Repository navigation
chore(release): v1.5.1 - #398
Merged
Merged
Conversation
chore: merge main into develop after v1.5.0
Only `pp-dev generate-icon-font` uses svgtofont, but as a dependency it gave every project that installs pp-dev glob 10/11 (GHSA-3g3m-2fjr-6pw4) and minimatch 9/10 (GHSA-g3hv-75wg-m249) through svgicons2svgfont and ttf2woff2 -> node-gyp -> cacache. The root `overrides` hide that in this repo only: npm applies overrides of the root project, not of a dependency. No svgtofont, svgicons2svgfont or cacache release asks for a fixed glob. svgtofont moves to `peerDependencies` (optional) and `devDependencies`. The command says what to install when the package is missing, and the README lists the `overrides` for a project that does install it. The test fixtures no longer need their glob/minimatch overrides.
fix(deps): make svgtofont an optional peer dependency
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the change making icon-font generation an opt-in dependency.
No open issues 🎉
2 files not reviewed
tests/test-commonjs/package-lock.json: Generated filetests/test-nextjs/package-lock.json: Generated file
What changed in this PR
Prepares v1.5.1 of the Portal Pages development tool by making icon-font generation an opt-in dependency, keeping its vulnerable transitive dependencies out of default installations.
Changes:
- 🔐 Moves
svgtofontto an optional peer dependency and removes obsolete fixture overrides. - 🔧 Adds actionable installation guidance when icon-font generation requires the missing package.
- 🧪 Adds loader tests and updates documentation, release notes, and package metadata.
| File | Description |
|---|---|
tests/unit/lib/icon-font-generator.spec.ts |
Tests successful loading, missing-package guidance, and unrelated error propagation. |
tests/test-nextjs/package.json |
Removes glob and minimatch overrides. |
tests/test-nextjs-cjs/package.json |
Removes glob and minimatch overrides. |
tests/test-commonjs/package.json |
Removes glob and minimatch overrides. |
tests/test-commonjs/package-lock.json |
Refreshes the local package dependency tree without svgtofont. |
src/lib/icon-font-generator.ts |
Adds lazy loading with a dedicated missing-dependency error. |
src/cli/commands/generate-icon-font.ts |
Reports installation instructions and exits when the dependency is absent. |
README.md |
Documents opt-in installation and dependency overrides. |
package.json |
Sets v1.5.1 and makes svgtofont an optional peer and development dependency. |
package-lock.json |
Synchronizes release metadata and dependency classifications. |
CLAUDE.md |
Documents the optional-peer dependency convention. |
CHANGELOG.md |
Adds v1.5.1 release notes and migration guidance. |
Review effort: Balanced
sergak01
approved these changes
Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases v1.5.1 (a patch release after v1.5.0), cut from
develop.Before merging
CHANGELOG.md. It becomes the GitHub release notes.package.json,package-lock.jsonand theCHANGELOG.mdheading.Merging publishes
v1.5.1to npm underlatest, creates the tag and the GitHub release, and opens the back-merge intodevelop.Release notes source:
ai (OpenRouter, anthropic/claude-opus-5.5).Release notes
Bug fixes
pp-devno longer pulls in theglobandminimatchversions thatnpm auditreports as moderate vulnerabilities. They only came in throughsvgtofont, which is now an optional dependency.Other changes
svgtofontis no longer installed withpp-dev. If you usepp-dev generate-icon-font, add it to the project withnpm install --save-dev svgtofont; without it the command exits with a message saying what to install.