Enhance the dependency tree view in a more dynamic rendering (#1742)

Signed-off-by: tdruez <tdruez@nexb.com>

Author: tdruez

CHANGELOG.rst

@@ -18,6 +18,10 @@ v35.2.0 (unreleased)
   ``policies.yml`` file.
   https://github.com/aboutcode-org/scancode.io/issues/1348
 
+- Enhance the dependency tree view in a more dynamic rendering.
+  Vulnerabilities and compliance alert are displayed along the dependency entries.
+  https://github.com/aboutcode-org/scancode.io/pull/1742
+
 v35.1.0 (2025-07-02)
 --------------------
 

scancodeio/static/iamkate-tree-views/expand-collapse.svg

@@ -0,0 +1,75 @@
+.tree{
+  --spacing : 1.5rem;
+  --radius  : 10px;
+}
+
+.tree li{
+  display      : block;
+  position     : relative;
+  padding-left : calc(2 * var(--spacing) - var(--radius) - 2px);
+}
+
+.tree ul{
+  margin-left  : calc(var(--radius) - var(--spacing));
+  padding-left : 0;
+}
+
+.tree ul li{
+  border-left : 2px solid #ddd;
+}
+
+.tree ul li:last-child{
+  border-color : transparent;
+}
+
+.tree ul li::before{
+  content      : '';
+  display      : block;
+  position     : absolute;
+  top          : calc(var(--spacing) / -2);
+  left         : -2px;
+  width        : calc(var(--spacing) + 2px);
+  height       : calc(var(--spacing) + 1px);
+  border       : solid #ddd;
+  border-width : 0 0 2px 2px;
+}
+
+.tree summary{
+  display : block;
+  cursor  : pointer;
+}
+
+.tree summary::marker,
+.tree summary::-webkit-details-marker{
+  display : none;
+}
+
+.tree summary:focus{
+  outline : none;
+}
+
+.tree summary:focus-visible{
+  outline : 1px dotted #000;
+}
+
+.tree li::after,
+.tree summary::before{
+  content       : '';
+  display       : block;
+  position      : absolute;
+  top           : calc(var(--spacing) / 2 - var(--radius));
+  left          : calc(var(--spacing) - var(--radius) - 1px);
+  width         : calc(2 * var(--radius));
+  height        : calc(2 * var(--radius));
+  border-radius : 50%;
+  background    : #ddd;
+}
+
+.tree summary::before{
+  z-index    : 1;
+  background : #696 url('expand-collapse.svg') 0 0;
+}
+
+.tree details[open] > summary::before{
+  background-position : calc(-2 * var(--radius)) 0;
+}

scancodeio/static/iamkate-tree-views/tree.css

@@ -0,0 +1,10 @@
+about_resource: tree.css
+name: css-tree-views
+homepage_url: https://iamkate.com/code/tree-views/
+description: A tree view (collapsible list) can be created using only html and css, without
+  the need for JavaScript. Accessibility software will see the tree view as lists nested inside
+  disclosure widgets, and the standard keyboard interaction is supported automatically.
+license_expression: cc0-1.0
+licenses:
+  - key: cc0-1.0
+    name: cc0-1.0

scancodeio/static/iamkate-tree-views/tree.css.ABOUT

@@ -0,0 +1,29 @@
+Free content on iamkate.com
+The web was still young when I first went online in 1998. It felt like a utopian dream of free culture and free knowledge. Anyone could contribute, and within weeks I had learnt html and created my first site, hosted in the 10mb of webspace my isp included as standard.
+
+I’ve watched as the dream has become a nightmare of surveillance and monetisation. Companies such as Google and Facebook offer their services for free to the public because their real products are their advertising networks powered by the personal data of their visitors.
+
+The only concern of these companies and their shareholders is to maximise their income from advertising, regardless of the costs to society. They use dubious schemes to avoid paying tax. They encourage addiction and risk the mental health of their visitors. They threaten democratic institutions.
+
+I have little influence over the wider web, but I can control my small part of it, creating a haven that remains true to the original dream. This page describes my approach to copyright, my promise to protect the privacy of my visitors, and my commitment to transparency.
+
+Copyright
+Copyright limits creativity and holds back progress by restricting our rights to build upon the works of others. Copyleft licences attempt to use copyright against itself, but “the master’s tools will never dismantle the master’s house”, as Audre Lorde remarked in a different context.
+
+All content on my site is released under the terms of the Creative Commons CC0 1.0 Universal Legal Code. This means I have waived all copyright and related rights to the extent possible under law, with the intention of dedicating the content to the public domain. You can use and adapt it without attribution.
+
+Privacy
+Every site is hosted on a server, which is usually operated by a third party due to the expertise needed to manage servers securely. Most sites are accessed indirectly through the servers of a content delivery network, which protects the original server from attacks that could disable the site.
+
+My site is hosted on Cloudflare Pages. Cloudflare is both the host and the content delivery network, avoiding the need to trust two separate third parties. Cloudflare have a strong commitment to privacy and data protection, and frequently write about developing systems to protect visitor privacy.
+
+Almost every site today includes code that tracks visitors for statistical and advertising purposes. Often the site owner includes code with the deliberate aim of tracking their visitors, but sometimes they just want to include a feature provided by a third party, and that provider includes their own tracking code.
+
+My site doesn’t include any tracking code, and doesn’t load any code from third parties. It doesn’t have a cookie banner because it doesn’t use cookies. Instead of an invasive analytics system, Cloudflare Web Analytics gives me the most important statistics without tracking individual visitors.
+
+Transparency
+You probably don’t know me, and shouldn’t have to trust me. Instead, you should be able to check security and privacy claims for yourself. Unfortunately most sites today use a process called code minification, which makes them faster but also makes it harder for other people to understand their code.
+
+The Mozilla Observatory report for my site confirms the presence of various security and privacy features, resulting in a perfect A+ rating. One of these features, the content security policy, prevents browsers from loading code and other resources from third parties.
+
+My site doesn’t need to use code minification in order to load quickly due to its simple design, efficient implementation, and absence of resources loaded from third parties. As a result, other software developers can easily understand how the layout, styling, and interactive features are created.

