chore(deps): bump style-dictionary from 3.9.2 to 5.5.0

[dependabot]

Bumps style-dictionary from 3.9.2 to 5.5.0.

Release notes

Sourced from style-dictionary's releases.

v5.5.0

Minor Changes

• b63dc05: Add emitEmptyFiles option to write output files even when no tokens match the file's filter, instead of skipping them.

Patch Changes

• e319976: Fix regression to gracefully handle unparseable dimension tokens which is required to support custom dimension tokens from third party vendors like Tokens Studio.

v5.4.4

Patch Changes

• 23b5e8d: Fix prototype pollution vulnerability in the convertTokenData utility function, this was introduced in version 4.3.0. Any token key that includes __proto__ will be ignored. See Security Advisory GHSA-vj5c-m527-mpff.

v5.4.3

Patch Changes

• 371dbcb: Get proper deepmerge types in, fix small potential bug for StyleDictionary.extend(), flagged by type safety improvement.

v5.4.2

Patch Changes

• 60d16e1: Fix sizeRem and sizePxToRem transform to keep the 0-valued tokens type number/string intact in the result (regression 5.4.0)

v5.4.1

Patch Changes

• 46ec860: Fix size/rem transform stripping the unit from zero-magnitude dimension values (e.g. "0em"), which caused downstream CSS variables to serialize as undefined. Unit preservation now runs before the unitless-zero short-circuit.

v5.4.0

Minor Changes

• edceda7: Add support for DTCG v2025.10 dimension token type object value, while remaining backwards compatible for dimension tokens using string values.

  All built-in transforms can now handle dimension tokens.

  This includes CSS shorthand transforms for composed token types such as typography, border and shadows, which can contain properties that are dimensions.

  {
    "spacing": {
      "$type": "dimension",
      "$value": { "value": 1, "unit": "px" }
    },
    "shadow": {
      "$type": "shadow",
      "$value": {
        "color": { "colorSpace": "srgb", "components": [0, 0, 0], "alpha": 0.4 },

... (truncated)

Changelog

Sourced from style-dictionary's changelog.

5.5.0

Minor Changes

• b63dc05: Add emitEmptyFiles option to write output files even when no tokens match the file's filter, instead of skipping them.

Patch Changes

• e319976: Fix regression to gracefully handle unparseable dimension tokens which is required to support custom dimension tokens from third party vendors like Tokens Studio.

5.4.4

Patch Changes

• 23b5e8d: Fix prototype pollution vulnerability in the convertTokenData utility function, this was introduced in version 4.3.0. Any token key that includes __proto__ will be ignored. See Security Advisory GHSA-vj5c-m527-mpff.

5.4.3

Patch Changes

• 371dbcb: Get proper deepmerge types in, fix small potential bug for StyleDictionary.extend(), flagged by type safety improvement.

5.4.2

Patch Changes

• 60d16e1: Fix sizeRem and sizePxToRem transform to keep the 0-valued tokens type number/string intact in the result (regression 5.4.0)

5.4.1

Patch Changes

• 46ec860: Fix size/rem transform stripping the unit from zero-magnitude dimension values (e.g. "0em"), which caused downstream CSS variables to serialize as undefined. Unit preservation now runs before the unitless-zero short-circuit.

5.4.0

Minor Changes

• edceda7: Add support for DTCG v2025.10 dimension token type object value, while remaining backwards compatible for dimension tokens using string values.

  All built-in transforms can now handle dimension tokens.

  This includes CSS shorthand transforms for composed token types such as typography, border and shadows, which can contain properties that are dimensions.

  {
    "spacing": {
      "$type": "dimension",

... (truncated)

Commits

• 9a9cca0 chore: release (#1712)
• fafbc7d chore: fix vulnerable dev deps (#1711)
• b63dc05 feat: add emitEmptyFiles option to write files even when no tokens match (#1700)
• e319976 fix: gracefully handle unparseable dimension token values (#1710)
• 1c90088 chore: release (#1703)
• 23b5e8d fix: prototype pollution in convertTokenData utility GHSA-vj5c-m527-mpff (#1702)
• 5345c8c chore: release (#1698)
• 371dbcb fix: deepmerge types + tiny extend() bugfix (#1697)
• 508087d chore: fix vulnerable dev deps (#1696)
• 437fdc3 chore: release (#1695)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for style-dictionary since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	style-dictionary@​5.5.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @zip.js/zip.js is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/style-dictionary@5.5.0 → npm/@zip.js/zip.js@2.8.26 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zip.js/zip.js@2.8.26. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report