually. Once released, it's uploaded to the Data Positioning Engine cloud and
|
|
11
|
+
becomes instantly available to all new instances of the browser app. A notification about the new version is also
|
|
12
|
+
sent to all existing browser apps.
|
|
13
|
+
|
|
14
|
+
## Usage
|
|
15
|
+
|
|
16
|
+
Basic usage example with no error handling.
|
|
17
|
+
|
|
18
|
+
```typescript
|
|
19
|
+
import type { D3Tool as D3ToolType, SankeyDiagramData } from '@dpuse/dpuse-tool-d3';
|
|
20
|
+
|
|
21
|
+
async function loadD3Tool(version: string): Promise<D3ToolType> {
|
|
22
|
+
if (d3Tool) return d3Tool;
|
|
23
|
+
|
|
24
|
+
const URL = `https://engine-eu.dpuse.app/tools/d3_v${version}/dpuse-tool-d3.es.js`;
|
|
25
|
+
const D3Tool = (await import(/* @vite-ignore */ URL)).D3Tool as new () => D3ToolType;
|
|
26
|
+
return new D3Tool();
|
|
27
|
+
}
|
|
28
|
+
|
|
29
|
+
const d3Tool = await loadD3Tool('n.n.nnn');
|
|
30
|
+
|
|
31
|
+
const data: SankeyDiagramData = {
|
|
32
|
+
nodes: [
|
|
33
|
+
{ id: 'sourcing', name: 'Sourcing' },
|
|
34
|
+
{ id: 'contextualising', name: 'Contextualising' },
|
|
35
|
+
{ id: 'publishing', name: 'Publishing' }
|
|
36
|
+
],
|
|
37
|
+
links: [
|
|
38
|
+
{ source: 'sourcing', target: 'contextualising', value: 8 },
|
|
39
|
+
{ source: 'contextualising', target: 'publishing', value: 5 }
|
|
40
|
+
]
|
|
41
|
+
};
|
|
42
|
+
|
|
43
|
+
const view = d3Tool.renderSankeyDiagram(data, renderTo);
|
|
44
|
+
// Call view.resize() after the container's size changes to redraw the layout.
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
<!-- DEPENDENCY_LICENSES_START -->
|
|
48
|
+
|
|
49
|
+
License data is collected automatically on each release using [license-checker](https://github.com/RSeidelsohn/license-checker-rseidelsohn). The following table lists all production dependencies. These dependencies (including transitive ones) have been checked and confirmed to use BSD-3-Clause, ISC, or MIT — all permissive, commercially-friendly licenses. Users of the uploaded library are covered by these checks; developers cloning this repository should independently verify development dependencies.
|
|
50
|
+
|
|
51
|
+
|Dependency|Version|License(s)|Document|
|
|
52
|
+
|:-|:-:|:-|:-|
|
|
53
|
+
|[@dpuse/dpuse-shared](https://github.com/dpuse/dpuse-shared)|0.3.758|MIT|[LICENSE](licenses/downloads/@dpuse/dpuse-shared@0.3.758-LICENSE.txt)|
|
|
54
|
+
|[d3-array](https://github.com/d3/d3-array)|2.12.1|BSD-3-Clause|[LICENSE](licenses/downloads/d3-array@2.12.1-LICENSE.txt)|
|
|
55
|
+
|[d3-path](https://github.com/d3/d3-path)|1.0.9|BSD-3-Clause|[LICENSE](licenses/downloads/d3-path@1.0.9-LICENSE.txt)|
|
|
56
|
+
|[d3-sankey](https://github.com/d3/d3-sankey)|0.12.3|BSD-3-Clause|[LICENSE](licenses/downloads/d3-sankey@0.12.3-LICENSE.txt)|
|
|
57
|
+
|[d3-selection](https://github.com/d3/d3-selection)|3.0.0|ISC|[LICENSE](licenses/downloads/d3-selection@3.0.0-LICENSE.txt)|
|
|
58
|
+
|[d3-shape](https://github.com/d3/d3-shape)|1.3.7|BSD-3-Clause|[LICENSE](licenses/downloads/d3-shape@1.3.7-LICENSE.txt)|
|
|
59
|
+
|[internmap](https://github.com/mbostock/internmap)|1.0.1|ISC|[LICENSE](licenses/downloads/internmap@1.0.1-LICENSE.txt)|
|
|
60
|
+
|
|
61
|
+
<!-- DEPENDENCY_LICENSES_END -->
|
|
62
|
+
|
|
63
|
+
<!-- DEPENDENCY_TREE_START -->
|
|
64
|
+
|
|
65
|
+
The dependency tree below lists every package in this project — direct and transitive — along with its installed version, release date, and update status. Packages flagged ❗ have a newer version available; ⚠️ indicates a package that hasn't been updated in the last 6 months or longer. Neither flag necessarily indicates a problem: we let new releases stabilise before upgrading, and some packages are simply mature and stable, requiring no active development.
