Download Core
Project policy

Maintenance and security

How we assess issues, support the current stable line, and publish release evidence.

Last reviewed: 1 November 2026. This page describes WestCoast Charts' own maintenance process. It is not a security certification or a promise that every defect will be detected before release.

Supported release line

The current supported stable line is WestCoast Charts 1.1.x, beginning with 1.1.1; 1.1.5 is the latest patch documented here. The 1.1.x line remains the supported stable line until this page names a successor or marks it ended. Release notes identify the versions and changes actually shipped. Older prereleases are not stable releases; another release line is supported only when listed here.

Support is provided by West Coast Software at service@pekagi.io. The published business terms describe the support included with a paid Premium subscription. This policy does not add response-time, resolution-time, or availability guarantees.

How issues are assessed

We review reproducible defects and vulnerability reports against the affected release and the code actually shipped. For issues inherited from ApexCharts 4.7.0 or another dependency, we check whether the relevant code is present, reachable, and affected in WestCoast Charts. We assess and address issues based on that evidence; we do not automatically port every upstream change or version update.

For each confirmed issue, the public record should say which versions and components are affected, the assessment status, the evidence and reproduction or test used, and the release that resolves it (if fixed). Possible statuses are under-review, affected, mitigated, resolved, and not-affected. A not-affected finding includes a reason and supporting evidence. An empty ledger is not a claim that the product has no vulnerabilities.

The maintenance process draws on practices described in the NIST Secure Software Development Framework (SP 800-218). This reference describes process guidance; it does not mean WestCoast Charts is assessed or certified against that framework.

Human release approval

Automated agents may investigate, edit, test, and prepare release candidates. Their work remains a draft. A human maintainer must review and explicitly approve every agent-prepared publication or deployment, including security, runtime, package, and website changes. This approval is required even when all automated checks pass.

Before approval, the maintainer reviews the exact source diff, test and build results, package contents, version and destination. The release record identifies the source commit and artifact hashes, the checks performed, the human approver, approval date, and intended publication targets. A changed source commit or artifact requires a new review. No agent or green CI job can publish, deploy, create a release tag, send a security notification, or open a public advisory without that human approval.

Private vulnerability reports

The concise, repository-facing copy is available as SECURITY.md.

Please report suspected vulnerabilities privately to service@pekagi.io with “Security report” in the subject. Include the affected version or commit, component, impact you observed, and a minimal reproduction where possible. Do not include licence keys, signing material, customer data, or other secrets. Please do not publish an unpatched report in a public issue.

A maintainer checks this inbox on working days, records each report for assessment, and aims to acknowledge it within three business days and provide an initial assessment within ten business days. These are best-effort targets, not service guarantees; complex reports may take longer. If the report is confirmed, we record the affected versions, evidence, mitigation or fix, verification, and disclosure decision. Public details are released when disclosure is appropriate and a human maintainer approves them.

We create a GitHub Security Advisory only for a confirmed vulnerability that affects a publicly released component and is ready for coordinated public disclosure. Ordinary defects, feature requests, and unconfirmed reports use the normal issue process; they are not presented as security advisories. We do not create advisories automatically. GitHub, npm, and Dependabot notifications depend on each platform's indexing, configuration, and recipient settings, and may be delayed or absent; they are not guaranteed delivery channels.

For urgent operational or account support, use the same contact and identify the affected release; do not send credentials by email.

Public issue ledger

The public assessment ledger lists collected upstream issue candidates, advisory assessments and confirmed released-behavior findings. Its coverage record states the exact search scope and limits. The automated collector only proposes records; it cannot change assessments or publish fixes. New confirmed findings use these machine-readable fields. Private reports remain private until disclosure is appropriate; public rows omit reporter identity and secrets.

