{
  "schemaVersion": 1,
  "generatedAt": "2026-10-30T10:51:17Z",
  "collectionReport": "./upstream-source-coverage.json",
  "importPolicy": "Collector output candidates begin OPEN and UNREVIEWED. Ledger triage changes require recorded evidence and human review; upstream title similarity, upstream issue closure, and later upstream changes do not prove WCC code replacement or resolution.",
  "records": [
    {
      "kind": "upstream-advisory",
      "id": "GHSA-w46j-8hm6-h8mm",
      "aliases": [
        "CVE-2021-23327"
      ],
      "sources": [
        {
          "source": "github-advisory-database",
          "id": "GHSA-w46j-8hm6-h8mm",
          "cve": "CVE-2021-23327",
          "summary": "XSS in apexcharts",
          "severity": "medium",
          "url": "https://github.com/advisories/GHSA-w46j-8hm6-h8mm",
          "publishedAt": "2021-02-11T20:47:34Z",
          "updatedAt": "2023-09-12T20:53:30Z",
          "affected": [
            {
              "ecosystem": "npm",
              "package": "apexcharts",
              "vulnerableVersionRange": "< 3.24.0",
              "firstPatchedVersion": null
            }
          ]
        },
        {
          "source": "osv",
          "id": "GHSA-w46j-8hm6-h8mm",
          "aliases": [
            "CVE-2021-23327"
          ],
          "summary": "XSS in apexcharts",
          "publishedAt": "2021-02-11T20:47:34Z",
          "updatedAt": "2025-01-14T08:57:20.231478Z",
          "affected": [
            {
              "ecosystem": "npm",
              "package": "apexcharts",
              "ranges": [
                {
                  "type": "SEMVER",
                  "events": [
                    {
                      "introduced": "0"
                    },
                    {
                      "fixed": "3.24.0"
                    }
                  ]
                }
              ]
            }
          ],
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-23327"
          ]
        }
      ],
      "summary": "XSS in apexcharts",
      "severity": "medium",
      "url": "https://github.com/advisories/GHSA-w46j-8hm6-h8mm",
      "triage": {
        "status": "under-review",
        "reviewStatus": "assessed-by-agent-awaiting-human-review",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "reviewNotes": {
        "wccStatus": "agent-assessed-under-review-awaiting-human-approval",
        "advisoryRange": "npm apexcharts <3.24.0; fixed version 3.24.0",
        "inheritedBase": "NOTICE identifies ApexCharts 4.7.0 as the inherited base",
        "evidence": [
          {
            "file": "public/wcc/west-coast-charts.min.js",
            "sha256": "ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0",
            "bytes": 683220,
            "version": "1.1.2",
            "commit": "853d26e1664aac05836b6a15d16e1050556cb61c",
            "finding": "Exact released artifact used for browser repro; 1.1.2 only."
          },
          {
            "file": "/audits/security-probes-1.1.2/probe-results.json",
            "finding": "Default legend payloads escaped; custom formatter sanitizer removed handlers; no marker execution in those paths."
          },
          {
            "file": "/audits/security-probes-1.1.2/probe-results.json",
            "finding": "Explicit chart.sanitizeHtml=false retained and executed local onerror marker; this is an explicit unsafe raw-HTML opt-out."
          }
        ],
        "nextEvidence": "Human maintainer review of the exact 1.1.2 artifact, browser evidence, and explicit raw-HTML opt-out boundary. Re-probe any later release artifact before claiming equivalence."
      },
      "assessment": "On the exact released WCC 1.1.2 Core UMD (SHA-256 ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0), tested default data-derived legend names rendered as text and custom formatter output with default sanitization retained no event handlers; neither tested default path executed the local marker. Explicit chart.sanitizeHtml=false retained and executed the local onerror marker. This is evidence only for these tested legend paths and artifact; raw HTML opt-out remains unsafe by design. Human review is pending; no universal not-affected conclusion.",
      "status": "under-review",
      "affectedVersions": [],
      "evidence": [
        "https://github.com/advisories/GHSA-w46j-8hm6-h8mm",
        "/audits/security-probes-1.1.2/probe-results.json"
      ],
      "fixedIn": null,
      "verification": [
        "Tested exact WCC 1.1.2 public Core UMD: 683220 bytes, SHA-256 ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0.",
        "Default legend payloads rendered as escaped text; custom formatter default sanitizer removed handlers; neither executed local marker.",
        "Explicit chart.sanitizeHtml=false executed local onerror marker. This is an explicitly unsafe raw-HTML opt-out.",
        "Evidence is limited to tested paths in 1.1.2; later artifacts require separate verification."