|
|
66
|
+
|
|
67
|
+
- **[@dpuse/dpuse-shared](https://github.com/dpuse/dpuse-shared)** 0.3.758 — this month: 2026-07-27
|
|
68
|
+
- **[d3-sankey](https://github.com/d3/d3-sankey)** 0.12.3 — **82 months** ago: 2019-09-02 ⚠️
|
|
69
|
+
- **[d3-array](https://github.com/d3/d3-array)** 2.12.1 — **64 months** ago: 2021-03-24 ⚠️ → **latest**: 3.2.4 — **38 months** ago: 2023-05-30 ⚠️ ❗
|
|
70
|
+
- **[internmap](https://github.com/mbostock/internmap)** 1.0.1 — **64 months** ago: 2021-03-10 ⚠️ → **latest**: 2.0.3 — **58 months** ago: 2021-09-20 ⚠️ ❗
|
|
71
|
+
- **[d3-shape](https://github.com/d3/d3-shape)** 1.3.7 — **80 months** ago: 2019-11-16 ⚠️ → **latest**: 3.2.0 — **43 months** ago: 2022-12-20 ⚠️ ❗
|
|
72
|
+
- **[d3-path](https://github.com/d3/d3-path)** 1.0.9 — **80 months** ago: 2019-11-16 ⚠️ → **latest**: 3.1.0 — **43 months** ago: 2022-12-19 ⚠️ ❗
|
|
73
|
+
- **[d3-selection](https://github.com/d3/d3-selection)** 3.0.0 — **61 months** ago: 2021-06-07 ⚠️
|
|
74
|
+
|
|
75
|
+
<!-- DEPENDENCY_TREE_END -->
|
|
76
|
+
|
|
77
|
+
<!-- USAGE_START -->
|
|
78
|
+
|
|
79
|
+
This connector is automatically uploaded to the DPUse Engine cloud once released and becomes instantly available to all new browser app instances, with existing instances notified of the update.
|
|
80
|
+
|
|
81
|
+
You may view or clone this repository for your own purposes, such as building a new, similar connector, though there is currently no process to accept third-party connectors into DPUse at this stage. Cloned or forked code is unsupported and isn't guaranteed to remain compatible with the DPUse Engine as it evolves.
|
|
82
|
+
|
|
83
|
+
```bash
|
|
84
|
+
git clone https://github.com/dpuse/dpuse-tool-d3.git
|
|
85
|
+
cd dpuse-tool-d3
|
|
86
|
+
npm install
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
_Requires [Node.js](https://nodejs.org/) 23.11 or later, [npm](https://www.npmjs.com/) 11 or later, and [TypeScript](https://www.typescriptlang.org/) 6.0.3 or later._
|
|
90
|
+
|
|
91
|
+
<!-- USAGE_END -->
|
|
92
|
+
|
|
93
|
+
<!-- BUNDLE_START -->
|
|
94
|
+
|
|
95
|
+
The Bundle Analysis Report is generated automatically on each release using [Sonda](https://sonda.dev/), which analyses final source maps to reveal the actual effects of tree-shaking and minification rather than relying on pre-build estimates.
