{
  "schema": "wcc-upstream-security-probe/1",
  "observedAt": "2026-11-01T10:06:52.977608+00:00",
  "purpose": "Fresh evidence-only selected Chromium probes against the exact published1.1.5 MIT Core TGZ; no runtime edits. Results were executed anew, not relabelled from1.1.4.",
  "artifact": {
    "version": "1.1.5",
    "sourceCommit": "95f093ba8d388c579d9f94701d3322c728c77632",
    "publicCommit": "bdb919664ca330f98ba8798087bc6db0450f0b7c",
    "runtimePath": "dist/west-coast-charts.min.js",
    "runtimeBytes": 683215,
    "runtimeSha256": "d1abf081be4ade4ea4893bc52555dcc8943628e53d2fc7fa5fea12ad64f23cde",
    "publicRuntimePath": "hash-verified canonical public TGZ: package/dist/west-coast-charts.min.js",
    "publicRuntimeBytes": 683215,
    "publicRuntimeSha256": "d1abf081be4ade4ea4893bc52555dcc8943628e53d2fc7fa5fea12ad64f23cde",
    "comparisonScope": "Tested bytes equal the exact canonical1.1.5 archive member; no results are borrowed from historical release probes.",
    "publicCoreArchiveSha256": "c4a4fdfebe81f29ad27b6e583e3a343e79e93633f54208f0c26a6d586a577dcc",
    "publicCoreArchiveBytes": 3361597,
    "integritySha256": "e08a2ecbf7f1ddcf86c150caf848652e91fd89b17ffd99ce1cf4766dd24b81f3",
    "provenanceSha256": "0080f9fdf1450a73bc4ea4643bfe68d8fb9ff1ca9ab5d67ce384c376c0021a88",
    "publishedAtTestTime": true,
    "testedRuntimeMatchesPublicArchive": true
  },
  "environment": {
    "browser": "Playwright Chromium",
    "version": "156.0.8078.4",
    "playwrightVersion": "1.64.0-alpha-1790635538000",
    "network": "Browser requests to every non-loopback origin are aborted; hostile image URLs resolve only to a local 404.",
    "nonLoopbackRequestCount": 0,
    "pageErrors": []
  },
  "evidence": {
    "raw": {
      "path": "probe-results-raw.json",
      "sha256": "70527817e3d748421376a64dcfcd34f5b3536bf01928438eefa415db8ab5415f",
      "bytes": 66076
    },
    "harness": {
      "path": "probe-harness.mjs",
      "sha256": "90be42da26b84896d6b8fbe23e31c3e031f8f06521bafb8fe907d953131bf6be",
      "bytes": 15800
    },
    "manifestSha256": "ade40bc2f113acaf94f976d72e78778b7b395c85c514bd83ddd02410efc1009d"
  },
  "cases": [
    {
      "id": "GH-3328",
      "source": "https://github.com/apexcharts/apexcharts.js/issues/3328",
      "sink": "series.name -> default legend label and rendered chart DOM",
      "result": "not-reproduced-in-tested-path",
      "events": [],
      "payloadHandlerAttributesObserved": 0,
      "pass": true
    },
    {
      "id": "GH-816",
      "source": "https://github.com/apexcharts/apexcharts.js/issues/816",
      "sink": "xaxis.categories -> x-axis tick text and point tooltip",
      "result": "not-reproduced-in-tested-path",
      "events": [],
      "payloadHandlerAttributesObserved": 0,
      "pass": true
    },
    {
      "id": "GH-3937",
      "source": "https://github.com/apexcharts/apexcharts.js/issues/3937",
      "sink": "point x value -> default tooltip label",
      "result": "not-reproduced-in-tested-path",
      "events": [],
      "payloadHandlerAttributesObserved": 0,
      "pass": true
    },
    {
      "id": "CVE-2021-23327-default-legend",
      "source": "https://github.com/advisories/GHSA-w46j-8hm6-h8mm",
      "sink": "series names -> default legend setContent path",
      "result": "not-reproduced-in-tested-path",
      "events": [],
      "payloadHandlerAttributesObserved": 0,
      "pass": true
    },
    {
      "id": "CVE-2021-23327-custom-formatter-sanitized",
      "source": "https://github.com/advisories/GHSA-w46j-8hm6-h8mm",
