Severity: medium · Type: tech-debt · Confidence: high
Location:scripts/patch-folds.mjs:11-30
Problem
The patch-folds.mjs script (runs on npm install) patches node_modules/folds by searching for a literal string 'children: src(filled)' and replacing it with a type guard. If the folds package updates and changes the Icon implementation, the string won't be found and the build will fail (hard exit 1). There is no fallback or graceful degradation.
How to trigger
Upgrading folds to a version that refactors the Icon component or splits the implementation differently will break all npm install runs.
Suggested fix
Add more context to the search string (e.g., include surrounding lines) to reduce sensitivity to whitespace/formatting changes. Alternatively, consider using patch-package (already mentioned in LOTUS_TODO.md line 178) if the folds team accepts the change upstream, or use a different Icon source guard implementation that doesn't require patching.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** medium · **Type:** tech-debt · **Confidence:** high
**Location:** `scripts/patch-folds.mjs:11-30`
### Problem
The `patch-folds.mjs` script (runs on `npm install`) patches `node_modules/folds` by searching for a literal string `'children: src(filled)'` and replacing it with a type guard. If the folds package updates and changes the Icon implementation, the string won't be found and the build will fail (hard exit 1). There is no fallback or graceful degradation.
### How to trigger
Upgrading folds to a version that refactors the Icon component or splits the implementation differently will break all `npm install` runs.
### Suggested fix
Add more context to the search string (e.g., include surrounding lines) to reduce sensitivity to whitespace/formatting changes. Alternatively, consider using `patch-package` (already mentioned in LOTUS_TODO.md line 178) if the folds team accepts the change upstream, or use a different Icon source guard implementation that doesn't require patching.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:17 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium · Type: tech-debt · Confidence: high
Location:
scripts/patch-folds.mjs:11-30Problem
The
patch-folds.mjsscript (runs onnpm install) patchesnode_modules/foldsby searching for a literal string'children: src(filled)'and replacing it with a type guard. If the folds package updates and changes the Icon implementation, the string won't be found and the build will fail (hard exit 1). There is no fallback or graceful degradation.How to trigger
Upgrading folds to a version that refactors the Icon component or splits the implementation differently will break all
npm installruns.Suggested fix
Add more context to the search string (e.g., include surrounding lines) to reduce sensitivity to whitespace/formatting changes. Alternatively, consider using
patch-package(already mentioned in LOTUS_TODO.md line 178) if the folds team accepts the change upstream, or use a different Icon source guard implementation that doesn't require patching.Filed from the September 2026 client audit (branch
lotus@4bea4895).