      ]
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-1029",
      "number": 1029,
      "title": "radar chart negative render stroke and markers error",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/1029",
      "createdAt": "2019-10-28T05:02:59Z",
      "updatedAt": "2019-12-27T10:14:58Z",
      "labels": [
        "bug",
        "radar"
      ],
      "triage": {
        "status": "open",
        "reviewStatus": "source-screened-candidate",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "finding": "Issue title/body reviewed; radar negative stroke/marker rendering behavior. No security applicability assessment made.",
        "scope": "Source-screened candidate only; applicability to WCC not assessed."
      },
      "reviewNotes": {
        "nextEvidence": "Human triage required if this item is selected for WCC applicability review; no not-affected or not-applicable conclusion is implied."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-2202",
      "number": 2202,
      "title": "HTML for tooltip is rendering as string",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/2202",
      "createdAt": "2021-02-03T08:53:03Z",
      "updatedAt": "2021-09-16T18:20:25Z",
      "labels": [
        "bug",
        "high-priority"
      ],
      "triage": {
        "status": "open",
        "reviewStatus": "source-screened-candidate",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "finding": "Issue title/body reviewed; tooltip HTML displayed as a string / compatibility behavior. No exploit payload or WCC sink was established.",
        "scope": "Source-screened candidate only; applicability to WCC not assessed."
      },
      "reviewNotes": {
        "nextEvidence": "Human triage required if this item is selected for WCC applicability review; no not-affected or not-applicable conclusion is implied."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-2214",
      "number": 2214,
      "title": "HTML no longer parsed in tooltip formatter",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/2214",
      "createdAt": "2021-02-07T09:52:18Z",
      "updatedAt": "2021-09-16T18:20:25Z",
      "labels": [
        "bug",
        "high-priority"
      ],
      "triage": {
        "status": "open",
        "reviewStatus": "source-screened-candidate",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "finding": "Issue title/body reviewed; tooltip formatter HTML parsing compatibility report. No exploit payload or WCC sink was established.",
        "scope": "Source-screened candidate only; applicability to WCC not assessed."
      },
      "reviewNotes": {
        "nextEvidence": "Human triage required if this item is selected for WCC applicability review; no not-affected or not-applicable conclusion is implied."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-238",
      "number": 238,
      "title": "ShadowDOM support",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/238",
      "createdAt": "2018-12-22T10:46:40Z",
      "updatedAt": "2021-11-11T06:26:04Z",
      "labels": [],
      "triage": {
        "status": "open",
        "reviewStatus": "source-screened-candidate",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "finding": "Issue title/body reviewed; ShadowDOM CSS support behavior. No security applicability assessment made.",
        "scope": "Source-screened candidate only; applicability to WCC not assessed."
      },
      "reviewNotes": {
        "nextEvidence": "Human triage required if this item is selected for WCC applicability review; no not-affected or not-applicable conclusion is implied."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-2412",
      "number": 2412,
      "title": "🚨 Potential Cross-site Scripting (XSS) - DOM",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/2412",
      "createdAt": "2021-05-17T09:03:50Z",
      "updatedAt": "2021-09-18T14:26:08Z",
      "labels": [
        "no-issue-activity"
      ],
      "triage": {
        "status": "under-review",
        "reviewStatus": "assessed-by-agent-awaiting-human-review",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "sink": "Primary report does not identify a testable sink",
        "finding": "Issue body is an automated disclosure with no payload, affected sink, chart configuration, or reproduction steps. No guessed payload was tested. Required next evidence: reporter/upstream payload, sink, chart options, affected version, and reproducible steps. No not-affected conclusion.",
        "artifact": {
          "version": "1.1.2",
          "sha256": "ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0"
        },
        "evidence": "/audits/security-probes-1.1.2/probe-results.json",
        "scope": "tested 1.1.2 artifact only; no inference to later releases"
      },
      "affectedVersions": [],
      "evidence": [
        "https://github.com/apexcharts/apexcharts.js/issues/2412",
        "/audits/security-probes-1.1.2/probe-results.json"
      ],
      "reviewNotes": {
        "nextEvidence": "Human maintainer review; for XSS candidates, obtain additional repro/configuration where current case did not reproduce; re-probe later release artifacts separately."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-2463",
      "number": 2463,
      "title": "v3.27.0 release breaks functionality for returning html from formatters",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/2463",
      "createdAt": "2021-06-11T18:41:54Z",
      "updatedAt": "2023-09-12T16:15:51Z",
      "labels": [
        "bug",
        "high-priority"
      ],
      "triage": {
        "status": "open",
        "reviewStatus": "source-screened-candidate",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "finding": "Issue title/body reviewed; formatter HTML compatibility change in upstream v3.27. No exploit payload or WCC sink was established.",
        "scope": "Source-screened candidate only; applicability to WCC not assessed."
