hipowered.dev/lucide
1
0
Fork 0
mirror of https://github.com/lucide-icons/lucide.git synced 2026-11-13 13:48:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,804 Commits 89 Branches 752 Tags
add-extra-checks
Commit Graph
152 Commits
Author SHA1 Message Date
Eric Fennis 917d2ca847 Merge branch 'main' of https://github.com/lucide-icons/lucide into add-extra-checks 2026-08-07 13:04:12 +02:00
Jakob GuddasericfennisEric Fenniscopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 		79fc531b30 ci(security): Pin sha actions (#4678) 
* cd: pin actions

* fix: remove trailing whitespace in release.yml to pass prettier lint

Co-authored-by: ericfennis <11825403+ericfennis@users.noreply.github.com>

* Format code

---------

Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: ericfennis <11825403+ericfennis@users.noreply.github.com>
 2026-08-07 11:31:26 +02:00
Eric Fennis dd4da98c1f Update sha 2026-08-07 10:42:33 +02:00
Eric Fennis cceab3d776 Merge branch 'main' of https://github.com/lucide-icons/lucide into ci-hardening 2026-08-07 09:53:25 +02:00
Copilotcopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>ericfennis
 		08e27e3387 Fix post-release: download lucide-font artifact by name into directory (#4675) 
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: ericfennis <11825403+ericfennis@users.noreply.github.com>
 2026-08-07 09:32:02 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 8503b1d4b7 chore(deps): bump the github-actions group with 13 updates (#4668) 
Bumps the github-actions group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `3` | `7` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `2` | `6` |
| [actions/setup-node](https://github.com/actions/setup-node) | `3.8.1` | `7.0.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `1` | `3` |
| [actions/stale](https://github.com/actions/stale) | `9` | `11` |
| [actions/github-script](https://github.com/actions/github-script) | `7` | `9` |
| [peter-evans/find-comment](https://github.com/peter-evans/find-comment) | `2` | `4` |
| [peter-evans/create-or-update-comment](https://github.com/peter-evans/create-or-update-comment) | `3` | `5` |
| [actions/labeler](https://github.com/actions/labeler) | `5` | `7` |
| [amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request) | `5` | `6` |
| [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `41` | `47` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` |


Updates `actions/checkout` from 3 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v7)

Updates `pnpm/action-setup` from 2 to 6
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/v2.0.0...v6)

Updates `actions/setup-node` from 3.8.1 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v3.8.1...v7.0.0)

Updates `softprops/action-gh-release` from 1 to 3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/v1...v3)

Updates `actions/stale` from 9 to 11
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/v9...v11)

Updates `actions/github-script` from 7 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v9)

Updates `peter-evans/find-comment` from 2 to 4
- [Release notes](https://github.com/peter-evans/find-comment/releases)
- [Commits](https://github.com/peter-evans/find-comment/compare/v2...v4)

Updates `peter-evans/create-or-update-comment` from 3 to 5
- [Release notes](https://github.com/peter-evans/create-or-update-comment/releases)
- [Commits](https://github.com/peter-evans/create-or-update-comment/compare/v3...v5)

Updates `actions/labeler` from 5 to 7
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/v5...v7)

Updates `amannn/action-semantic-pull-request` from 5 to 6
- [Release notes](https://github.com/amannn/action-semantic-pull-request/releases)
- [Changelog](https://github.com/amannn/action-semantic-pull-request/blob/main/CHANGELOG.md)
- [Commits](https://github.com/amannn/action-semantic-pull-request/compare/v5...v6)

Updates `tj-actions/changed-files` from 41 to 47
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](https://github.com/tj-actions/changed-files/compare/v41...v47)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)

Updates `actions/download-artifact` from 4 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4...v8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pnpm/action-setup
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/stale
  dependency-version: '11'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: peter-evans/find-comment
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: peter-evans/create-or-update-comment
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/labeler
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: amannn/action-semantic-pull-request
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: tj-actions/changed-files
  dependency-version: '47'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-06 13:37:32 +02:00
Eric FennisandClaude Opus 5 caa622b4ea ci(security): improve security with adding permissions (#4619) 
* ci(security): add scoped GITHUB_TOKEN permissions to all workflows

Every workflow now declares its token permissions explicitly instead of
inheriting the repository default, which satisfies OpenSSF Scorecard's
token-permissions check.

