Spaces:
Build error
Build error
Commit History
-
fix(frontend): vendor D3.js locally instead of loading from CDN (N-2/F-14)
Root cause: frontend/index.html loaded D3 from cdnjs.cloudflare.com. window._d3Failed was set in the script's onerror handler but never read anywhere in the codebase (confirmed by grep across every frontend/*.js file) -- so on CDN failure, the Relationship Graph tab threw an unhandled ReferenceError instead of showing any kind of message. Trigger condition: whenever cdnjs.cloudflare.com is unreachable. Rare today for the hosted deployment, but becomes a routine condition (not an edge case) the moment any offline/local desktop build ships -- this is exactly the CDN dependency PHASE_ROADMAP.md's offline-first goal can't tolerate. Fix direction: vendored the library locally rather than wiring the existing _d3Failed flag into a real fallback message. A real offline-first / desktop build has no good 'recover from missing charting library' story worth building -- the relationship-graph feature would just be broken either way -- so removing the network dependency entirely is the correct fix…a18c616
-
docs: add NOTICE.md -- resolves Lic-1 (fake-useragent license) and D-7 (missing attribution file)
Lic-1: the audit's own automated PyPI/GitHub metadata check returned empty for fake-useragent. Resolved via direct research: the package's own pyproject.toml declares 'license = "Apache-2.0"', corroborated independently by conda-forge's feedstock metadata. The SPDX identifier appears to have been added to the upstream package relatively recently (see its changelog), explaining why the audit's automated check missed it. D-7: no LICENSE/NOTICE/attribution file existed anywhere for any bundled dependency. Added a full inventory of all 20 direct dependencies plus the 3 bundled AI models, and a dedicated section on WeasyPrint's native rendering stack (Pango, Cairo, GDK-Pixbuf, HarfBuzz) since that's the one dependency chain with real LGPL obligations once vendored into a distributable installer rather than apt-installed into a container. Also corrects an imprecision in the original audit: HarfBuzz was grouped with Pango/Cairo/GDK-Pixbuf as 'LGPL-licensed C libraries', but verified directl…6449ffb