Merge main and fix conflicts

Signed-off-by: tdruez <[email protected]>

Author: tdruez

CHANGELOG.rst

@@ -18,6 +18,10 @@ v35.2.0 (unreleased)
   ``policies.yml`` file.
   https://github.com/aboutcode-org/scancode.io/issues/1348
 
+- Enhance the dependency tree view in a more dynamic rendering.
+  Vulnerabilities and compliance alert are displayed along the dependency entries.
+  https://github.com/aboutcode-org/scancode.io/pull/1742
+
 v35.1.0 (2025-07-02)
 --------------------
 

scancodeio/static/iamkate-tree-views/expand-collapse.svg

@@ -0,0 +1,75 @@
+.tree{
+  --spacing : 1.5rem;
+  --radius  : 10px;
+}
+
+.tree li{
+  display      : block;
+  position     : relative;
+  padding-left : calc(2 * var(--spacing) - var(--radius) - 2px);
+}
+
+.tree ul{
+  margin-left  : calc(var(--radius) - var(--spacing));
+  padding-left : 0;
+}
+
+.tree ul li{
+  border-left : 2px solid #ddd;
+}
+
+.tree ul li:last-child{
+  border-color : transparent;
+}
+
+.tree ul li::before{
+  content      : '';
+  display      : block;
+  position     : absolute;
+  top          : calc(var(--spacing) / -2);
+  left         : -2px;
+  width        : calc(var(--spacing) + 2px);
+  height       : calc(var(--spacing) + 1px);
+  border       : solid #ddd;
+  border-width : 0 0 2px 2px;
+}
+
+.tree summary{
+  display : block;
+  cursor  : pointer;
+}
+
+.tree summary::marker,
+.tree summary::-webkit-details-marker{
+  display : none;
+}
+
+.tree summary:focus{
+  outline : none;
+}
+
+.tree summary:focus-visible{
+  outline : 1px dotted #000;
+}
+
+.tree li::after,
+.tree summary::before{
+  content       : '';
+  display       : block;
+  position      : absolute;
+  top           : calc(var(--spacing) / 2 - var(--radius));
+  left          : calc(var(--spacing) - var(--radius) - 1px);
+  width         : calc(2 * var(--radius));
+  height        : calc(2 * var(--radius));
+  border-radius : 50%;
+  background    : #ddd;
+}
+
+.tree summary::before{
+  z-index    : 1;
+  background : #696 url('expand-collapse.svg') 0 0;
+}
+
+.tree details[open] > summary::before{
+  background-position : calc(-2 * var(--radius)) 0;
+}

scancodeio/static/iamkate-tree-views/tree.css

@@ -0,0 +1,10 @@
+about_resource: tree.css
+name: css-tree-views
+homepage_url: https://iamkate.com/code/tree-views/
+description: A tree view (collapsible list) can be created using only html and css, without
+  the need for JavaScript. Accessibility software will see the tree view as lists nested inside
+  disclosure widgets, and the standard keyboard interaction is supported automatically.
+license_expression: cc0-1.0
+licenses:
+  - key: cc0-1.0
+    name: cc0-1.0

scancodeio/static/iamkate-tree-views/tree.css.ABOUT

@@ -0,0 +1,29 @@
+Free content on iamkate.com
+The web was still young when I first went online in 1998. It felt like a utopian dream of free culture and free knowledge. Anyone could contribute, and within weeks I had learnt html and created my first site, hosted in the 10mb of webspace my isp included as standard.
+
+I’ve watched as the dream has become a nightmare of surveillance and monetisation. Companies such as Google and Facebook offer their services for free to the public because their real products are their advertising networks powered by the personal data of their visitors.
+
+The only concern of these companies and their shareholders is to maximise their income from advertising, regardless of the costs to society. They use dubious schemes to avoid paying tax. They encourage addiction and risk the mental health of their visitors. They threaten democratic institutions.
+
+I have little influence over the wider web, but I can control my small part of it, creating a haven that remains true to the original dream. This page describes my approach to copyright, my promise to protect the privacy of my visitors, and my commitment to transparency.
+
+Copyright
+Copyright limits creativity and holds back progress by restricting our rights to build upon the works of others. Copyleft licences attempt to use copyright against itself, but “the master’s tools will never dismantle the master’s house”, as Audre Lorde remarked in a different context.
+
+All content on my site is released under the terms of the Creative Commons CC0 1.0 Universal Legal Code. This means I have waived all copyright and related rights to the extent possible under law, with the intention of dedicating the content to the public domain. You can use and adapt it without attribution.
+
+Privacy
+Every site is hosted on a server, which is usually operated by a third party due to the expertise needed to manage servers securely. Most sites are accessed indirectly through the servers of a content delivery network, which protects the original server from attacks that could disable the site.
+
+My site is hosted on Cloudflare Pages. Cloudflare is both the host and the content delivery network, avoiding the need to trust two separate third parties. Cloudflare have a strong commitment to privacy and data protection, and frequently write about developing systems to protect visitor privacy.
+
+Almost every site today includes code that tracks visitors for statistical and advertising purposes. Often the site owner includes code with the deliberate aim of tracking their visitors, but sometimes they just want to include a feature provided by a third party, and that provider includes their own tracking code.
+
+My site doesn’t include any tracking code, and doesn’t load any code from third parties. It doesn’t have a cookie banner because it doesn’t use cookies. Instead of an invasive analytics system, Cloudflare Web Analytics gives me the most important statistics without tracking individual visitors.
+
+Transparency
+You probably don’t know me, and shouldn’t have to trust me. Instead, you should be able to check security and privacy claims for yourself. Unfortunately most sites today use a process called code minification, which makes them faster but also makes it harder for other people to understand their code.
+
+The Mozilla Observatory report for my site confirms the presence of various security and privacy features, resulting in a perfect A+ rating. One of these features, the content security policy, prevents browsers from loading code and other resources from third parties.
+
+My site doesn’t need to use code minification in order to load quickly due to its simple design, efficient implementation, and absence of resources loaded from third parties. As a result, other software developers can easily understand how the layout, styling, and interactive features are created.

