{
  "schemaVersion": 1,
  "collectionId": "upstream-risk-metadata-2026-10-29-authenticated",
  "generatedAt": "2026-10-30T10:51:17Z",
  "repository": "apexcharts/apexcharts.js",
  "inheritedBaseVersion": "4.7.0",
  "notice": "shared/wcc/NOTICE",
  "mode": "live-metadata-only",
  "authentication": "GitHub token available; read-only GETs only",
  "scope": "Public metadata only: six GitHub issue searches for security, vulnerability, CVE, XSS, injection, and sanitize (all/closed/open issues; pull requests excluded), plus GitHub Advisory Database, OSV npm package query, and npm Bulk Advisory query for apexcharts@4.7.0. No issue bodies, comments, code, source bundles, tarballs, or type files were fetched.",
  "issueSearch": {
    "endpoint": "https://api.github.com/search/issues",
    "queries": [
      {
        "query": "repo:apexcharts/apexcharts.js is:issue security",
        "totalCount": 7,
        "pagesFetched": 1,
        "pageSize": 100,
        "truncated": false
      },
      {
        "query": "repo:apexcharts/apexcharts.js is:issue vulnerability",
        "totalCount": 5,
        "pagesFetched": 1,
        "pageSize": 100,
        "truncated": false
      },
      {
        "query": "repo:apexcharts/apexcharts.js is:issue CVE",
        "totalCount": 0,
        "pagesFetched": 1,
        "pageSize": 100,
        "truncated": false
      },
      {
        "query": "repo:apexcharts/apexcharts.js is:issue XSS",
        "totalCount": 7,
        "pagesFetched": 1,
        "pageSize": 100,
        "truncated": false
      },
      {
        "query": "repo:apexcharts/apexcharts.js is:issue injection",
        "totalCount": 3,
        "pagesFetched": 1,
        "pageSize": 100,
        "truncated": false
      },
      {
        "query": "repo:apexcharts/apexcharts.js is:issue sanitize",
        "totalCount": 4,
        "pagesFetched": 1,
        "pageSize": 100,
        "truncated": false
      }
    ],
    "uniqueCandidates": 14,
    "truncated": false,
    "completeness": "Keyword-scoped public issue metadata, not a complete review of every upstream issue or issue body."
  },
  "advisorySearch": {
    "sources": [
      {
        "name": "GitHub Advisory Database",
        "endpoint": "https://api.github.com/advisories?ecosystem=npm&affects=apexcharts&per_page=100",
        "status": "complete",
        "pagesFetched": 1
      },
      {
        "name": "OSV",
        "endpoint": "https://api.osv.dev/v1/query",
        "query": "npm/apexcharts",
        "status": "complete",
        "pagesFetched": 1
      },
      {
        "name": "npm security advisories bulk endpoint",
        "endpoint": "https://registry.npmjs.org/-/npm/v1/security/advisories/bulk",
        "query": "apexcharts@4.7.0",
        "status": "complete"
      }
    ],
    "uniqueCandidates": 1,
    "completeness": "Advisory metadata for npm/apexcharts and npm's bulk result for upstream 4.7.0. GitHub and OSV pagination is followed up to maxPages and reported as truncated; absence from any one response is not proof of non-affected status."