Multi-job and write-scoped workflows use `permissions: {}` as a
deny-by-default floor at the top level, with the actual grants declared
per job. Consolidating those grants at the workflow level would leak
scopes into jobs that don't need them — a `permissions` block replaces
rather than merges, so the empty top-level block also makes a forgotten
job block fail closed rather than inherit the default.

Single-job read-only package workflows keep a plain top-level
`contents: read`; there is no write scope to leak, so a second block per
file would only add noise.

Scopes were matched to what each job's steps actually do:

- linting-icons: `contents: read` per job. No `pull-requests: read` —
  tj-actions/changed-files only needs that with `use_rest_api: true`,
  and here it reads the local .git.
- lint-pr-title: `pull-requests: read`, which
  action-semantic-pull-request needs to read the PR title.
- close-stale-prs: `pull-requests: write` only; the job never checks out.
- comment-icon-preview: `actions: read` for the cross-run artifact
  download, plus `pull-requests: write` to post the comment.
- release: `contents: read` for the checkouts, `id-token: write` only on
  the publishing jobs that use npm provenance, and `contents: write` only
  on post-release, which uploads the release assets. The prepare job
  neither checks out nor calls the API, so its empty scope is explicit.
- ci: `contents: write` only on create-release; the reusable-workflow
  calls pass `id-token: write` and `contents: write` down to release.yml,
  since a called workflow can only reduce what the caller grants.

Verified with actionlint (no new findings) and zizmor (no
excessive-permissions findings).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(ci): correct pull_request path filter in the lucide-vue workflow

The Vue package lives in packages/vue, not packages/lucide-vue, so the
filter never matched and the workflow did not run for changes to the
package itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Remove empty scope in prepare

* Patch WeaknessCWE-506

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-06 09:57:00 +02:00
Thibaud-Vdb 8298424ae0 ci: pass only the secret the release workflow needs 
Both reusable calls to release.yml used 'secrets: inherit', which
forwards the caller's entire secret set. The only secret release.yml
reads is BLOB_READ_WRITE_TOKEN, used by the build-font job to upload
the code points blob; npm publishing is OIDC trusted publishing and
needs no token secret at all. Declare that one secret on the reusable
workflow and pass it explicitly, so the workflow files show exactly
which secret flows into the release path and nothing else does. It is
declared optional, so tag-push runs (which read it from the repo
secrets directly) and forks without the secret behave as before.
 2026-08-05 11:05:42 +02:00
Thibaud-Vdb 7c8f38774b ci: pin actions to commit SHAs 
Version tags are movable pointers: whoever controls an action's repo
can re-point them, and the previous commit's CVE is the proof it
happens in practice, to this very repository's dependency set. These
workflows hold real credentials: release.yml publishes the whole
lucide npm family with OIDC trusted publishing, ci.yml creates the
GitHub releases, and the comment and review workflows carry
pull-request write tokens.

Pinning by full commit SHA makes the reviewed code the code that runs.
Every pin keeps a version comment, resolved from the upstream repo and
cross-checked against its release tag (softprops v1 has no patch tag,
the comment names the floating tag it replaced). Dependabot understands
SHA pins and keeps bumping them with the comment in sync; the repo has
no dependabot.yml yet, adding one with the github-actions ecosystem is
a one-block follow-up.
 2026-08-05 11:05:00 +02:00
Eric Fennis cf0e1e44ba ci(release.yml): Remove concurrency field to prevent release mess (#4485) 2026-06-18 14:41:27 +02:00
Eric Fennis 5ff536e139 ci(release.yml): Fix workflow and remove version scripts in package scripts (#4479) 
* ci(release.yml): Remove new-version in release flow