      "sink": "custom legend formatter -> sanitizer default",
      "result": "not-reproduced-in-tested-path",
      "events": [],
      "payloadHandlerAttributesObserved": 0,
      "pass": true
    },
    {
      "id": "CVE-2021-23327-explicit-raw-html-optout",
      "source": "https://github.com/advisories/GHSA-w46j-8hm6-h8mm",
      "sink": "custom legend formatter with explicit chart.sanitizeHtml=false",
      "result": "marker-executed-explicit-raw-html-optout",
      "events": [
        "cve-img",
        "cve-img"
      ],
      "payloadHandlerAttributesObserved": 2,
      "pass": true
    },
    {
      "id": "GH-5146",
      "source": "https://github.com/apexcharts/apexcharts.js/issues/5146",
      "sink": "Core dataURI/export path under issue policy style-src self (no unsafe-inline)",
      "result": "strict-style-csp-compatibility-violations-observed",
      "policy": "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; object-src 'none'; base-uri 'none'",
      "inlineStyleViolationsAfterRenderAndGetSvgString": 26,
      "inlineStyleViolationsAfterDataURI": 21,
      "exportError": null,
      "dataUriUnderCsp": "data:,",
      "dataUriWithoutCsp": "data:,",
      "interpretation": "Strict style-src compatibility violations remain observed. Empty data:, export occurs in both this CSP run and its no-CSP control; it is not attributed solely to CSP. Pass means the scoped observations were captured, not compatibility.",
      "pass": true
    },
    {
      "id": "GH-727",
      "source": "https://github.com/apexcharts/apexcharts.js/issues/727",
      "result": "strict-style-csp-compatibility-observed-in-tested-render",
      "sameRenderAs": "GH-5146",
      "inlineStyleViolationsAfterRenderAndGetSvgString": 26,
      "interpretation": "Same measured strict-style render, not an independent reproduction of every detail of the report.",
      "pass": true
    },
    {
      "id": "GH-2412",
      "source": "https://github.com/apexcharts/apexcharts.js/issues/2412",
      "result": "insufficient-primary-source-reproduction-data",
      "noTestRun": true,
      "detail": "GitHub issue body is an automated disclosure directing maintainers to an external huntr bounty page; it gives no payload, affected sink, chart options, or reproduction steps.",
      "pass": true
    },
    {
      "id": "GH-4502",
      "source": "https://github.com/apexcharts/apexcharts.js/issues/4502",
      "result": "dependency-version mismatch; redirect claim not reproduced",
      "reportedDependency": "svg.js 2.7.1",
      "artifactDependency": "@svgdotjs/svg.js 3.2.4 (package notices)",
      "nonLoopbackRequestCount": 0,
      "detail": "rendered charts in local browser with all non-loopback requests blocked; see blockedExternal list",
      "noUniversalClaim": true,
      "pass": true
    }
  ],
  "limits": [
    "Chromium only; selected paths/configurations only.",
    "No universal not-affected claim or security certification.",
    "Strict inline-style CSP incompatibility and empty data:, exports remain observed limitations.",
    "GH-2412 has no executable primary-source reproduction; GH-727 reuses the disclosed strict-style render.",
    "chart.sanitizeHtml=false explicitly allows unsafe raw HTML.",
    "An initial browser-launch setup error used a missing default1247 executable; it ran no cases. The completed fresh run explicitly used installed Chromium1248. Its setup log is retained separately under output/playwright/security-probes-1.1.5."
  ]
}