      },
      "reviewNotes": {
        "nextEvidence": "Human triage required if this item is selected for WCC applicability review; no not-affected or not-applicable conclusion is implied."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-3328",
      "number": 3328,
      "title": "Series labels are vulnerable to XSS attacks ",
      "state": "open",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/3328",
      "createdAt": "2022-08-23T18:33:23Z",
      "updatedAt": "2025-01-15T10:57:56Z",
      "labels": [
        "bug"
      ],
      "triage": {
        "status": "under-review",
        "reviewStatus": "assessed-by-agent-awaiting-human-review",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "sink": "series.name -> default legend label and rendered chart DOM",
        "finding": "Issue injection shape was tested on exact 1.1.2 with local marker. Legend and tooltip escaped it; no child nodes or marker execution. Only tested configuration/path; agent assessment awaits human review.",
        "artifact": {
          "version": "1.1.2",
          "sha256": "ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0"
        },
        "evidence": "/audits/security-probes-1.1.2/probe-results.json",
        "scope": "tested 1.1.2 artifact only; no inference to later releases"
      },
      "affectedVersions": [],
      "evidence": [
        "https://github.com/apexcharts/apexcharts.js/issues/3328",
        "/audits/security-probes-1.1.2/probe-results.json"
      ],
      "reviewNotes": {
        "nextEvidence": "Human maintainer review; for XSS candidates, obtain additional repro/configuration where current case did not reproduce; re-probe later release artifacts separately."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-3539",
      "number": 3539,
      "title": "Columns - 1st and last columns not showing - 6 series - 5 columns (each with 5 datapoints) + 1 as a line",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/3539",
      "createdAt": "2022-12-07T22:43:31Z",
      "updatedAt": "2022-12-08T08:05:39Z",
      "labels": [],
      "triage": {
        "status": "open",
        "reviewStatus": "source-screened-candidate",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "finding": "Issue title/body reviewed; mixed column/line category rendering behavior. No security applicability assessment made.",
        "scope": "Source-screened candidate only; applicability to WCC not assessed."
      },
      "reviewNotes": {
        "nextEvidence": "Human triage required if this item is selected for WCC applicability review; no not-affected or not-applicable conclusion is implied."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-3937",
      "number": 3937,
      "title": "Tooltips evaluate malicious javascript by default",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/3937",
      "createdAt": "2023-07-20T20:49:49Z",
      "updatedAt": "2023-09-26T14:27:05Z",
      "labels": [
        "no-issue-activity"
      ],
      "triage": {
        "status": "under-review",
        "reviewStatus": "assessed-by-agent-awaiting-human-review",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "sink": "point x string -> default tooltip title",
        "finding": "Local image/onerror marker tested on exact 1.1.2 line-chart default tooltip; title escaped; no marker execution. This does not cover all tooltip configurations; agent assessment awaits human review.",
        "artifact": {
          "version": "1.1.2",
          "sha256": "ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0"
        },
        "evidence": "/audits/security-probes-1.1.2/probe-results.json",
        "scope": "tested 1.1.2 artifact only; no inference to later releases"
      },
      "affectedVersions": [],
      "evidence": [
        "https://github.com/apexcharts/apexcharts.js/issues/3937",
        "/audits/security-probes-1.1.2/probe-results.json"
      ],
      "reviewNotes": {
        "nextEvidence": "Human maintainer review; for XSS candidates, obtain additional repro/configuration where current case did not reproduce; re-probe later release artifacts separately."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-4502",
      "number": 4502,
      "title": "安全漏洞：更新内部 svg.js 文件",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/4502",
      "createdAt": "2024-06-02T15:07:49Z",
      "updatedAt": "2024-06-02T15:11:24Z",
      "labels": [
        "bug"
      ],
      "triage": {
        "status": "under-review",
        "reviewStatus": "assessed-by-agent-awaiting-human-review",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "sink": "Reported svg.js 2.7.1 redirect behavior / dependency version",
        "finding": "Issue alleges svg.js 2.7.1 behavior; tested 1.1.2 package notice identifies @svgdotjs/svg.js 3.2.4. Render made no external request. Dependency-version mismatch and this render do not establish behavior across all dependency paths/versions; human review pending.",
