ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
2.4 KiB
2.4 KiB
Dependency policy
A production dependency is accepted only when it:
- solves a real requirement better than a small maintained implementation;
- is actively maintained;
- has a compatible license;
- has no unresolved unacceptable security issue;
- supports the selected runtime/browser versions;
- has clear upgrade and removal paths;
- does not require excessive privilege or bundle size.
Selection record
For material dependencies record:
- package and version range;
- purpose;
- alternatives considered;
- maintenance/release activity;
- license;
- security check;
- bundle/image/runtime impact;
- locking strategy.
This may be an ADR or a dependency manifest note.
Default choices to validate during M0/M1
- React + TypeScript + Vite.
- GridStack for layout.
- uPlot for high-volume time series.
- ECharts for complex visualizations.
- TanStack Query for server state.
- Accessible UI primitives/component library.
- Go HTTP/router, OIDC/JWT and PostgreSQL libraries selected from maintained options.
- PostgreSQL migration tool with explicit CLI and rollback strategy.
- Playwright and automated accessibility tooling.
- Testcontainers for integration tests.
These are defaults, not permission to install blindly. Verify current supported versions and compatibility.
Rules
- Commit lockfiles.
- Prefer exact image tags/digests in production records.
- Avoid duplicate libraries for the same concern.
- Do not use abandonware because an example already uses it.
- Do not add Redis, Kafka, Elasticsearch or a second metrics database without measured need and ADR.
- Remove unused dependencies immediately.
- Run dependency/license/vulnerability checks at milestones and release.
M4-06 WebSocket selection
- Package/version: github.com/coder/websocket v1.8.15, pinned in go.mod and go.sum.
- Purpose: RFC6455 server upgrade, context-aware reads/writes, ping/pong and bounded frame reads for the authenticated live endpoint.
- Alternatives considered: hand-rolled RFC6455 handling was rejected because it increases protocol and security risk; gorilla/websocket was not needed for this narrow API; golang.org/x/net/websocket is deprecated.
- Maintenance/security: current upstream release was resolved locally on 2026-08-01; the module has zero transitive dependencies and the source license is permissive MIT.
- Runtime impact: server-only dependency, no browser bundle or privilege change; SetReadLimit and write deadlines enforce the endpoint budget.