scancodeio/static/iamkate-tree-views/tree.css.NOTICE

@@ -2568,6 +2568,13 @@ def from_db(cls, db, field_names, values):
 
         return new
 
+    @property
+    def has_compliance_issue(self):
+        """Return True if the compliance status is not OK or not set."""
+        if not self.compliance_alert or self.compliance_alert == self.Compliance.OK:
+            return False
+        return True
+
     @property
     def license_policy_index(self):
         return self.project.license_policy_index
@@ -3831,12 +3838,23 @@ class DiscoveredDependency(
 
     This class manages dependencies with the following considerations:
 
-    1. A dependency can be associated with a Package via the "for_package" field.
-       In this case, it is termed a "Package's dependency". If there is no such
-       association, the dependency is considered a "Project's dependency".
+    1. A dependency can be associated with a Package via the ``for_package`` field.
+       In this case, it is termed a "Package's dependency".
+       If there is no such association, the dependency is considered a
+       "Project's dependency".
 
-    2. A dependency can also be linked to a Package through the "resolved_to_package"
+    2. A dependency can also be linked to a Package through the ``resolved_to_package``
        field. When this link exists, the dependency is considered "resolved".
+
+    3. Dependencies can be either direct or transitive:
+       - A **direct dependency** is explicitly declared in a package manifest or
+         lockfile.
+       - A **transitive dependency** is not declared directly, but is required by one
+         of the project's direct dependencies.
+
+    Understanding the distinction between direct and transitive dependencies is
+    important for analyzing dependency trees, resolving version conflicts, and
+    assessing potential security risks.
     """
 
     # Overrides the `project` field to set the proper `related_name`.
@@ -3989,14 +4007,20 @@ def datafile_path(self):
 
     @property
     def is_project_dependency(self):
+        """
+        Return True if the dependency is directly associated with the project
+        (not tied to a specific package).
+        """
         return not bool(self.for_package_id)
 
     @property
-    def is_for_package(self):
+    def is_package_dependency(self):
+        """Return True if the dependency is explicitly associated with a package."""
         return bool(self.for_package_id)
 
     @property
     def is_resolved_to_package(self):
+        """Return True if the dependency is resolved to a package."""
         return bool(self.resolved_to_package_id)
 
     @classmethod
@@ -4014,11 +4038,13 @@ def create_from_data(
         Create and returns a DiscoveredDependency for a `project` from the
         `dependency_data`.
 
-        The `for_package` and `resolved_to_package` FK can be provided as args or
-        in the dependency_data providing the `for_package_uid` and
+        The `for_package` and `resolved_to_package` FKs can be provided as args,
+        or in the `dependency_data` using the `for_package_uid` and
         `resolve_to_package_uid`.
-        Note that a dependency without a `for_package` FK is a project dependency and
-        a dependency without a `resolve_to_package` is unresolved.
+
+        Note that a dependency:
+         - without a `for_package` FK is a "Project's dependency"
+         - without a `resolve_to_package` is "unresolved".
 
         If `strip_datafile_path_root` is True, then `create_from_data()` will
         strip the root path segment from the `datafile_path` of

scanpipe/models.py

@@ -41,7 +41,7 @@
           </a>
           <a href="{% url 'project_dependency_tree' project.slug %}">
             <span class="icon">
-              <i class="fa-solid fa-sitemap"></i>
+              <i class="fa-solid fa-sitemap fa-sm"></i>
             </span>
           </a>
         {% else %}

scanpipe/templates/scanpipe/includes/project_list_table.html

@@ -44,6 +44,11 @@
               {{ project.vulnerable_dependency_count|intcomma }}
             </a>
           {% endif %}
+          <a href="{% url 'project_dependency_tree' project.slug %}" class="ml-2">
+            <span class="icon">
+              <i class="fa-solid fa-sitemap is-size-6"></i>
+            </span>
+          </a>
         {% else %}
           <span class="has-text-grey">0</span>
         {% endif %}