-
-
Notifications
You must be signed in to change notification settings - Fork 0
Remove astro-icon integration #1886
Copy link
Copy link
Open
Labels
prio:mediumMedium priority.Medium priority.status:confirmedConfirmed and accepted as valid work, but not yet in active implementation.Confirmed and accepted as valid work, but not yet in active implementation.type:dependenciesDependencies and upstream updates.Dependencies and upstream updates.type:refactorInternal code restructuring without an intended behaviour change.Internal code restructuring without an intended behaviour change.
Description
Activity
Metadata
Metadata
Assignees
Labels
prio:mediumMedium priority.Medium priority.status:confirmedConfirmed and accepted as valid work, but not yet in active implementation.Confirmed and accepted as valid work, but not yet in active implementation.type:dependenciesDependencies and upstream updates.Dependencies and upstream updates.type:refactorInternal code restructuring without an intended behaviour change.Internal code restructuring without an intended behaviour change.
Follow-up from Dependabot alert 424 / the
extract-zipfix.The site currently renders Bootstrap, Lucide, Simple Icons, and Font Awesome brand icons through
astro-icon. The security fix removed the vulnerableextract-zippath by overriding@iconify/tools, but we should remove theastro-iconintegration entirely instead of keeping that compatibility layer long-term.Target state:
astro-iconfromastro.config.tsand package metadata.@iconify/toolsand all@iconify-json/*packages.src/icons/; remove the generated Bootstrap icon workflow if it is no longer needed.References:
Known affected areas:
astro.config.tssrc/components/shared/links/IconLink.astrosrc/components/shared/elements/Button.astroastro-icon/componentssrc/content/social.jsonsimple-icons:*src/utils/icon-names.tssrc/scripts/maintenance/create-icon-types.tssrc/packages/site/astro.jsoncsrc/packages/site/icons.jsoncdocumentation/theme/icons.md.agents/instructions/src-components-astro.instructions.mdAcceptance criteria:
rg "astro-icon|@iconify|fa7-brands|bootstrap-icons"shows no runtime dependency on the old icon pipeline, except for historical documentation if deliberately retained.npm ls extract-zipremains empty.npm testpasses.npm run checkpasses.