
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@glyphicjs/core
Advanced tools
Layout and rendering engine for Glyphic — typed JSON in, deterministic SVG & PNG out, no headless browser. Built for LLMs and agents.
The rendering engine for Glyphic. Takes a validated diagram (JSON) and returns SVG, a high-resolution PNG, and React Flow JSON — with no headless browser.
npm install @glyphicjs/core @glyphicjs/schema
import { processDiagram } from "@glyphicjs/core";
import { writeFileSync } from "node:fs";
const result = await processDiagram({
type: "flowchart",
title: "Login flow",
direction: "TB",
nodes: [
{ id: "start", label: "Visit /login", shape: "rounded" },
{ id: "auth", label: "Valid credentials?", shape: "diamond" },
{ id: "ok", label: "Dashboard", shape: "rectangle" },
{ id: "err", label: "Show error", shape: "rectangle", metadata: { color: "#ef4444" } }
],
edges: [
{ source: "start", target: "auth" },
{ source: "auth", target: "ok", label: "yes" },
{ source: "auth", target: "err", label: "no" }
]
});
writeFileSync("login.png", result.png);
writeFileSync("login.svg", result.svg);
processDiagram(input, fontBuffer?)function processDiagram(
input: unknown,
fontBuffer?: ArrayBuffer
): Promise<RenderResult>;
input — any value; it is validated with @glyphicjs/schema's DiagramInput and throws a ZodError if invalid. (You can pass an already-parsed object or raw JSON.)fontBuffer (optional) — a .ttf/.otf buffer embedded into the PNG so a custom font appears in the raster (resvg cannot fetch remote font URLs at rasterization time).interface RenderResult {
svg: string; // scalable vector markup (role="img" + <title>)
png: Buffer; // high-resolution PNG (2× by default)
metadata: { width: number; height: number };
reactFlow?: ReactFlowConfig; // node/edge & flow diagrams only
}
svgandpngare always produced.reactFlowis included for graph/flow diagrams (not forpie,quadrant, orcanvas).
input ──▶ validate (@glyphicjs/schema)
──▶ layout (registry → elkjs / d3 / custom adapter)
──▶ scene graph (shapes, labels, edges, markers)
──▶ SVG (escaped + sanitized output)
──▶ PNG (@resvg/resvg-js, native)
Each diagram type is wired in src/registry.ts, which maps a type to its layout adapter and render strategy — the single place to extend. See CONTRIBUTING.
Pass a theme (preset string or object), a fontFamily / customFontUrl, and FontAwesome icons or customIcons directly in the diagram JSON. See the theming guide.
SVG output is escaped, and any custom SVG you provide (via customIcons or a
canvas node's raw-svg content) is run through a regex-based sanitizer that
strips <script> tags, event-handler attributes, and <foreignObject>. This
is defense-in-depth, not a guarantee — regex sanitization can't catch every
malformed-markup edge case. If you render the returned svg as live DOM in a
browser from untrusted input, sanitize it yourself with a proper HTML/SVG
sanitizer such as DOMPurify before
insertion. PNG output is unaffected, since it's rasterized bytes, not markup.
elkjs (graph layout), d3-hierarchy / d3-sankey / d3-shape (data layouts), @resvg/resvg-js (rasterization), and @fortawesome/* (icons).
FSL-1.1-ALv2 (Functional Source License) — converts to Apache-2.0 two years after each version's release.
FAQs
Layout and rendering engine for Glyphic — typed JSON in, deterministic SVG & PNG out, no headless browser. Built for LLMs and agents.
The npm package @glyphicjs/core receives a total of 38 weekly downloads. As such, @glyphicjs/core popularity was classified as not popular.
We found that @glyphicjs/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.