|
|
96
|
+
|
|
97
|
+
_Note: Sonda's Vite reports currently exclude CSS files, since Vite does not generate source maps for CSS._
|
|
98
|
+
|
|
99
|
+
|Chunk/Module/File|Composition|
|
|
100
|
+
|:------ |:-----------|
|
|
101
|
+
| dist/dpuse-tool-d3.es.js | 33.6 kB · brotli 7.8 kB |
|
|
102
|
+
| d3-selection | `████████░░░░░░░░░░░░` 42.3% |
|
|
103
|
+
| src/selection/data.js | `█░░░░░░░░░░░░░░░░░░░` 4.1% |
|
|
104
|
+
| src/selection/on.js | `█░░░░░░░░░░░░░░░░░░░` 4.0% |
|
|
105
|
+
| src/selection/classed.js | `█░░░░░░░░░░░░░░░░░░░` 3.4% |
|
|
106
|
+
| src/selection/attr.js | `█░░░░░░░░░░░░░░░░░░░` 2.6% |
|
|
107
|
+
| src/selection/index.js | `░░░░░░░░░░░░░░░░░░░░` 1.8% |
|
|
108
|
+
| src/selection/style.js | `░░░░░░░░░░░░░░░░░░░░` 1.7% |
|
|
109
|
+
| src/selection/enter.js | `░░░░░░░░░░░░░░░░░░░░` 1.6% |
|
|
110
|
+
| src/selection/dispatch.js | `░░░░░░░░░░░░░░░░░░░░` 1.4% |
|
|
111
|
+
| src/creator.js | `░░░░░░░░░░░░░░░░░░░░` 1.2% |
|
|
112
|
+
| src/selection/sort.js | `░░░░░░░░░░░░░░░░░░░░` 1.2% |
|
|
113
|
+
| src/selection/property.js | `░░░░░░░░░░░░░░░░░░░░` 1.1% |
|
|
114
|
+
| src/selection/merge.js | `░░░░░░░░░░░░░░░░░░░░` 1.1% |
|
|
115
|
+
| src/selection/selectAll.js | `░░░░░░░░░░░░░░░░░░░░` 1.0% |
|
|
116
|
+
| src/selection/select.js | `░░░░░░░░░░░░░░░░░░░░` 1.0% |
|
|
117
|
+
| src/selection/text.js | `░░░░░░░░░░░░░░░░░░░░` 1.0% |
|
|
118
|
+
| src/selection/html.js | `░░░░░░░░░░░░░░░░░░░░` 1.0% |
|
|
119
|
+
| src/selection/clone.js | `░░░░░░░░░░░░░░░░░░░░` 0.8% |
|
|
120
|
+
| src/selection/filter.js | `░░░░░░░░░░░░░░░░░░░░` 0.8% |
|
|
121
|
+
| src/selection/insert.js | `░░░░░░░░░░░░░░░░░░░░` 0.8% |
|
|
122
|
+
| src/selection/join.js | `░░░░░░░░░░░░░░░░░░░░` 0.8% |
|
|
123
|
+
| src/selection/selectChildren.js | `░░░░░░░░░░░░░░░░░░░░` 0.7% |
|
|
124
|
+
| src/selection/order.js | `░░░░░░░░░░░░░░░░░░░░` 0.7% |
|
|
125
|
+
| src/selection/selectChild.js | `░░░░░░░░░░░░░░░░░░░░` 0.7% |
|
|
126
|
+
| src/namespaces.js | `░░░░░░░░░░░░░░░░░░░░` 0.6% |
|
|
127
|
+
| src/selection/each.js | `░░░░░░░░░░░░░░░░░░░░` 0.6% |
|
|
128
|
+
| src/namespace.js | `░░░░░░░░░░░░░░░░░░░░` 0.5% |
|
|
129
|
+
| src/selection/node.js | `░░░░░░░░░░░░░░░░░░░░` 0.5% |
|
|
130
|
+
| src/selection/iterator.js | `░░░░░░░░░░░░░░░░░░░░` 0.5% |
|
|
131
|
+
| src/selection/append.js | `░░░░░░░░░░░░░░░░░░░░` 0.4% |
|
|
132
|
+
| src/selection/lower.js | `░░░░░░░░░░░░░░░░░░░░` 0.4% |
|
|
133
|