* Remove version in scripts

* Update workflow
 2026-06-16 16:24:07 +02:00
Eric Fennis bb7d2d9839 ci(release.yml): Remove new-version in release flow (#4478) 2026-06-16 15:01:58 +02:00
Karsa c81e6846c5 test(build-font): added comprehensive unit tests on build-font tool (#4315) 2026-04-24 14:12:43 +02:00
Karsa fa09963bf8 fix(pipeline): revert custom angular publish step. not even this solves it. 2026-03-24 17:58:37 +01:00
Karsa f1360e1d9b feat(pipeline): fix working directory (angular, not @lucide/angular) 2026-03-24 17:50:32 +01:00
Karsa aed7aeaa72 feat(pipeline): move angular publish step from lucide-static ⇒ release 2026-03-24 17:46:54 +01:00
Karsa 25d96b7ec0 feat(pipeline): fix linting issues 2026-03-24 17:41:09 +01:00
Karsa 10962ce51b feat(pipeline): add separate Angular publish step using dist as the working directory & stripping publishConfig.directory from its package.json 2026-03-24 17:36:52 +01:00
Karsa 7dfbd21bce feat(pipeline): revert debug changes made to release.yml 2026-03-24 17:23:20 +01:00
Karsa b18f27ea8d feat(pipeline): add angular debug to release workflow 2026-03-24 17:14:31 +01:00
Karsa 5e6186ff70 feat(pipeline): add angular debug to release workflow 2026-03-24 17:12:55 +01:00
Karsa acb947a770 Merge remote-tracking branch 'origin/main' 2026-03-24 17:11:02 +01:00
Karsa e9bec8e6f8 feat(pipeline): add angular debug to release workflow 2026-03-24 17:10:48 +01:00
Karsa 4ea3561788 feat(pipeline): add angular debug to release workflow 2026-03-24 17:09:32 +01:00
Karsa 76c1b0caa9 feat(pipeline): add release-angular workflow for testing 2026-03-24 16:45:40 +01:00
Karsa f2eab2c30a feat(icons): debug angular release 2026-03-24 16:21:47 +01:00
Karsa 3fc90467a3 feat(pipeline): re-revert from the working-directory solution & set default tag as latest 2026-03-24 16:18:39 +01:00
Karsa 7a395122a1 feat(pipeline): revert to working-directory solution for testing 2026-03-24 16:10:24 +01:00
KarsaandEric Fennis 914919a4a3 fix(github/workflows): revert release workflow & add --fail-if-no-match (#4201) 
* fix(github/workflows): revert release workflow & add --fail-if-no-match
fix(packages/angular): add "analytics": false to angular.json to prevent build prompt

* Apply suggestion from @ericfennis

---------

Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
 2026-03-24 10:25:25 +01:00
Eric FennisandCopilot 3b63c139ae ci(ci.yml): Fix release flow (#4193) 
* ci(ci.yml): Fix release flow

* format code

* Update .github/workflows/release.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-03-24 09:14:50 +01:00
Eric Fennis e3db10ac9d ci(release.yml): Change release yml 2026-03-21 15:14:51 +01:00
Eric Fennis 73139fae2d ci(release.yml): Turn on @lucide/angular and @lucide/vue 2026-03-21 15:00:45 +01:00
Eric Fennis 56258a9281 Update release yml file 2026-03-20 15:36:33 +01:00
KarsaCopilotEric Fennis
 		a0e202d759 feat(packages/angular): add new @lucide/angular package (#3897) 
* Add new lucide angular package

* feat(packages/angular): added initial @lucide/angular package

* feat(packages/angular): update readme

* feat(packages/angular): update angular.json

* docs(packages/angular): added (for now) full documentation for @lucide/angular

* docs(packages/angular): added migration guide from lucide-angular

* fix(github): fix package label syntax 😅

* fix(lint): fix linting issues

* fix(github/angular): add prebuild stage

* fix(github/angular): add prebuild stage & fix tests

* fix(github/angular): fix LucideIconComponentType, update with _real_ public members

* fix(github/angular): add prebuild to build step manually

* fix(github/angular): downgrade vitest

* fix(packages/angular): fix migration guide code example

* fix(packages): add vitest + @vitest/* to pnpm overrides

* fix(packages): update pnpm-lock with merged version

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix(packages): fix aria-hidden logic

* fix(packages): update pnpm-lock

* fix(packages): extract vitest and jsdom to root devDependencies

* Fix copy utils script

* Format code

* feat(packages/angular): switched to self-describing IconData object from separate node+name – no more toKebabCase hackery
feat(packages/angular): renamed LucideIconComponentType => LucideIcon, and LucideIcon => LucideDynamicIcon
feat(packages/angular): added backwards compatible CSS class support
feat(packages/angular): switched to vector-effect: non-scaling-stroke implementation from computed stroke width
feat(packages/angular): rewrote icon provider to only accept a list of self-described icons – no more toKebabCase hackery & as an added bonus automatic backwards compatible alias support 🚀
feat(packages/angular): added legacy icon node helper function for passing legacy icons to providers
test(packages/angular): added unit tests on LUCIDE_CONFIG provider usage

* fix(packages/angular): fix linting issues

* feat(packages/angular): extract createLucideIcon logic into helper function, refactor export template to use the iconData object as defined in ExportTemplate