scancodeio/static/iamkate-tree-views/tree.css.NOTICE

@@ -2568,6 +2568,13 @@ def from_db(cls, db, field_names, values):
 
         return new
 
+    @property
+    def has_compliance_issue(self):
+        """Return True if the compliance status is not OK or not set."""
+        if not self.compliance_alert or self.compliance_alert == self.Compliance.OK:
+            return False
+        return True
+
     @property
     def license_policy_index(self):
         return self.project.license_policy_index

scanpipe/models.py

@@ -39,6 +39,11 @@
           <a href="{% url 'project_dependencies' project.slug %}">
             {{ project.discovereddependencies_count|intcomma }}
           </a>
+          <a href="{% url 'project_dependency_tree' project.slug %}">
+            <span class="icon">
+              <i class="fa-solid fa-sitemap fa-sm"></i>
+            </span>
+          </a>
         {% else %}
           <span>0</span>
         {% endif %}

scanpipe/templates/scanpipe/includes/project_list_table.html

@@ -44,6 +44,11 @@
               {{ project.vulnerable_dependency_count|intcomma }}
             </a>
           {% endif %}
+          <a href="{% url 'project_dependency_tree' project.slug %}" class="ml-2">
+            <span class="icon">
+              <i class="fa-solid fa-sitemap is-size-6"></i>
+            </span>
+          </a>
         {% else %}
           <span class="has-text-grey">0</span>
         {% endif %}

scanpipe/templates/scanpipe/includes/project_summary_level.html

@@ -1,7 +1,25 @@
 {% extends "scanpipe/base.html" %}
+{% load static %}
 
 {% block title %}ScanCode.io: {{ project.name }} - Dependency tree{% endblock %}
 
+{% block extrahead %}
+<link rel="stylesheet" href="{% static 'iamkate-tree-views/tree.css' %}" crossorigin="anonymous">
+<style>
+  .tree {
+    line-height: 1.8rem;
+    --spacing : 2rem;
+  }
+  .tree summary {
+    display: inline-block;
+  }
+  .tree summary::before{
+    background-color: rgb(72, 199, 142);
+    background-image: url('{% static "iamkate-tree-views/expand-collapse.svg" %}');
+  }
+</style>
+{% endblock %}
+
 {% block content %}
   <div id="content-header" class="container is-max-widescreen mb-3">
     {% include 'scanpipe/includes/navbar_header.html' %}
@@ -13,64 +31,127 @@
   </div>
 
   <div class="container is-max-widescreen mb-3">
-    {% if recursion_error %}
-      <article class="message is-danger">
-        <div class="message-body">
-          The dependency tree cannot be rendered as it contains circular references.
-          {{ message|linebreaksbr }}
-        </div>
-      </article>
-    {% endif %}
-    <div id="tree"></div>
+    <section class="mx-5">
+      {% if recursion_error %}
+        <article class="message is-danger">
+          <div class="message-body">
+            The dependency tree cannot be rendered as it contains circular references.
+            {{ message|linebreaksbr }}
+          </div>
+        </article>
+      {% endif %}
+
+      <div class="mb-4">
+        <button id="collapseAll" class="button is-small">
+          <span>Collapse All</span>
+          <span class="icon is-small">
+            <i class="fas fa-minus"></i>
+          </span>
+        </button>
+        <button id="expendAll" class="button is-small">
+          <span>Expend All</span>
+          <span class="icon is-small">
+            <i class="fas fa-plus"></i>
+          </span>
+        </button>
+        <button id="showVulnerableOnlyButton" class="button is-small">
+          <span>Show Vulnerable only</span>
+          <span class="icon is-small">
+            <i class="fa-solid fa-bug"></i>
+          </span>
+        </button>
+        <button id="showComplianceAlertOnlyButton" class="button is-small">
+          <span>Show Compliance Alert only</span>
+          <span class="icon is-small ">
+            <i class="fa-solid fa-scale-balanced"></i>
+          </span>
+        </button>
+      </div>
+
+      <ul id="tree" class="tree">
+        <li>
+          <details open>
+            <summary class="has-text-weight-semibold">
+              {{ dependency_tree.name }}
+            </summary>
+            {% include 'scanpipe/tree/dependency_children.html' with children=dependency_tree.children %}
+          </details>
+        </li>
+      </ul>
+    </section>
   </div>
 {% endblock %}
 