+
| src/select.js | `░░░░░░░░░░░░░░░░░░░░` 0.4% |
|
|
134
|
+
| src/matcher.js | `░░░░░░░░░░░░░░░░░░░░` 0.4% |
|
|
135
|
+
| src/selectorAll.js | `░░░░░░░░░░░░░░░░░░░░` 0.3% |
|
|
136
|
+
| src/selection/raise.js | `░░░░░░░░░░░░░░░░░░░░` 0.3% |
|
|
137
|
+
| src/selection/remove.js | `░░░░░░░░░░░░░░░░░░░░` 0.3% |
|
|
138
|
+
| src/window.js | `░░░░░░░░░░░░░░░░░░░░` 0.3% |
|
|
139
|
+
| src/selector.js | `░░░░░░░░░░░░░░░░░░░░` 0.3% |
|
|
140
|
+
| src/selection/call.js | `░░░░░░░░░░░░░░░░░░░░` 0.3% |
|
|
141
|
+
| src/selection/datum.js | `░░░░░░░░░░░░░░░░░░░░` 0.3% |
|
|
142
|
+
| src/selection/exit.js | `░░░░░░░░░░░░░░░░░░░░` 0.2% |
|
|
143
|
+
| src/array.js | `░░░░░░░░░░░░░░░░░░░░` 0.2% |
|
|
144
|
+
| src/selection/size.js | `░░░░░░░░░░░░░░░░░░░░` 0.2% |
|
|
145
|
+
| src/constant.js | `░░░░░░░░░░░░░░░░░░░░` 0.1% |
|
|
146
|
+
| src/selection/nodes.js | `░░░░░░░░░░░░░░░░░░░░` 0.1% |
|
|
147
|
+
| src/selection/sparse.js | `░░░░░░░░░░░░░░░░░░░░` 0.1% |
|
|
148
|
+
| src/selection/empty.js | `░░░░░░░░░░░░░░░░░░░░` 0.1% |
|
|
149
|
+
| d3-sankey | `████░░░░░░░░░░░░░░░░` 18.2% |
|
|
150
|
+
| src/sankey.js | `███░░░░░░░░░░░░░░░░░` 17.4% |
|
|
151
|
+
| src/sankeyLinkHorizontal.js | `░░░░░░░░░░░░░░░░░░░░` 0.4% |
|
|
152
|
+
| src/align.js | `░░░░░░░░░░░░░░░░░░░░` 0.2% |
|
|
153
|
+
| src/constant.js | `░░░░░░░░░░░░░░░░░░░░` 0.1% |
|
|
154
|
+
| (unassigned) → [unassigned] | `███░░░░░░░░░░░░░░░░░` 15.6% |
|
|
155
|
+
| src | `██░░░░░░░░░░░░░░░░░░` 11.7% |
|
|
156
|
+
| sankeyDiagram.ts | `██░░░░░░░░░░░░░░░░░░` 8.9% |
|
|
157
|
+
| palette.ts | `░░░░░░░░░░░░░░░░░░░░` 2.3% |
|
|
158
|
+
| index.ts | `░░░░░░░░░░░░░░░░░░░░` 0.5% |
|
|
159
|
+
| d3-path → src/path.js | `█░░░░░░░░░░░░░░░░░░░` 7.2% |
|
|
160
|
+
| d3-shape | `█░░░░░░░░░░░░░░░░░░░` 3.2% |
|
|
161
|
+
| src/link/index.js | `█░░░░░░░░░░░░░░░░░░░` 2.7% |
|
|
162
|
+
| src/point.js | `░░░░░░░░░░░░░░░░░░░░` 0.2% |
|
|
163
|
+
| src/constant.js | `░░░░░░░░░░░░░░░░░░░░` 0.2% |
|
|
164
|
+
| src/array.js | `░░░░░░░░░░░░░░░░░░░░` 0.1% |
|
|
165
|
+
| d3-array | `░░░░░░░░░░░░░░░░░░░░` 1.9% |
|
|
166
|
+
| src/min.js | `░░░░░░░░░░░░░░░░░░░░` 0.7% |
|
|
167
|
+
| src/max.js | `░░░░░░░░░░░░░░░░░░░░` 0.7% |
|
|
168
|
+
| src/sum.js | `░░░░░░░░░░░░░░░░░░░░` 0.5% |
|
|
169
|
+
|
|
170
|
+
(unassigned) = bytes Sonda can't trace to a specific source line (whitespace, stray keywords, bundler-injected region markers) — not actual missing/unknown code.
