Skip to content

Sankey Studio 0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@giovannimanzoni giovannimanzoni released this 18 Oct 11:54
· 1 commit to main since this release
v0.2.0
This tag was signed with the committer’s verified signature.
giovannimanzoni Giovanni Manzoni
SSH Key Fingerprint: O+VNPvKOWi5ZrSvzs4gNBjAa9PeHvj7KlvoSDZJ25EQ
Verified
Learn about vigilant mode.
f91369a
This commit was signed with the committer’s verified signature.
giovannimanzoni Giovanni Manzoni
SSH Key Fingerprint: O+VNPvKOWi5ZrSvzs4gNBjAa9PeHvj7KlvoSDZJ25EQ
Verified
Learn about vigilant mode.

Second release of Sankey Studio: a local web app for drawing and managing Sankey graphs, with an optional donut chart. It listens on loopback by default, has no login, and defends itself (see the Security model). This release changes where connection strings are stored, fixes one fuzzing finding, and adds hosted CI, fuzzing and stricter quality gates.

Highlights

  • Connection strings (the MongoDB URIs with their passwords) are now stored in <data-dir>/credentials.json (mode 0600, written atomically), apart from settings.json, which holds no secret any more. The Settings page works as before. A settings.json from an earlier version keeps working and is migrated by the next save. Downgrading afterwards is not supported.
  • Fixed: the JSON reader treated a first read that held only the byte order mark as the end of the input. With the production chunk size no real input was affected; ClusterFuzzLite found it with a chunk size of 1.
  • Hosted CI for the browser, memory and MongoDB suites and the scanners, ClusterFuzzLite fuzzing, a weekly Trivy scan, CodeQL and the OpenSSF Scorecard.
  • The mutation gate now fails below a score of 95 (it was 90); the last full run scored 98.4%.
  • The UI reference is split into one file per page or topic under docs/ui/.

Upgrade

uv tool upgrade sankey-studio     # or: pipx upgrade sankey-studio

Going back to 0.1.0 afterwards is not supported: the older version moves the new settings.json aside.

Install

uv tool install sankey-studio     # or: pipx install --python python3.14 sankey-studio
sankey-studio serve               # then open http://127.0.0.1:8765

Needs Python 3.14 (uv fetches it). For SVG and PNG export install Chrome or Chromium.

Verify the download

The wheel and the source distribution on PyPI carry a Sigstore attestation made by this repository's release workflow:

uvx pypi-attestations verify pypi --repository https://github.com/Axiumine/Sankey-Studio \
  pypi:sankey_studio-0.2.0-py3-none-any.whl

The tag v0.2.0 is signed (git tag -v v0.2.0). More in Verifying a release.

More

Assets 6
Loading