        "artifact": {
          "version": "1.1.2",
          "sha256": "ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0"
        },
        "evidence": "/audits/security-probes-1.1.2/probe-results.json",
        "scope": "tested 1.1.2 artifact only; no inference to later releases"
      },
      "affectedVersions": [],
      "evidence": [
        "https://github.com/apexcharts/apexcharts.js/issues/4502",
        "/audits/security-probes-1.1.2/probe-results.json"
      ],
      "reviewNotes": {
        "nextEvidence": "Human maintainer review; for XSS candidates, obtain additional repro/configuration where current case did not reproduce; re-probe later release artifacts separately."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-5146",
      "number": 5146,
      "title": "CSP Violation during Export (Strict Policy Incompatibility)",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/5146",
      "createdAt": "2025-12-22T17:01:44Z",
      "updatedAt": "2026-08-09T14:46:53Z",
      "labels": [
        "bug"
      ],
      "triage": {
        "status": "under-review",
        "reviewStatus": "assessed-by-agent-awaiting-human-review",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "sink": "Strict-style-CSP compatibility during render/export",
        "finding": "Exact 1.1.2 local strict CSP test observed inline style violations during chart render and getSvgString. dataURI returned data:, but the no-CSP control returned the same, so export failure is not attributable. Upstream issue names ApexCharts ^5.3.6 / wrapper ^1.10.0, while WCC lineage base is 4.7.0. Compatibility signal only; human review pending.",
        "artifact": {
          "version": "1.1.2",
          "sha256": "ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0"
        },
        "evidence": "/audits/security-probes-1.1.2/probe-results.json",
        "scope": "tested 1.1.2 artifact only; no inference to later releases"
      },
      "affectedVersions": [],
      "evidence": [
        "https://github.com/apexcharts/apexcharts.js/issues/5146",
        "/audits/security-probes-1.1.2/probe-results.json"
      ],
      "reviewNotes": {
        "nextEvidence": "Human maintainer review; for XSS candidates, obtain additional repro/configuration where current case did not reproduce; re-probe later release artifacts separately."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-709",
      "number": 709,
      "title": "x-axis values not rendered properly for real-time chart",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/709",
      "createdAt": "2019-06-25T16:30:20Z",
      "updatedAt": "2020-01-16T15:47:39Z",
      "labels": [],
      "triage": {
        "status": "open",
        "reviewStatus": "source-screened-candidate",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "finding": "Issue title/body reviewed; realtime x-axis rendering behavior. No security applicability assessment made.",
        "scope": "Source-screened candidate only; applicability to WCC not assessed."
      },
      "reviewNotes": {
        "nextEvidence": "Human triage required if this item is selected for WCC applicability review; no not-affected or not-applicable conclusion is implied."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-727",
      "number": 727,
      "title": "Is it possible to disable unsafe inline style in ApexCharts ?",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/727",
      "createdAt": "2019-07-02T18:54:48Z",
      "updatedAt": "2025-03-11T08:11:36Z",
      "labels": [],
      "triage": {
        "status": "under-review",
        "reviewStatus": "assessed-by-agent-awaiting-human-review",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "sink": "Inline style behavior under strict CSP",
        "finding": "Source issue describes layout incompatibility when unsafe-inline styles are disallowed. Exact 1.1.2 strict style-src self test observed inline style policy violations during normal render. This is a compatibility concern, not an XSS reproduction; human review pending.",
        "artifact": {
          "version": "1.1.2",
          "sha256": "ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0"
        },
        "evidence": "/audits/security-probes-1.1.2/probe-results.json",
        "scope": "tested 1.1.2 artifact only; no inference to later releases"
      },
      "affectedVersions": [],
      "evidence": [
        "https://github.com/apexcharts/apexcharts.js/issues/727",
        "/audits/security-probes-1.1.2/probe-results.json"
      ],
      "reviewNotes": {
        "nextEvidence": "Human maintainer review; for XSS candidates, obtain additional repro/configuration where current case did not reproduce; re-probe later release artifacts separately."