|
|
171
|
+
|
|
172
|
+
<!-- BUNDLE_END -->
|
|
173
|
+
|
|
174
|
+
## Design Notes
|
|
175
|
+
|
|
176
|
+
- All D3 submodules (`d3-sankey`, `d3-selection`, and their transitive `d3-array`/`d3-shape` dependencies) are bundled
|
|
177
|
+
directly into this tool's build, the same way `@dpuse/dpuse-tool-highcharts` bundles Highcharts. There is exactly
|
|
178
|
+
one copy of each module per page load regardless of how many times this tool is dynamically imported, since the
|
|
179
|
+
browser's module registry caches `import()` calls by resolved URL.
|
|
180
|
+
- Rendering happens on the main thread because it writes directly into a real `HTMLElement` - the DPUse Engine's
|
|
181
|
+
connector/context processing runs inside a dedicated Web Worker, but presentation-rendering tools (this one and
|
|
182
|
+
Highcharts) are loaded the same way `dpuse-presenter-default` is, directly by the host app.
|
|
183
|
+
- Node identity is carried by a direct text label on every node, not by colour alone, so the categorical palette is
|
|
184
|
+
free to cycle past its 8 fixed slots for diagrams with more nodes than that.
|
|
185
|
+
|
|
186
|
+
<!-- OPENING_START -->
|
|
187
|
+
|
|
188
|
+
[](./LICENSE)
|
|
189
|
+
[](https://github.com/dpuse/dpuse-tool-d3/releases/latest)
|
|
190
|
+
[](https://github.com/dpuse/dpuse-tool-d3/actions/workflows/ci.yml)
|
|
191
|
+
[](https://github.com/dpuse/dpuse-tool-d3/actions/workflows/codeql.yml)
|
|
192
|
+
[](https://sonarcloud.io/summary/new_code?id=dpuse_dpuse-tool-d3)
|
|
193
|
+
|
|
194
|
+
[Documentation](https://www.dpuse.app) · [Report a Vulnerability](https://github.com/dpuse/dpuse-tool-d3/security/advisories/new) · [Open an Issue](https://github.com/dpuse/dpuse-tool-d3/issues)
|
|
195
|
+
|
|
196
|
+
## About DPUse
|
|
197
|
+
|
|
198
|
+
DPUse (Data Positioning & Use) is an in-browser application that positions your data for use through three core activities: sourcing, contextualising, and publishing. **Sourcing** uses a library of [Connectors](https://www.dpuse.app) to establish [Connections](https://www.dpuse.app) to applications, databases, file stores, and curated datasets; these connections are subsequently used to configure structured [Data Views](https://www.dpuse.app) from the underlying sources. **Contextualising** extracts chronological events from those [Data Views](https://www.dpuse.app) and maps them into comprehensive [Context Models](https://www.dpuse.app). This provides the DPUse Engine with the structural framework required to generate deterministic transactions, facts, or observations. **Publishing** employs a library of [Presenters](https://www.dpuse.app) to render standard [Presentations](https://www.dpuse.app) immediately using the contextualised data; additionally, [Cookbooks](https://www.dpuse.app) of [Recipes](https://www.dpuse.app) allow you to build Data Apps using your preferred tools.
|
|
199
|
+
|
|
200
|
+
## Introduction
|
|
201
|
+
|
|
202
|
+
...
|
|
203
|
+
|
|
204
|
+
<!-- OPENING_END -->
|
|
205
|
+
|
|
206
|
+
## Contributing
|
|
207
|
+
|
|
208
|
+
This repository is maintained solely by its owner and does not, at present, accept external contributions into the canonical repo. Its source is published openly under the MIT License.
