{
  "schemaVersion": 1,
  "type": "resource",
  "id": "lucide",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "local-fixture",
      "source-review"
    ],
    "summary": "Lucide 1.59.0 replaced a known icon, honored size/stroke settings and avoided duplication on a second initialization. An unknown name remained a placeholder. The authored Confirm button retained its name while the decorative SVG stayed hidden.",
    "reportUrl": "/design-evaluations/resource-lucide.json",
    "identity": {
      "target": "lucide",
      "version": "1.59.0",
      "integrity": "sha512-0KTOAFYlTuLHdJOqnRCuPhscU29xtx/QnlHyrOfK0FynDhuPm50O3BH/e4wRnOS67ph0z7uovveCVcXUPLTPBw=="
    },
    "environment": [
      "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.",
      "Synthetic inputs only; no uploads, purchases, accounts or private data.",
      "Pinned extracted assets/modules; browser HTTP(S) and WebSocket requests denied. No install/lifecycle scripts; no process-wide Node egress guarantee."
    ],
    "tests": [
      {
        "name": "Icon replacement and dimensions",
        "mode": "local-fixture",
        "method": "Replace a known Check placeholder with named icon data",
        "result": "pass",
        "observation": "{\"count\":1,\"after\":1,\"viewBox\":\"0 0 24 24\",\"width\":\"32\",\"stroke\":\"1.5\",\"hidden\":\"true\",\"unknownRetained\":true}"
      },
      {
        "name": "Repeat initialization",
        "mode": "local-fixture",
        "method": "Initialize icons a second time and count SVGs",
        "result": "pass",
        "observation": "{\"before\":1,\"after\":1}"
      },
      {
        "name": "Unknown-name boundary",
        "mode": "local-fixture",
        "method": "Include an unavailable icon name",
        "result": "pass",
        "observation": "Unknown icon placeholder remains; this is not a visible fallback or validation error."
      },
      {
        "name": "Decorative icon label boundary",
        "mode": "local-fixture",
        "method": "Inspect authored parent label and propagated hidden attribute",
        "result": "pass",
        "observation": "Authored button label remains Confirm; decorative SVG is hidden. Semantic labeling belongs to the consumer."
      },
      {
        "name": "Framework-specific behavior",
        "mode": "local-fixture",
        "method": "Render icons through framework packages",
        "result": "not-run",
        "observation": "Only the plain JavaScript bundle was used; framework rendering and hydration were not tested."
      }
    ],
    "security": {
      "scope": "Manifest/license and selected entry/source inspection, plus the named synthetic local fixture. No active exploitation or full security audit.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Unknown icon names need an application fallback",
          "detail": "The missing-name fixture retained its original placeholder. Validate icon identifiers and provide a readable fallback rather than assuming every requested name will render."
        },
        {
          "level": "caution",
          "basis": "observed",
          "title": "Control semantics come from the wrapper",
          "detail": "The fixture supplied the button element, Confirm label and decorative hidden attribute. The passing label check covers that composition, not every use of Lucide."
        },
        {
          "level": "caution",
          "basis": "documented",
          "title": "Keep the complete notice file",
          "detail": "The upstream license combines ISC terms with MIT notices for identified Feather-derived icons. Retain the complete applicable notices with redistributed assets."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Pinned sample and network boundary",
          "detail": "The fetched archive matched its registry SHA-512. The selected fixture made zero outbound attempts under an HTTP/WebSocket deny rule. No package lifecycle scripts executed; this does not audit all package code or dependencies."
        }
      ],
      "limits": [
        "No React/Vue package runtime, whole-catalog SVG inspection, screen-reader session, contrast audit or bundle-size measurement.",
        "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification."
      ]
    },
    "practicalCaveats": [
      "Map product actions to a small approved icon set and keep essential labels visible.",
      "Review stroke weight, contrast, target size and meaning at the actual display size."
    ],
    "limits": [
      "One named Check icon, one unknown name and the plain JavaScript initialization API.",
      "No React/Vue package runtime, whole-catalog SVG inspection, screen-reader session, contrast audit or bundle-size measurement."
    ],
    "sources": [
      {
        "label": "Lucide guide",
        "url": "https://lucide.dev/guide/"
      },
      {
        "label": "Accessibility guidance",
        "url": "https://lucide.dev/how-to/accessibility"
      },
      {
        "label": "Full license including Feather notices",
        "url": "https://github.com/lucide-icons/lucide/blob/main/LICENSE"
      },
      {
        "label": "Dated repository snapshot source",
        "url": "https://github.com/lucide-icons/lucide"
      },
      {
        "label": "Exact evaluated package archive",
        "url": "https://registry.npmjs.org/lucide/-/lucide-1.59.0.tgz"
      }
    ]
  }
}