🐛 fix(ui): resolve iconify aliases and broken references in the icon bundle by scttbnsn · Pull Request #683 · CodesWhat/drydock

scttbnsn · 2026-08-09T00:49:39Z

What

The icon bundle is regenerated from the locked @iconify-json packages during every Docker image build (npm run build → npm run icons), but extract-icons.mjs only looked up plain icon entries — never aliases. lucide 1.2.121 demoted history to an alias of rotate-ccw-clock, so every image built since that pin ships without lucide:history, and the Audit nav icon renders blank in the Lucide icon theme (the offline iconify API module means there's no network fallback). The committed bundle still had the icon only because it was generated from stale node_modules (lucide 1.2.107).

Regenerating with the lockfile-correct packages also exposed references that have never resolved — broken in production all along:

iconoir:history, iconoir:gitlab, iconoir:stack don't exist in the locked iconoir 1.2.11
fa6-brands:github/gitlab/google/microsoft (registry icons in the Font Awesome theme) — the @iconify-json/fa6-brands package was never a dependency

Fix

extract-icons.mjs resolves alias chains (parent-following, depth-capped); aliases carrying rotate/flip transforms are refused with a warning since the body-only bundle can't represent them
iconoir:history → iconoir:clock-rotate-right, iconoir:gitlab → iconoir:gitlab-full, iconoir:stack → iconoir:multiple-pages (group-view toggle in the containers list)
@iconify-json/fa6-brands added (exact-pinned, build-time only)
Bundle regenerated: 576/576 references extracted, zero warnings
New guard test asserts every icons.ts reference exists in the committed bundle, so a collection rename fails CI instead of shipping a blank glyph

Wants to land before v1.6.0-rc.13 so the fix rides the release.

Changelog

✨ Added exact-pinned @iconify-json/fa6-brands@1.2.6 to devDependencies.
✨ Added a guard test for unresolved icon references.
🔧 Changed extract-icons.mjs to resolve chained aliases.
🔧 Changed Iconoir mappings to use icons in the locked collection.
🐛 Fixed missing icon references in the generated bundle.
🐛 Regenerated the bundle with 576 valid references.
⚠️ Alias transforms that require rotation or flipping remain unsupported.

Concerns

Confirm that the guard test runs in the standard UI test pipeline.
Confirm that the alias depth limit covers all supported collection aliases.
Review whether unsupported alias transforms should fail the build instead of only emitting warnings.

…bundle - 🐛 fix(ui): resolve alias chains in extract-icons.mjs so renamed icons (lucide:history) survive regeneration - 🐛 fix(ui): point iconoir audit/gitlab/stack references at icons that exist in the locked collection - 📦 deps(ui): add @iconify-json/fa6-brands for the Font Awesome registry brand glyphs - ✅ test(ui): guard that every icons.ts reference exists in the committed bundle - 📝 docs: changelog entry

vercel · 2026-08-09T00:49:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview	Aug 9, 2026 1:29am
drydockdemo-website	Ready	Preview	Aug 9, 2026 1:29am

coderabbitai · 2026-08-09T00:49:50Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a8f8a771-ff91-4e1c-91a4-6975b1364ccf

📥 Commits

Reviewing files that changed from the base of the PR and between 56f5544 and abdea8a.

⛔ Files ignored due to path filters (1)

ui/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (1)

ui/package.json

🚧 Files skipped from review as they are similar to previous changes (1)

ui/package.json

📝 Walkthrough

Walkthrough

The UI adds the Font Awesome 6 brands package. Icon extraction now resolves recursive, untransformed aliases with a depth limit and warnings for unsupported transforms. The icon bundle updates SVG paths and adds Lucide, Iconoir, and Font Awesome icons. Three Iconoir mappings now use new identifiers. A test verifies that every icon referenced by icons.ts has a nonempty bundle body.

Possibly related PRs

CodesWhat/drydock#608: Both changes update the tabler:server SVG path.
CodesWhat/drydock#668: Both changes update the tabler:server SVG path.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/v1.6-icon-bundle-alias

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

scttbnsn · 2026-08-09T01:18:11Z

@coderabbitai review

coderabbitai · 2026-08-09T01:18:17Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

🧹 Nitpick comments (1)

ui/package.json (1)
31-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Keep the Iconify collection out of runtime installs.