  },
  "primaryDocumentation": {
    "githubSearch": "https://docs.github.com/en/rest/search/search",
    "githubAdvisories": "https://docs.github.com/en/rest/security-advisories/global-advisories",
    "githubPagination": "https://docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api",
    "osv": "https://google.github.io/osv.dev/post-v1-query/",
    "npmAudit": "https://docs.npmjs.com/cli/commands/npm-audit/"
  },
  "interpretation": "The read-only collector workflow installed on the default branch is from commit 8c6afc07e655818c64ce0c9e41209cb6fb2b5ff9 (https://github.com/Lokumbus/west-coast-charts-core/commit/8c6afc07e655818c64ce0c9e41209cb6fb2b5ff9). Recorded successful run 41042720797 (https://github.com/Lokumbus/west-coast-charts-core/actions/runs/41042720797) completed on main at that commit. The workflow is scheduled to collect public metadata daily at 07:21 UTC; it does not mutate the ledger or publish assessments. The initial collector scope remains keyword-scoped metadata only. Follow-up issue-body screening and 1.1.2 browser probes are separately identified and do not establish universal applicability or non-applicability.",
  "initialAssessmentEvidence": [
    {
      "id": "GHSA-w46j-8hm6-h8mm",
      "status": "assessed-not-affected-awaiting-human-review",
      "finding": "On the exact public 1.1.1 Core UMD, the default data-derived legend name rendered only as literal text; custom formatter markup with the default sanitizer lost inline event handlers and executed neither hostile payload. The explicitly unsafe chart.sanitizeHtml=false opt-out executed both payloads, as expected. The default vulnerable path is absent in the tested artifact; human review remains required before publication.",
      "evidence": "src/data/upstream-cve-2021-23327-test-evidence.json"
    },
    {
      "id": "WCC-GAUGE-DOMAIN-UNIT",
      "status": "affected",
      "finding": "The reported defect is confined to screen-reader overview text using a percent suffix for a custom unit domain; visible SVG and data table can show the correctly formatted value. Do not describe it as a visual-rendering defect."
    }
  ],
  "followUpReview": {
    "observedAt": "2026-10-30T10:45:30.770Z",
    "scope": "Read-only primary-source title/body screening for the 14 existing candidates, plus browser reproduction of selected XSS/CSP reports against released 1.1.2. This follow-up does not change the original keyword-scoped search completeness.",
    "primaryIssueBodiesReviewed": [
      1029,
      2202,
      2214,
      238,
      2412,
      2463,
      3328,
      3539,
      3937,
      4502,
      5146,
      709,
      727,
      816
    ],
    "commentsReviewed": [
      2412,
      3328,
      3937,
      4502,
      5146,
      816
    ],
    "browserEvidence": "/audits/security-probes-1.1.2/probe-results.json",
    "browserHarness": "/audits/security-probes-1.1.2/probe-harness.mjs",
    "testedArtifact": {
      "version": "1.1.2",
      "commit": "853d26e1664aac05836b6a15d16e1050556cb61c",
      "runtime": "/wcc/west-coast-charts.min.js",
      "bytes": 683220,
      "sha256": "ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0"
    },
    "limitations": [
      "Chromium only; tested chart/sink configurations only.",
      "No universal not-affected conclusions.",
      "Evidence applies to 1.1.2 only; any 1.1.3 artifact needs its own exact-hash probe before equivalence is asserted."
    ],
    "workflowRun": {
      "name": "Collect upstream issue and advisory metadata",
      "url": "https://github.com/Lokumbus/west-coast-charts-core/actions/runs/41042720797",
      "event": "workflow_dispatch",
      "branch": "main",
      "headSha": "8c6afc07e655818c64ce0c9e41209cb6fb2b5ff9",
      "status": "completed",
      "conclusion": "success",
      "startedAt": "2026-10-30T10:42:32Z",
      "updatedAt": "2026-10-30T10:42:53Z",
      "defaultBranch": "main"
    }
  },
  "collectorInstallation": {
    "repository": "https://github.com/Lokumbus/west-coast-charts-core",
    "workflow": ".github/workflows/upstream-risk-metadata.yml",
    "installedDefaultBranchCommit": "8c6afc07e655818c64ce0c9e41209cb6fb2b5ff9",
    "permissions": "contents: read; public metadata GETs only",
    "scheduleUtc": "daily at 07:21 UTC",
    "successfulRun": {
      "id": 41042720797,
      "url": "https://github.com/Lokumbus/west-coast-charts-core/actions/runs/41042720797",
      "branch": "main",
      "headSha": "8c6afc07e655818c64ce0c9e41209cb6fb2b5ff9",
      "conclusion": "success"
    }
  }
}