Sankey Studio 0.2.0

Second release of Sankey Studio: a local web app for drawing and managing Sankey graphs, with an optional donut chart. It listens on loopback by default, has no login, and defends itself (see the Security model). This release changes where connection strings are stored, fixes one fuzzing finding, and adds hosted CI, fuzzing and stricter quality gates.

Highlights

• Connection strings (the MongoDB URIs with their passwords) are now stored in <data-dir>/credentials.json (mode 0600, written atomically), apart from settings.json, which holds no secret any more. The Settings page works as before. A settings.json from an earlier version keeps working and is migrated by the next save. Downgrading afterwards is not supported.
• Fixed: the JSON reader treated a first read that held only the byte order mark as the end of the input. With the production chunk size no real input was affected; ClusterFuzzLite found it with a chunk size of 1.
• Hosted CI for the browser, memory and MongoDB suites and the scanners, ClusterFuzzLite fuzzing, a weekly Trivy scan, CodeQL and the OpenSSF Scorecard.
• The mutation gate now fails below a score of 95 (it was 90); the last full run scored 98.4%.
• The UI reference is split into one file per page or topic under docs/ui/.

Upgrade

uv tool upgrade sankey-studio     # or: pipx upgrade sankey-studio

Going back to 0.1.0 afterwards is not supported: the older version moves the new settings.json aside.

Install

uv tool install sankey-studio     # or: pipx install --python python3.14 sankey-studio
sankey-studio serve               # then open http://127.0.0.1:8765

Needs Python 3.14 (uv fetches it). For SVG and PNG export install Chrome or Chromium.

Verify the download

The wheel and the source distribution on PyPI carry a Sigstore attestation made by this repository's release workflow:

uvx pypi-attestations verify pypi --repository https://github.com/Axiumine/Sankey-Studio \
  pypi:sankey_studio-0.2.0-py3-none-any.whl

The tag v0.2.0 is signed (git tag -v v0.2.0). More in Verifying a release.

More

• Full list of changes: CHANGELOG.md
• PyPI: https://pypi.org/project/sankey-studio/0.2.0/
• Report a vulnerability privately: SECURITY.md
• License: GPL-3.0-only

Sankey Studio 0.1.0

First release of Sankey Studio: a local web app for drawing and managing Sankey graphs, with an optional donut chart. It listens on loopback by default, has no login, and defends itself (see the Security model).

Highlights

• A library of saved graphs (on disk or in MongoDB) with collections, tags, search, JSON bundles, and a compare view for up to 12 graphs.
• A live editor with sources from pasted or uploaded text (CSV, TSV, SankeyMATIC, JSON), a managed sources folder, MongoDB collections (read-only unless you opt into write-back) and a manual table.
• Optional categories with a legend and a donut chart; transforms such as minimum link value, top-N links and hide or merge nodes.
• Exports to SVG, PNG, HTML, JSON and CSV; light and dark themes.

Install

uv tool install sankey-studio     # or: pipx install --python python3.14 sankey-studio
sankey-studio serve               # then open http://127.0.0.1:8765

Needs Python 3.14 (uv fetches it). For SVG and PNG export install Chrome or Chromium.

Verify the download

The wheel and the source distribution on PyPI carry a Sigstore attestation made by this repository's release workflow:

uvx pypi-attestations verify pypi --repository https://github.com/Axiumine/Sankey-Studio \
  pypi:sankey_studio-0.1.0-py3-none-any.whl

The tag v0.1.0 is signed (git tag -v v0.1.0). More in Verifying a release.

More

• Full list of changes: CHANGELOG.md
• PyPI: https://pypi.org/project/sankey-studio/0.1.0/
• Report a vulnerability privately: SECURITY.md
• License: GPL-3.0-only