@iconify-json/fa6-brands is used by ui/scripts/extract-icons.mjs to generate the committed bundle. The application uses ui/src/boot/icon-bundle.json, so the collection is not needed at runtime. Move Line 31 to devDependencies and verify the lockfile entry after the move.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ui/package.json` at line 31, Move `@iconify-json/fa6-brands` from dependencies
to devDependencies in package.json, preserving its version, since it is only
consumed by the extract-icons.mjs build script. Regenerate or update the
lockfile so its dependency classification reflects the move, and verify the
application runtime dependencies no longer include the collection.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ui/package.json`:
- Line 31: Move `@iconify-json/fa6-brands` from dependencies to devDependencies in
package.json, preserving its version, since it is only consumed by the
extract-icons.mjs build script. Regenerate or update the lockfile so its
dependency classification reflects the move, and verify the application runtime
dependencies no longer include the collection.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4db788f8-440f-476d-8d67-c8882c89745d

📥 Commits

Reviewing files that changed from the base of the PR and between 9e4e56c and 56f5544.

⛔ Files ignored due to path filters (2)

CHANGELOG.md is excluded by !CHANGELOG.md
ui/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (5)

ui/package.json
ui/scripts/extract-icons.mjs
ui/src/boot/icon-bundle.json
ui/src/icons.ts
ui/tests/boot/icon-bundle.spec.ts

… siblings

scttbnsn · 2026-08-09T01:27:31Z

Nitpick addressed in abdea8a — moved to devDependencies with the sibling collections; regenerated bundle is byte-identical.

biggest-littlest

LGTM

17-file identity roll-forward from rc.12 to rc.13, dated 2026-08-08. - CHANGELOG: new `[1.6.0-rc.13]` section from Unreleased content — #670 digest re-anchoring, #672 self-hosted Star History, #673 nanoid pin, #682 node 24.19.0 + trivy 0.73.0 base-image bumps, #683 icon-bundle alias resolution — plus compare-link rotation - README: version badge + rc.13 highlights block - Demo mocks, site config/content, docs API pages, quickstart, updates highlights, identity-test constants, changelog-link pairs Guarded by `scripts/release-identity.test.mjs` (4/4) and the web scripts suite (56/56). Once merged: dev→main wholesale-tree sync, then dispatch `release-cut.yml` for `v1.6.0-rc.13`. GA candidate clock restarts — earliest GA ≈ Aug 16.  ## Changelog 🔧 **Changed** - Advanced the release identity from `1.6.0-rc.12` to `1.6.0-rc.13`, dated August 8, 2026. - Updated README, demo mocks, site configuration, roadmap content, API examples, quickstart, and update highlights. - Updated changelog comparison links and release identity test constants. - Added release notes for digest re-anchoring, self-hosted Star History, `nanoid` pins, Node 24.19.0 and Trivy 0.73.0 base images, and icon-bundle alias resolution. 🔒 **Security** - Documented workspace-wide `nanoid` security pinning. - Documented base-image CVE remediation. ## Concerns - Sync the `dev` tree to `main` after merge. - Dispatch `release-cut.yml` for `v1.6.0-rc.13`. - Confirm the expected GA date remains approximately August 16.

Wholesale-tree sync ahead of the v1.6.0-rc.13 cut (same pattern as #667). The single commit carries the exact tree of `dev/v1.6` at b98808e onto `main` — after merge, `git diff --quiet origin/main origin/dev/v1.6` holds. Content on dev since rc.12: - #669/#670 — release-cut digest re-anchoring - #672 — self-hosted Star History chart - #673 — NAS acceptance follow-ups - #681 — v1.7 dependency ordering (forward-ported) - #682 — CVE base-image bumps + digest-pinned Node base guard test - #683 — icon-bundle alias resolution (fixes blank Audit/registry icons shipped in rc.12) - #684 — rc.13 identity roll-forward (17 files, CHANGELOG, README)  ## Changelog - ✨ Added repository-aware Docker digest selection and multi-anchor comparison. - ✨ Added self-hosted, theme-aware Star History SVG API with pagination, caching, deadlines, and fallback rendering. - ✨ Added icon alias resolution and bundle coverage tests. - ✨ Added required icon bundle entries and updated icon mappings. - 🔧 Updated Node and Trivy image digests. - 🔒 Pinned `nanoid` to `3.3.18` across workspaces. - 🔒 Added a digest-pinned Node 24 Alpine base-image guard test. - 🔧 Updated `js-yaml` override to `3.15.1`. - 🔧 Updated release documentation, examples, mocks, badges, and tests to `1.6.0-rc.13`. - 🔧 Removed the external Star History CSP allowlist and embed. ## Concerns - Verify the Star History route stays within GitHub API rate limits under concurrent requests. - Verify cache headers do not serve incomplete or repository-specific fallback responses incorrectly. - Verify Docker digest re-anchoring preserves legacy behavior for stored containers without `repoDigests`. - Verify icon aliases with rotation or flipping have acceptable fallback behavior. - Run the Docker, Star History, icon-bundle, release-identity, and workspace dependency tests.