 {% block scripts %}
-  <script src="https://d3js.org/d3.v7.min.js"></script>
-  <script src="https://cdn.jsdelivr.net/npm/@observablehq/plot@0.6"></script>
-  {{ dependency_tree|json_script:"dependency_tree" }}
-  {{ row_count|json_script:"row_count" }}
-  {{ max_depth|json_script:"max_depth" }}
-  <script>
-    const data = JSON.parse(document.getElementById("dependency_tree").textContent);
-    const hierarchyData = d3.hierarchy(data);
-    const columnWidth = 110;
-    const rowWidth = 25;
-    const columnCount = hierarchyData.height;
-    const rowCount = hierarchyData.links().length;
-    const width = columnWidth * (columnCount + 1);
-    const height = rowWidth * (rowCount + 1);
-
-    function indent() {
-      return (root) => {
-        root.eachBefore((node, i) => {
-          node.y = node.depth;
-          node.x = i;
-        });
-      };
+<script>
+  document.addEventListener('DOMContentLoaded', () => {
+    const treeContainer = document.getElementById('tree');
+    const collapseAllButton = document.getElementById('collapseAll');
+    const expendAllButton = document.getElementById('expendAll');
+
+    function collapseAllDetails() {
+      document.querySelectorAll('details').forEach(details => {
+        details.removeAttribute('open');
+      });
+      showAllListItems();
+    }
+
+    function expendAllDetails() {
+      document.querySelectorAll('details').forEach(details => {
+        details.setAttribute('open', ''); // Adding 'open' attribute to open the details
+      });
+      showAllListItems();
+    }
+
+    collapseAllButton.addEventListener('click', collapseAllDetails);
+    expendAllButton.addEventListener('click', expendAllDetails);
+
+    // Following function are use to limit the display to specific elements.
+
+    function expandAncestors(detailsElement) {
+      let parent = detailsElement.parentElement.closest('details');
+      while (parent) {
+        parent.setAttribute('open', '');
+        parent.parentElement.style.display = '';
+        parent = parent.parentElement.closest('details');
+      }
+    }
+
+    function showAllListItems() {
+      const listItems = treeContainer.querySelectorAll('li');
+      listItems.forEach(item => {
+          item.style.display = '';
+      });
+    }
+
+    function hideAllListItems() {
+      const listItems = treeContainer.querySelectorAll('li');
+      listItems.forEach(item => {
+          item.style.display = 'none';
+      });
+    }
+
+    function handleItems(attribute, value) {
+      collapseAllDetails();
+      hideAllListItems();
+
+      const items = document.querySelectorAll(`li[${attribute}="${value}"]`);
+      items.forEach(item => {
+          item.style.display = 'block';
+          expandAncestors(item);
+      });
+    }
+
+    function handleVulnerableItems() {
+      handleItems('data-is-vulnerable', 'true');
+    }
+
+    function handleComplianceAlertItems() {
+      handleItems('data-compliance-alert', 'true');
     }
 
-    // https://observablehq.com/plot/marks/tree
-    const plot = Plot.plot({
-      axis: null,
-      margin: 10,
-      marginLeft: 40,
-      marginRight: 160,
-      width: width,
-      height: height,
-      marks: [
-        Plot.tree(hierarchyData.leaves(), {
-          path: (node) => node.ancestors().reverse().map(({ data: { name } }) => name).join("|"),
-          delimiter: "|",
-          treeLayout: indent,
-          strokeWidth: 1,
-          curve: "step-before",
-          fontSize: 14,
-          textStroke: "none"
-        })
-      ]
-    });
-
-    document.getElementById("tree").appendChild(plot);
-  </script>
+    showVulnerableOnlyButton.addEventListener('click', handleVulnerableItems);
+    showComplianceAlertOnlyButton.addEventListener('click', handleComplianceAlertItems);
+  });
+</script>
 {% endblock %}