DPUse Development

Actions for managing DPUse projects.

Installation

Install as a development dependency:

cd dpuse-development
npm install --save-dev @dpuse/dpuse-development

See the Data Positioning security documentation for additional initialization requirements.

Actions

The package implements the following actions:

| Name | Notes | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | auditDependencies | Audit the project's dependencies for known security vulnerabilities. uses the owasp-dependency-check module to perform the checks. Updates the OWASP badge(s) at the top of this page. Also runs the 'npm outdatedcommand. | | buildDirectoryIndex | Build an index for the specified directory path. | | buildProject | Builds the package using Vite. Output to '/dist' directory. Wrangler for api. Nuxt for app-nuxt. Builds bundle analysis reports. | | checkDependencies | Identifies outdated dependencies using npm outdatedandnpm-check-updateswith option to automatically install latest versions. | | documentDependencies | Identify licenses of the project's production and peer dependencies. Updates the table in the **Dependency Licenses** section of this page and summary files licenses.json and licenseTree.json in th licenses directory of this repository. Also downloads a copy of dependency license tolicenses/downloads'.. | | formatCode | Uses prettier to enforce formatting style rules. | | lintCode | Uses eslint to check the code for potential errors and enforces coding style rules. | | releaseProject | Bump version, builds config, builds project, synchronise with GitHub and publish to npm or Cloudflare. | | syncProjectWithGitHub | Synchronise the local repository with the main GitHub repository. | | testProject | ❌ Not implemented. | | updateDPUseDependencies | Install the latest version of the specified Data Positioning dependencies. |

Usage

All utilities are designed to be run from package.json scripts and assume that the project follows the standard Data Positioning directory structure and that it includes a config.json file in the root directory.

{
    ...
    "scripts": {
        "audit": "node -e \"import('@dpuse/dpuse-development').then(m => m.auditDependencies())\"",
        "build": "node -e \"import('@dpuse/dpuse-development').then(m => m.buildProject())\"",
        "check": "node -e \"import('@dpuse/dpuse-development').then(m => m.checkDependencies())\"",
        "document": "node -e \"import('@dpuse/dpuse-development').then(m => m.documentDependencies(['MIT']))\"",
        "format": "node -e \"import('@dpuse/dpuse-development').then(m => m.formatCode())\"",
        "lint": "node -e \"import('@dpuse/dpuse-development').then(m => m.lintCode())\"",
        "release": "node -e \"import('@dpuse/dpuse-development').then(m => m.releaseProject())\"",
        "sync": "node -e \"import('@dpuse/dpuse-development').then(m => m.syncProjectWithGitHub())\"",
        "test": "node -e \"import('@dpuse/dpuse-development').then(m => m.testProject())\"",
        "update": "node -e \"import('@dpuse/dpuse-development').then(m => m.updateDPUseDependencies(['development']))\""
    }
    ...
}

Resources

Common resources (files) used across Data Positioning projects.

| Name | File | | --------------------------------------------- | -------------------------------------------------------------------- | | ESLint rules * | eslint.config.ts | | Git path attributes | .gitattributes | | Git ignore rules for published repositories | resources/.gitignore_PUBLISHED | | Git ignore rules for unpublished repositories | resources/.gitignore_UNPUBLISHED | | LICENSE | LICENSE | | Markdown lint rules | .markdownlint.json | | VS Code key bindings | resources/vsCodeKeyBindings.json |

Bundle Analysis Reports

The Bundle Analysis Report provides a detailed breakdown of the bundle’s composition and module sizes, helping identify which modules contribute most to the final build. It is generated automatically on each release using the npm package rollup-plugin-visualizer.

View the Bundle Analysis Report created by the rollup visualiser plugin.

View the Bundle Analysis Report created by the sonda plugin.

Dependency Check Report

The OWASP Dependency Check Report identifies known vulnerabilities in project dependencies. It is generated automatically on each release using the npm package owasp-dependency-check.

View the OWASP Dependency Check Report

Dependency Licenses

The following table lists the top-level production and peer dependencies. All of these dependencies—along with their transitive dependencies—have been recursively verified to use one of the following commercially friendly licenses: BSD-2-Clause, CC0-1.0, or MIT. Developers cloning this repository should independently verify all development and optional dependencies. This project supports development activities only. It is not used in production or distributed in any other form.

We use the npm packages license-report, license-report-check, license-report-recursive and license-downloader to identify all dependency licenses and include copies of them. We do not use any unlicensed dependencies in either production or development.

|Name|Type|Installed|Latest|Latest Released|Deps|Document| |:-|:-|:-:|:-:|:-|-:|:-| |@dpuse/dpuse-shared|MIT|0.3.594 ⚠️|0.3.595|this month: 2026-03-23|0|LICENSE| |acorn|MIT|8.16.0|8.16.0|1 month ago: 2026-02-19|0|⚠️ No license file| |acorn-typescript|MIT|1.4.13|1.4.13|26 months ago: 2024-01-03❗|1|LICENSE| |acorn-walk|MIT|8.3.5|8.3.5|1 month ago: 2026-02-19|1|⚠️ No license file| |nanoid|MIT|5.1.7|5.1.7|this month: 2026-03-15|0|LICENSE| |valibot|MIT|1.3.1|1.3.1|this month: 2026-03-18|1|LICENSE.md|

Insert link to other document for detailed explanation. Only show messages if issues arise.

1. Installed column:

   The ⚠️ symbol indicates that the installed version does not match the latest available version.”.

2. Latest Release column:

   The ⚠️ symbol indicates that the dependency has gone more than 6 months without an update but no more than 12 months.

   The ❗ symbol indicates a dependency that has gone more than 12 months without an update.

   If a dependency has no, or only a small number of, transitive dependencies, then it may not require frequent updates. The Deps column shows the number of transitive dependencies. Full details for these dependencies can be found in licenses/licenseTree.json.

3. Document column:

   The “⚠️ No license file” message indicates a dependency that does not include a license file.

License

This project is licensed under the MIT License, permitting free use, modification, and distribution.

MIT © 2026 DPUse Pty Ltd