      }
    },
    {
      "kind": "upstream-issue",
      "source": "github-issues",
      "id": "GH-816",
      "number": 816,
      "title": "xaxis:categories are open to XSS attack. Tooltip does not escape the category but bottom of the graph does it",
      "state": "closed",
      "url": "https://github.com/apexcharts/apexcharts.js/issues/816",
      "createdAt": "2019-07-30T11:23:53Z",
      "updatedAt": "2021-11-10T14:27:13Z",
      "labels": [
        "no-issue-activity"
      ],
      "triage": {
        "status": "under-review",
        "reviewStatus": "assessed-by-agent-awaiting-human-review",
        "automaticResolutionAllowed": false,
        "assessedByAgent": true,
        "humanApproval": {
          "status": "pending",
          "approver": null,
          "date": null,
          "record": null
        }
      },
      "assessment": {
        "sink": "xaxis.categories[0] -> axis label and tooltip title",
        "finding": "Local image/onerror marker tested on exact 1.1.2; axis SVG text and tooltip title escaped the value; no marker execution. Only tested configuration/path; agent assessment awaits human review.",
        "artifact": {
          "version": "1.1.2",
          "sha256": "ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0"
        },
        "evidence": "/audits/security-probes-1.1.2/probe-results.json",
        "scope": "tested 1.1.2 artifact only; no inference to later releases"
      },
      "affectedVersions": [],
      "evidence": [
        "https://github.com/apexcharts/apexcharts.js/issues/816",
        "/audits/security-probes-1.1.2/probe-results.json"
      ],
      "reviewNotes": {
        "nextEvidence": "Human maintainer review; for XSS candidates, obtain additional repro/configuration where current case did not reproduce; re-probe later release artifacts separately."
      }
    },
    {
      "kind": "release-behavior",
      "id": "WCC-GAUGE-DOMAIN-UNIT",
      "source": "internal-release-qualification",
      "reportedOrFound": "2026-10-29",
      "component": "core",
      "affectedVersions": [
        "1.1.1"
      ],
      "status": "resolved",
      "reviewStatus": "resolved-by-release-evidence",
      "assessment": "The 1.1.1 screen-reader overview announced 180% for a custom 0–240 domain while the visible SVG value and data table showed the custom formatted value. Core 1.1.2 now formats the accessibility overview from the same domain-aware gauge value formatter used by the visible label and table. The fix is present in the published 1.1.2 artifact and covered by the gauge unit assertions and browser evidence.",
      "evidence": [
        "/audits/runtime-recipe-browser-1.1.1.json"
      ],
      "mitigation": null,
      "fixedIn": "1.1.2",
      "verification": [
        "Published 1.1.2 dist/west-coast-charts.js SHA-256 2f03532650c9c89f2d983b32e06e09c0d00d5ed9918c097a29db122ecb45fcab matches the candidate bundle used for browser proof.",
        "Gauge unit tests cover custom-domain output, plain radialBar percent compatibility, explicit m³/h formatter output, accessibility overview, visible label, and data table (tests/unit/types-gauge.spec.js).",
        "Candidate Chromium proof exercises gauge and radialBar accessible descriptions; published bundle matches its tested bundle SHA-256."
      ],
      "humanApproval": {
        "status": "pending",
        "approver": null,
        "date": null,
        "record": null
      },
      "resolutionEvidence": {
        "releasedVersion": "1.1.2",
        "sourceCommit": "853d26e1664aac05836b6a15d16e1050556cb61c",
        "publicCommit": "214b699c45bbf14ed81125d7c0368dd20bb7d9f0",
        "publishedRuntime": "dist/west-coast-charts.js",
        "publishedRuntimeSha256": "2f03532650c9c89f2d983b32e06e09c0d00d5ed9918c097a29db122ecb45fcab",
        "unitTest": "tests/unit/types-gauge.spec.js",
        "browserEvidence": "/audits/gauge-a11y-candidate-proof.json",
        "browserEvidenceScope": "Candidate Chromium proof; exact runtime hash is present in the published 1.1.2 core distribution."
      }
    }
  ]
}