|
|
209
|
+
|
|
210
|
+
## License
|
|
211
|
+
|
|
212
|
+
This project is licensed under the MIT License, permitting free use, modification, and distribution.
|
|
213
|
+
|
|
214
|
+
[MIT](./LICENSE) © 2026-present Jonathan Terrell
|
|
215
|
+
|
|
216
|
+
<!-- GOVERNANCE_START -->
|
|
217
|
+
|
|
218
|
+
## Security & Quality
|
|
219
|
+
|
|
220
|
+
### CodeQL
|
|
221
|
+
|
|
222
|
+
[CodeQL](https://github.com/dpuse/dpuse-tool-d3/security/code-scanning) static analysis runs on every push to `main` and on a weekly schedule, scanning TypeScript, JavaScript, Rust, and GitHub Actions workflow files for security vulnerabilities and coding errors.
|
|
223
|
+
|
|
224
|
+
### SonarCloud
|
|
225
|
+
|
|
226
|
+
[SonarCloud](https://sonarcloud.io/summary/new_code?id=dpuse_dpuse-tool-d3) performs continuous code quality and security analysis on every push, detecting bugs, code smells, and security vulnerabilities in the TypeScript source.
|
|
227
|
+
|
|
228
|
+
### Vulnerability Scanning
|
|
229
|
+
|
|
230
|
+
Two complementary tools continuously monitor dependencies for known vulnerabilities:
|
|
231
|
+
|
|
232
|
+
- [npm audit](https://docs.npmjs.com/cli/v8/commands/npm-audit) runs on every push to `main` via the CI workflow, failing the build if any high or critical severity vulnerabilities are detected.
|
|
233
|
+
- [GitHub Dependabot](https://docs.github.com/en/code-security/dependabot) automatically raises pull requests to update vulnerable dependencies, drawing on the GitHub Advisory Database which combines NVD and npm-specific advisories.
|
|
234
|
+
|
|
235
|
+
### Supply Chain Security
|
|
236
|
+
|
|
237
|
+
[Socket.dev](https://socket.dev) monitors all dependencies for supply chain risk — detecting malicious packages, dependency confusion, typosquatting, and suspicious behaviour that may not yet have a CVE.
|
|
238
|
+
|
|
239
|
+
### Reporting Vulnerabilities
|
|
240
|
+
|
|
241
|
+
Please do not open public GitHub issues for security vulnerabilities. Use [GitHub private vulnerability reporting](https://github.com/dpuse/dpuse-tool-d3/security/advisories/new) instead. See [SECURITY.md](./SECURITY.md) for the full disclosure policy, contact details, and expected response times.
|
|
242
|
+
|
|
243
|
+
### OpenSSF 🚧
|
|
244
|
+
|
|
245
|
+
[](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-tool-d3)
|
|
246
|
+
|
|
247
|
+
This project is working towards the [OpenSSF Best Practices](https://www.bestpractices.dev) Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. Currently the [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-tool-d3) provides an independent automated assessment of the project's security practices and is an ongoing area of improvement.
|
|
248
|
+
|
|
249
|
+
## Contributing
|
|
250
|
+
|
|
251
|
+
This repository is maintained solely by its owner and does not, at present, accept external contributions into the canonical repo. Its source is published openly under the MIT License — every DPUse project is fully open source except DPUse Engine, which remains closed and proprietary.
|
|
252
|
+
|
|
253
|
+
For security vulnerabilities, see [Reporting Vulnerabilities](#reporting-vulnerabilities). For bugs, inconsistencies, or other feedback, [open a GitHub issue](https://github.com/dpuse/dpuse-tool-d3/issues) — feedback is read, but responses and fixes are at the maintainer's discretion.
|
|
254
|
+
|
|
255
|
+
## License
|
|
256
|
+
|
|
257
|
+
This project is licensed under the MIT License, permitting free use, modification, and distribution.
|
|
258
|
+
|
|
259
|
+
[MIT](./LICENSE) © 2026-present Jonathan Terrell
|
|
260
|
+
|
|
261
|
+
<!-- GOVERNANCE_END -->
|