D3
Last updated: Mar 25, 2026
Rationale
D3.js and Billboard.js are used to render pre-computed analytics in the platform dashboard.
The main reasons why we chose them over other alternatives are:
- They are open source.
- D3 is the de facto standard for data-driven documents
and gives full control over rendering and DOM;
generators use it for selection and layout
(e.g.,
d3.select,d3.selectAll). - Billboard.js is built on D3 and provides ready-made chart types (line, bar, stacked bar, etc.) that match our needs and reduce custom code.
- The stack fits our analytics pipeline: pre-computed data is stored, then served to the front end; no server-side chart rendering is required.
- Charts run in the browser from static JSON produced by generators.
Alternatives
The following alternatives are being considered:
Evidence.dev
- Evidence.dev is an open-source BI framework (Markdown + SQL) that could leverage Snowflake, which we already use.
- Evidence Studio requires an Enterprise license
to embed charts as iframes,
blocking the primary integration surface (
Graphiccomponent). - Evidence Studio does not support GitLab versioning; report definitions live only on Evidence's platform, conflicting with the team's standard workflow.
- Evidence OSS has no built-in access control; securing chart pages would require a custom reverse proxy or auth layer, adding significant infrastructure work.
Plotly
- Plotly is an open source charting library.
- It does not require a new service; charts can be built by using a SQL query to snowflake without pre-computing the data.
- Charts are interactive out of the box (hover, zoom, pan, click events).
- With the current D3/Billboard approach
each graph takes normally under 1 second;
Plotly charts take 2-5 seconds per graph
without
alru_cache, degrading the dashboard experience. - The Plotly.js CDN bundle is ~3 MB, adding significant weight to each chart response inside sandboxed iframes.
Apache ECharts
- Apache ECharts offers many chart types and is another option worth considering.
- We stayed with D3 and Billboard for their smaller API surface and existing generator integration.
Usage
We use D3.js and Billboard.js to render analytics in the platform:
- Pre-computed chart data is loaded from storage and sent to the client.
- The front end loads D3 and Billboard and runs chart the generator logic for each visualization.
- Generators consume the data and use D3 and Billboard to draw the chart on the page.
Commitlint
Learn about Commitlint, the tool chosen by Fluid Attacks for standardizing and validating commit messages through CI/CD tests.
Dependency licenses
Learn which third-party dependency licenses Fluid Attacks accepts across its components, why the boundary sits where it does, and how it is enforced.