Wrong: pasting raw SVG into a node body via Source mode → Right: enable CKEditor 5 icon button + filter; use <drupal-icon>
Wrong: treating SVG content as fully trusted → Right: only ship SVG you authored or vetted — SVG can carry <script>; UI Icons does not sanitize automatically
Wrong: hardcoding icon paths in Twig templates → Right: render through pack templates so settings, cache metadata, and a11y templating apply
Wrong: pack IDs without theme/module prefix → Right: prefix to avoid collisions with other packs
Wrong: changing icon files but expecting Drupal to detect the change → Right: clear cache; YamlDiscovery and extractor results are cached
Wrong: missing decorative / ariaLabel settings → Right: declare them so editors can comply with WCAG
Wrong: relying on dompdf/php-font-lib without requiring it in Composer → Right: install the library, or ship a .codepoints/.json metadata file alongside the font
Wrong: enabling all submodules without a plan → Right: enable only the integrations the site uses; each adds form alters, routes, and schema