json
{
  "id": "publisher-assigned identifier",
  "reportedOrFound": "YYYY-MM-DD",
  "sourceUrl": "public source or null for a private report",
  "component": "runtime, dependency, website, or release tooling",
  "affectedVersions": ["1.1.1"],
  "status": "under-review | affected | mitigated | resolved | not-affected",
  "assessment": "concise impact and applicability finding",
  "evidence": ["public report, advisory, or test record URL"],
  "fixedIn": "version or null",
  "verification": ["version and test or check used"],
  "disclosed": "YYYY-MM-DD or null",
  "humanApproval": {
    "status": "pending | approved | not-approved",
    "approver": "name or role, or null",
    "date": "YYYY-MM-DD or null",
    "record": "review or release record URL, or null"
  }
}

This is the field contract for confirmed WCC findings; collected upstream leads retain their separate unreviewed-candidate status until assessed. An open record states its current status and next evidence needed; a resolved or not-affected record retains the test or reasoning that supports that outcome.

Release and maintenance evidence

The read-only operational status snapshot confirms that GitHub private vulnerability reporting is enabled and records the successful manual collector run. The daily read-only schedule is installed; this snapshot does not claim that a scheduled daily run has already occurred.

1.1.5 patch

  • Scope: This release includes Trellis and shared validator/type corrections. It does not claim that all chart code is unchanged from 1.1.4. Premium and layer modules remain separately licensed and are not included in the public Core package.
  • Source and publication: Library source 95f093ba8d388c579d9f94701d3322c728c77632 is exported by public Core commit bdb919664ca330f98ba8798087bc6db0450f0b7c. The canonical TGZ SHA-256 is c4a4fdfebe81f29ad27b6e583e3a343e79e93633f54208f0c26a6d586a577dcc; the verified package has 174 files: 173 integrity records plus the manifest itself. GitHub and npm archive bytes match, and the version-pinned jsDelivr Core and Full scripts match the archived files. Channel and provenance evidence records the successful npm publisher run.
  • Bounded evidence: 1.1.5 release manifest, current Core SBOM, fresh selected browser probes bind their observations to the exact public Core runtime. The browser probes retain the strict inline-style CSP violations and empty image-export limitation. They are not a full security certification, a new Canvas timing cycle, or a claim that every product test passed. Historical performance and agent-pairing records below retain their original versions.

1.1.4 patch

  • Scope: Gauge validation now suggests the supported radialBar namespace and provides a safe, non-overwriting fix. The validator publishes named ESM exports alongside its default plugin export.
  • Pinned library source: d999ea3db78e810ffee31877fa7c4b3824447dd9. The focused validator suite passed 15/15 tests. A fresh offline-installed consumer passed ESM named/default imports, CommonJS, the Gauge suggestion/fix/revalidation path, input immutability, conflict suppression, non-Gauge scope, all 172 integrity entries, and license/notice checks.
  • Qualification: Agent tools 0.2.3 passed a fresh npm-installed targeted CLI/MCP pairing check with Core 1.1.4 for Gauge suggestion/fix, SVG rendering and describe, with install scripts disabled; this is not a full agent suite. The release inherits the 1.1.3 qualification and 1.1.2 performance baseline. The chart renderer is unchanged; no new full Canvas performance cycle or timing is claimed.
  • Supply-chain evidence: release manifest and CycloneDX 1.6 SBOM, bound to the exact public Core TGZ and ZIP. GitHub and npm archives, npm signature/provenance, and the advertised jsDelivr Core and Full bundles were verified against their pinned bytes; the CDN proof covers jsDelivr only.

1.1.3 patch

  • Scope: heatmap row identity for the existing reversed Y axis and repaired packaged security policy. The standard row order remains compatible.
  • Pinned library source: a4cc352cc8834b3bb9364df43b7838377257bd16. The targeted regression passed six unit tests and real geometry/hover checks in Chromium, Firefox and WebKit; the fresh public Core consumer verified 190 module resolutions, TypeScript, ESM/CommonJS and rendering/describe/update behavior. This patch does not claim a new full Canvas timing cycle.
  • Supply-chain evidence: release manifest and CycloneDX 1.6 SBOM, bound to the exact Core TGZ and ZIP. The version-specific SBOM generator preserves the two verified vendored components and validates against the official local 1.6 schema.