* Replace author

* Remove private field

* fix(packages/angular): remove createLucideIcon, it breaks the package :'(

* fix(packages/angular): fix rendering order of child elements (_before_ projected content)

* Format package.json

* Update docs/guide/packages/angular.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update packages/angular/MIGRATION.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-03-20 15:31:34 +01:00
Eric Fennis 0d7bb4f4a7 chore: Format code 2026-03-19 12:09:04 +01:00
Eric Fennis 7f19f6adf1 ci(release.yml): Fix access public 2026-03-19 11:03:29 +01:00
Eric Fennis 2a7eeb2d87 ci(version-1): Prepare CI.yml for next release tag (#4145) 2026-03-14 20:57:27 +01:00
KarsaandEric Fennis 8fe835c105 feat(packages): added new @lucide/icons package (#3881) 
* feat(packages): added lucide icons package skeleton

* feat(packages): added initial commit of @lucide/icons

* fix: fixed linting issues introduced in c4e5730bc4 (#3858)

* fix(packages/icons): update package, remove UMD export

* fix(packages/icons): update github actions

* docs(packages/icons): add documentation for various helpers and types

* fix(.github/ISSUE_TEMPLATE): fix linting issue (@ is a reserved character)

* fix(packages/icons): fix linting issues in configs

* feat(packages/icons): rename from packages/lucide-icons => packages/icons

* fix(pnpm): update lockfile

* fix(packages/icons): update readme and documentation

* fix(packages/icons): update absoluteStrokeWidth implementation

* test(packages/icons): update absoluteStrokeWidth unit test

* feat(packages/icons): add backwards compatible alias support in buildLucideIconNode

* feat(packages/icons): fix linting issues in build tools

* fix(packages/icons): rename LucideIcon => LucideIconData

---------

Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
 2026-03-13 10:18:53 +01:00
Eric Fennis 6faa55d34e Merge branch 'main' of https://github.com/lucide-icons/lucide into next 2026-03-06 10:49:44 +01:00
Eric Fennis c5b155ec37 Merge branch 'main' of https://github.com/lucide-icons/lucide into next 2026-03-05 18:47:02 +01:00
Eric Fennis e8e800f98d ci(build-font): Fix env var GH actions 2026-03-04 10:39:55 +01:00
Eric FennisandCopilot de6ddfe381 fix(lucide-font, lucide-static): Fixing stable code points (#3894) 
* Refactor font building

* Add lucide-font to gitignore

* Adjust workflow

* update lockfile

* Fixing code points build

* Adds next solution after build

* adds addLigatures to config

* Make code point consistent

* Format code

* Add todo

* Add comment in ci file

* Update tools/build-font/src/allocateCodepoints.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update tools/build-font/src/outlineSVGs.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-02-27 16:29:52 +01:00
Eric Fennis 5720278ef7 Merge branch 'main' of https://github.com/lucide-icons/lucide into next 2026-02-21 13:04:38 +01:00
Eric Fennis 80923a08b3 ci(ci.yml): Adds workflow_dispatch option to trigger manual release 2026-02-19 13:16:14 +01:00
Eric Fennis 881e733159 Merge branch 'main' of https://github.com/lucide-icons/lucide into next 2025-12-12 09:34:11 +01:00
Eric Fennis c2b059fb60 ci(release.yml): Remove deprecated token assignment 2025-12-10 13:12:55 +01:00
Eric Fennis 5ecf78bb8a Merge branch 'main' of https://github.com/lucide-icons/lucide into next 2025-11-27 10:58:34 +01:00
Eric Fennis f78061b488 ci(workflows): Enable trusted publishing in release (#3808) 
* Add permissions for trusted publishing to workflows

* update pnpm

* Update workflow deps

* format code
 2025-11-27 10:58:14 +01:00
Eric FennisandCopilot 7bbb1e1fea feat(@lucide/vue): Rename Vue package name to @lucide/vue (#3337) 
* Remove old vue 2 package

* Add @lucide/vue package

* Remove old vue 2 doc

* Update docs

* Adjust export template

* Adjust vue package!

* Fix tests

* Format code

* Update packages/vue/src/Icon.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Adjust vue package in docs

* Update deadlinks

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-09-11 14:38:34 +02:00
Eric Fennis 987edb14f8 ci(release.yml): Disable lucide-vue release (Deprecated) 2025-08-08 13:41:34 +02:00