islamic-icons 1.1.7 → 2.0.0

package/README.md

@@ -14,6 +14,8 @@ pnpm add islamic-icons
 
 **Requirements:** Node.js >= 18, React 16.8+ (web); for React Native / Expo, also install `react-native-svg` and use the `/native` entry (see below).
 
+Security and supply-chain: this package has **no production dependencies**; only peer deps (React, react-native-svg). For Socket.dev and similar alerts, see [SECURITY.md](SECURITY.md).
+
 | Environment        | Import from              |
 |--------------------|--------------------------|
 | Web (React DOM)    | `'islamic-icons'`        |
@@ -84,7 +86,7 @@ When neither `aria-label` nor `title` is set, icons get `aria-hidden="true"` so
 - **Direction** – Qibla  
 - **Phrases** – Bismillah, Alhamdulillah, etc. (as SVGs)
 
-More icons are added over time. Run the demo or Storybook to see what’s available.
+More icons are added over time. Run the documentation site (`npm run docs`, then open http://localhost:5174), the demo, or Storybook to see what’s available.
 
 ## React Native / Expo
 

package/SECURITY.md

@@ -0,0 +1,43 @@
+# Security & Socket.dev Alerts
+
+## Published package surface
+
+**`islamic-icons` has zero production dependencies.** When users install the package, they only receive:
+
+- Built icon components in `dist/web` and `dist/native`
+- Peer dependencies: `react`, `react-dom` (optional), `react-native-svg` (optional)
+
+So **none of the Socket alerts affect the code that runs in your app** when you use this library. The alerts come from the **development and build dependency tree** (Vite, Storybook, Babel, ESLint, jimp, sharp, SVGO, etc.), which is not published to npm.
+
+## Why Socket shows so many alerts
+
+Socket (and similar tools) analyze the **entire dependency tree** of the repository, including **devDependencies**. In this project, that includes:
+
+- **Build/tooling**: Vite, Babel, TypeScript, vite-plugin-dts, Storybook
+- **Image/icon tooling**: jimp, potrace, sharp, SVGO (used for scripts like `generate:icons`, `optimize:svgs`, `png-to-svg`)
+
+Those tools commonly trigger alerts such as:
+
+| Alert | Why it appears |
+|-------|----------------|
+| **Uses eval** | Bundlers and transpilers (e.g. Babel, Vite) use `eval` or dynamic code execution. |
+| **Shell access** | Build scripts and dev tools (e.g. Storybook, Vite) run shell commands. |
+| **Network access** | Dev server, hot reload, and some plugins use the network. |
+| **Filesystem access** | Build and file-watching tools read/write files. |
+| **Environment variable access** | Config and env loading (e.g. `NODE_ENV`, `.env`). |
+| **Obfuscated / minified code** | Some dependencies ship minified or bundled code. |
+| **Deprecated / Unmaintained** | Transitive devDependencies that are old or deprecated. |
+| **URL strings** | In this repo: standard SVG `xmlns="http://www.w3.org/2000/svg"` and lockfile registry URLs; no runtime URL fetching in published code. |
+
+So the alerts are expected for a project that uses modern JS tooling and do **not** indicate malicious behavior in the published package.
+
+## Known CVEs (devDependencies only)
+
+`npm audit` may report vulnerabilities in **devDependencies** (e.g. jimp → file-type/phin, vite-plugin-dts → minimatch, vue-template-compiler). These do **not** run in production for consumers of `islamic-icons`. To reduce dev risk:
+
+1. Run `npm audit` and apply safe fixes: `npm audit fix`.
+2. For remaining issues, consider upgrading or replacing dev-only packages when convenient (e.g. upgrading `jimp` or `vite-plugin-dts` when compatible).
+
+## Reporting security issues
+
+If you find a security issue in the **published** code (e.g. in `dist/` or in how the library is consumed), please report it responsibly (e.g. via the repository’s issue tracker or a private channel if the project provides one).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "islamic-icons",
-  "version": "1.1.7",
+  "version": "2.0.0",
   "description": "Tree-shakeable React component library of Islamic SVG icons",
   "type": "module",
   "main": "./dist/web/index.cjs",
@@ -31,7 +31,8 @@
     "dist/native",
     "README.md",
     "MIGRATION.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "sideEffects": false,
   "engines": {
@@ -56,6 +57,11 @@
     "png-to-svg": "node scripts/png-to-svg.mjs",
     "storybook": "storybook dev -p 6006",
     "build-storybook": "storybook build",
+    "docs": "node scripts/generate-docs-manifest.mjs && cd docs && npm run dev",
+    "docs:build": "node scripts/generate-docs-manifest.mjs && cd docs && npm run build",
+    "docs:copy-to-alkarartech": "node scripts/copy-docs-to-alkarartech.mjs",
+    "docs:deploy-local": "npm run docs:build && npm run docs:copy-to-alkarartech",
+    "generate:docs-manifest": "node scripts/generate-docs-manifest.mjs",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src --ext .ts,.tsx"
   },
@@ -117,5 +123,8 @@
   "repository": {
     "type": "git",
     "url": ""
+  },
+  "overrides": {
+    "minimatch": "^9.0.5"
   }
 }