1.1.2 stable

  • Public Core source: commit 214b699c45bbf14ed81125d7c0368dd20bb7d9f0, exporting library source commit 853d26e1664aac05836b6a15d16e1050556cb61c. The 1.1.2 artifact manifest records both source pins and archive hashes.
  • Publication provenance: the signed npm provenance identifies workflow run 41034143001 and the public source commit above.
  • Qualification: combined unit verification records 2,199 unique passes, 4 pending and 0 failures after a focused stale-expectation correction; this is not a fresh full-suite run. Separate final-runtime checks passed: 68 renderer-tooltip tests across 8 suites and 31 colour/theme tests across 3 suites. The 100k-scatter first-render samples were 108.3 ms, 125.4 ms and 110.3 ms against an approved 130 ms requirement and 120 ms optimum. Hover p95 was 4.1 ms, 5.0 ms and 4.0 ms; zoom tracked at 60 fps in all three stages. The performance review binds release source 853d26e1664aac05836b6a15d16e1050556cb61c to tested runtime 371c5b977a31905300107c969ef7a2e5db22d9ea; its isolated original 120 ms verdict is retained even though the approved 130 ms requirement is met. See current release qualification.

1.1.1 stable

  • Public source export: 89131079. The artifact manifest records the complete library source pin 56a7708437f1932ceea3b742db7268a6857133cf.
  • Release evidence: release notes and the measured source comparison, including per-module data and both source-line denominators.
  • Qualification: 2,169/2,169 unit tests and 3,168/3,168 catalogue identities passed in the recorded release check. Performance was 69/70 assertions: the loaded-host 100k-scatter render was 137 ms against a 120 ms limit. Quiet-host performance remained inconclusive. See current release qualification.

Software bill of materials

The immutable 1.1.1 Core TGZ and ZIP do not embed an SBOM. A separate CycloneDX 1.6 SBOM for the public Core archives is prepared from those exact artifacts and their archived THIRD-PARTY-LICENSES.txt, PROVENANCE.json, and INTEGRITY.json, and validated against the official CycloneDX 1.6 schema. It identifies the six MIT packages listed as bundled into dist/ and two separately verified vendored implementations (Treemap Squared 0.5 and svg.pathmorphing.js 0.1.3); ApexCharts 4.7.0 is recorded separately as source lineage, not as an installed npm runtime dependency. The optional map data described in NOTICE and all Premium material are outside this SBOM's scope. The TGZ and ZIP bytes and their published hashes remain unchanged.

Future release entries should link to the exact source commit and release manifest, summarize the change in the changelog, and identify relevant versioned tests or checks. Old evidence is not reused as proof for a later source or artifact without a recorded equivalence check.

Licensing overview

The Free Core is released under the MIT License. The release archives include the license and attribution files; keep them when redistributing. The separately supplied Premium distribution, updates, and support are covered by the business terms. Those terms do not replace the licence attached to MIT-marked code. See the shipped LICENSE, NOTICE, third-party notices, and the Premium licensing guide.

WestCoast Charts is an independent project and is not affiliated with ApexCharts. Attribution and compatibility information is in the NOTICE. These links provide the operative texts; this summary does not amend them or the business terms.

Supplemental attribution for 1.1.1

The delivered unminified bundle retains the Treemap Squared attribution. The source header for the bundled svg.pathmorphing implementation was omitted from the distributed notices. The supplemental MIT notices provide the two original attributions and permission texts for the exact 1.1.1 artifacts. Keep this file with redistributed copies. This is an additive notice; the existing npm, TGZ and ZIP bytes have not been replaced. Release 1.1.3 includes the complete bundled-package and vendored-implementation notices in its THIRD-PARTY-LICENSES.txt. This corrects the notice inventory for the 1.1.3 distribution; the immutable 1.1.1 archives remain unchanged, and the supplemental notices above remain necessary when redistributing those original archives.