) (#686) Forward-ports #683 to dev/v1.7. #680 fixed the symptom here (direct icon-name renames) but not the root cause: `ui/scripts/extract-icons.mjs` still dropped icons that iconify collections demote to aliases (`collection.aliases[name].parent`), so any future collection bump could silently ship broken icons again — that's exactly how rc.12 shipped a blank Audit icon. What's in the port: - `extract-icons.mjs`: `resolveIcon()` follows alias parent chains (depth-capped), merges alias overrides, refuses transform-requiring aliases with a warning. - `ui/tests/boot/icon-bundle.spec.ts`: guard test — every `prefix:name` ref in `icons.ts` must exist in the bundle with a body. - `iconoir:stack` → `multiple-pages` (#680 had picked `cube`; `multiple-pages` matches v1.6 and verified valid against locked iconoir 1.2.11). - `@iconify-json/fa6-brands` 1.2.4 → 1.2.6 exact-pinned (devDependencies). - Bundle regenerated: 576/576 refs, zero warnings, 229.8 KB; `npm run build` leaves the tree clean. 4508 UI tests, 100% coverage, full pre-push gate green.  ## Changelog - ✨ Added recursive Iconify alias resolution with parent-chain traversal, override merging, depth limits, and transform warnings. - ✨ Added a guard test for missing or empty icon bundle entries. - 🔧 Replaced `iconoir:cube` with `iconoir:multiple-pages` for the `stack` icon. - 🔧 Pinned `@iconify-json/fa6-brands` to `1.2.6`. - 🐛 Fixed extraction of indirect icon aliases. ## Concerns - Verify aliases with rotation or flipping produce actionable warnings and do not enter the body-only bundle. - Keep the guard test aligned with all supported `icons.ts` reference formats. - Confirm the regenerated bundle contains all 576 references with nonempty bodies.

scttbnsn requested review from ALARGECOMPANY and biggest-littlest as code owners August 9, 2026 00:49

vercel Bot deployed to Preview – drydock-website August 9, 2026 00:51 View deployment

vercel Bot deployed to Preview – drydockdemo-website August 9, 2026 00:51 View deployment

coderabbitai Bot reviewed Aug 9, 2026

View reviewed changes

📦 deps(ui): move @iconify-json/fa6-brands to devDependencies with its…

abdea8a

… siblings

biggest-littlest approved these changes Aug 9, 2026

View reviewed changes

vercel Bot deployed to Preview – drydock-website August 9, 2026 01:29 View deployment

vercel Bot deployed to Preview – drydockdemo-website August 9, 2026 01:29 View deployment

scttbnsn merged commit 97a2f56 into dev/v1.6 Aug 9, 2026
25 checks passed

scttbnsn deleted the fix/v1.6-icon-bundle-alias branch August 9, 2026 01:52

scttbnsn mentioned this pull request Aug 9, 2026

🔧 chore(release): roll release identity forward to v1.6.0-rc.13 #684

Merged

scttbnsn mentioned this pull request Aug 9, 2026

🚀 release: sync dev/v1.6 → main for v1.6.0-rc.13 #685

Merged

scttbnsn mentioned this pull request Aug 9, 2026

🐛 fix(ui): resolve iconify aliases in the icon bundle (forward-port #683) #686

Merged

Navigation Menu

Uh oh!

Uh oh!

🐛 fix(ui): resolve iconify aliases and broken references in the icon bundle - #683

🐛 fix(ui): resolve iconify aliases and broken references in the icon bundle#683
scttbnsn merged 2 commits into
dev/v1.6from
fix/v1.6-icon-bundle-alias

scttbnsn commented Aug 9, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading

Walkthrough

Uh oh!

scttbnsn commented Aug 9, 2026

Uh oh!

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

scttbnsn commented Aug 9, 2026

Uh oh!

biggest-littlest left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

scttbnsn commented Aug 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Fix

Changelog

Concerns

Uh oh!

vercel Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

scttbnsn commented Aug 9, 2026

Uh oh!

coderabbitai Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

scttbnsn commented Aug 9, 2026

Uh oh!

biggest-littlest left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

scttbnsn commented Aug 9, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Aug 9, 2026 •

edited

Loading

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading