[dependabot]

Bumps style-dictionary from 5.7.0 to 5.8.0.

Release notes

Sourced from style-dictionary's releases.

v5.8.0

Minor Changes

• e8f77ed: Expose stripMetaProps, formatJS and isColor utilities through the style-dictionary/utils entrypoint, so that custom formats and transforms can reuse the same helpers as the built-in ones.
• 73acfe2: Add StopTransformError to style-dictionary/utils. A transform can throw it to skip the remaining transforms for that token, which keeps the changes made by the transforms that ran before. It is still reported as a transform error.

Patch Changes

• 52d9d7d: Fix cleaning the copy_assets action on Node.js 25 and later. It removed the assets directory with fs.rmdir() and its recursive option, which Node.js 25 removed, so cleaning threw ERR_INVALID_ARG_VALUE. It now uses fs.rm().
• ce0a390: When a token in source overrides a token from include (or from the inline tokens option), it now replaces that token instead of being merged into it, the same as when two source files or two include files define the same token. Properties that only the overridden token had, such as $extensions or comment, are no longer carried over.
• d87ca0b: Round alpha values that come from 8 or 4 digit hex colors in the color/css transform to the shortest value that maps back to the same hex alpha (two decimals, or three when two do not round-trip), the same as browsers do. For example [#00000014](https://github.com/style-dictionary/style-dictionary/issues/00000014) becomes rgba(0, 0, 0, 0.08) again instead of rgba(0, 0, 0, 0.0784313725490196). Alpha values written as decimals are still kept as they are.
• f82e7aa: BREAKING: the sketch/palette format is registered under its documented name again. Since the enums were introduced in v4.3.0 the format was accidentally registered as sketchPalette, which made format: 'sketch/palette' throw "Can't find format". The formats.sketchPalette enum now resolves to 'sketch/palette', and the accidental 'sketchPalette' string name is no longer accepted. If you used format: 'sketchPalette', switch to format: 'sketch/palette' or use formats.sketchPalette from style-dictionary/enums.
• 5a2e3d2: Include the token path, and the token's filePath when it has one, in the "Token name must be a string" error, so a token with an empty name (e.g. an empty "" key) is easier to find.

v5.7.1

Patch Changes

• c3c37e1: Protect convertTokenData to output 'object' from another prototype pollution vulnerability (GHSA-m4pr-rgwp). In this case, the attack vector was by placing 2 tokens and letting the 2nd descend into the 1st one, and then polluting the object prototype in that descension.

Changelog

Sourced from style-dictionary's changelog.

5.8.0

Minor Changes

• e8f77ed: Expose stripMetaProps, formatJS and isColor utilities through the style-dictionary/utils entrypoint, so that custom formats and transforms can reuse the same helpers as the built-in ones.
• 73acfe2: Add StopTransformError to style-dictionary/utils. A transform can throw it to skip the remaining transforms for that token, which keeps the changes made by the transforms that ran before. It is still reported as a transform error.

Patch Changes

• 52d9d7d: Fix cleaning the copy_assets action on Node.js 25 and later. It removed the assets directory with fs.rmdir() and its recursive option, which Node.js 25 removed, so cleaning threw ERR_INVALID_ARG_VALUE. It now uses fs.rm().
• ce0a390: When a token in source overrides a token from include (or from the inline tokens option), it now replaces that token instead of being merged into it, the same as when two source files or two include files define the same token. Properties that only the overridden token had, such as $extensions or comment, are no longer carried over.
• d87ca0b: Round alpha values that come from 8 or 4 digit hex colors in the color/css transform to the shortest value that maps back to the same hex alpha (two decimals, or three when two do not round-trip), the same as browsers do. For example [#00000014](https://github.com/style-dictionary/style-dictionary/issues/00000014) becomes rgba(0, 0, 0, 0.08) again instead of rgba(0, 0, 0, 0.0784313725490196). Alpha values written as decimals are still kept as they are.
• f82e7aa: BREAKING: the sketch/palette format is registered under its documented name again. Since the enums were introduced in v4.3.0 the format was accidentally registered as sketchPalette, which made format: 'sketch/palette' throw "Can't find format". The formats.sketchPalette enum now resolves to 'sketch/palette', and the accidental 'sketchPalette' string name is no longer accepted. If you used format: 'sketchPalette', switch to format: 'sketch/palette' or use formats.sketchPalette from style-dictionary/enums.
• 5a2e3d2: Include the token path, and the token's filePath when it has one, in the "Token name must be a string" error, so a token with an empty name (e.g. an empty "" key) is easier to find.

5.7.1

Patch Changes

• c3c37e1: Protect convertTokenData to output 'object' from another prototype pollution vulnerability (GHSA-m4pr-rgwp). In this case, the attack vector was by placing 2 tokens and letting the 2nd descend into the 1st one, and then polluting the object prototype in that descension.

Commits

• 795233d chore: release (#1792)
• e8f77ed feat: expose stripMetaProps, formatJS and isColor via style-dictionary/utils ...
• 3815256 docs: correct asset/base64 description and quoting in the base64 example (#1795)
• ce0a390 fix: let a source token override an include token instead of merging into it ...
• 52d9d7d fix: clean copy_assets output with fs.rm() so it works on Node.js 25+ (#1796)
• f82e7aa fix: restore documented sketch/palette format name (#1781)
• d87ca0b fix: round hex alpha in color/css to the shortest value that round-trips (#1782)
• 73acfe2 feat: add StopTransformError to stop transforming a token (#1787)
• 5a2e3d2 fix: include the token path in the "Token name must be a string" error (#1788)
• d126fdf Update README.md (#1778)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)