Bump the npm-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the npm-minor-patch group with 3 updates in the /packages/tokens directory: color, markdownlint-cli and style-dictionary.

Updates color from 5.0.0 to 5.0.3

Release notes

Sourced from color's releases.

5.0.3

Full Changelog: Qix-/color@5.0.2...5.0.3

5.0.2

Functionally identical release to 5.0.0.

Version 5.0.1 is compromised. Please see debug-js/debug#1005.

Commits

• 4fda9a3 5.0.3
• e41fa22 update color dependencies
• 02a615f 5.0.2
• See full diff in compare view

Updates markdownlint-cli from 0.48.0 to 0.49.1

Release notes

Sourced from markdownlint-cli's releases.

v0.49.1

• Update markdownlint dependency to 0.41.1
  • Improve MD029
  • Fix module resolution under webpack
  • Update dependencies
• Update all dependencies via Dependabot

v0.49.0

• Update markdownlint dependency to 0.41.0
  • Improve MD022/MD028/MD035/MD042/MD051/MD060
  • Remove handling of inline directive syntax (frequent false positives)
  • Remove support for end-of-life Node version 20
• Update all dependencies via Dependabot

Commits

• 5b5dddc Bump version 0.49.1
• 4e83bdd Bump run-con from 1.3.2 to 1.3.3
• 4f2127b Bump actions/setup-node from 6 to 7
• cc62492 Manually address new violations reported by xo.
• 678b7ee Bump xo from 3.0.2 to 4.0.0
• 06602e9 Bump ignore from 7.0.5 to 7.0.6
• eac32dd Bump markdownlint from 0.41.0 to 0.41.1
• 2864eb0 Bump js-yaml from 5.2.0 to 5.2.1
• 2748661 Bump markdown-it from 14.2.0 to 14.3.0
• 0144ebe Manually address new violations reported by xo.
• Additional commits viewable in compare view

Updates style-dictionary from 5.0.4 to 5.5.1

Release notes

Sourced from style-dictionary's releases.

v5.5.1

Patch Changes

• ef1dbc8: Add better prototype pollution mitigation for convertTokenData utility. See GitHub Advisory GHSA-xmr7-549p-98w3

v5.5.0

Minor Changes

• b63dc05: Add emitEmptyFiles option to write output files even when no tokens match the file's filter, instead of skipping them.

Patch Changes

• e319976: Fix regression to gracefully handle unparseable dimension tokens which is required to support custom dimension tokens from third party vendors like Tokens Studio.

v5.4.4

Patch Changes

• 23b5e8d: Fix prototype pollution vulnerability in the convertTokenData utility function, this was introduced in version 4.3.0. Any token key that includes __proto__ will be ignored. See Security Advisory GHSA-vj5c-m527-mpff.

v5.4.3

Patch Changes

• 371dbcb: Get proper deepmerge types in, fix small potential bug for StyleDictionary.extend(), flagged by type safety improvement.

v5.4.2

Patch Changes

• 60d16e1: Fix sizeRem and sizePxToRem transform to keep the 0-valued tokens type number/string intact in the result (regression 5.4.0)

v5.4.1

Patch Changes

• 46ec860: Fix size/rem transform stripping the unit from zero-magnitude dimension values (e.g. "0em"), which caused downstream CSS variables to serialize as undefined. Unit preservation now runs before the unitless-zero short-circuit.

v5.4.0

Minor Changes

• edceda7: Add support for DTCG v2025.10 dimension token type object value, while remaining backwards compatible for dimension tokens using string values.

  All built-in transforms can now handle dimension tokens.

  This includes CSS shorthand transforms for composed token types such as typography, border and shadows, which can contain properties that are dimensions.

  {
    "spacing": {
      "$type": "dimension",

... (truncated)

Changelog

Sourced from style-dictionary's changelog.

5.5.1

Patch Changes

• ef1dbc8: Add better prototype pollution mitigation for convertTokenData utility. See GitHub Advisory GHSA-xmr7-549p-98w3

5.5.0

Minor Changes

• b63dc05: Add emitEmptyFiles option to write output files even when no tokens match the file's filter, instead of skipping them.

Patch Changes

• e319976: Fix regression to gracefully handle unparseable dimension tokens which is required to support custom dimension tokens from third party vendors like Tokens Studio.

5.4.4

Patch Changes

• 23b5e8d: Fix prototype pollution vulnerability in the convertTokenData utility function, this was introduced in version 4.3.0. Any token key that includes __proto__ will be ignored. See Security Advisory GHSA-vj5c-m527-mpff.

5.4.3

Patch Changes

• 371dbcb: Get proper deepmerge types in, fix small potential bug for StyleDictionary.extend(), flagged by type safety improvement.

5.4.2

Patch Changes

• 60d16e1: Fix sizeRem and sizePxToRem transform to keep the 0-valued tokens type number/string intact in the result (regression 5.4.0)

5.4.1

Patch Changes

• 46ec860: Fix size/rem transform stripping the unit from zero-magnitude dimension values (e.g. "0em"), which caused downstream CSS variables to serialize as undefined. Unit preservation now runs before the unitless-zero short-circuit.

5.4.0

Minor Changes

• edceda7: Add support for DTCG v2025.10 dimension token type object value, while remaining backwards compatible for dimension tokens using string values.

  All built-in transforms can now handle dimension tokens.

... (truncated)

Commits

• 2b03351 chore: release (#1732)
• ef1dbc8 fix: prototype pollution convertTokenData using Object.create(null) (#1731)
• 3c430c0 docs: generate enum reference from sources (#1724)
• 9a9cca0 chore: release (#1712)
• fafbc7d chore: fix vulnerable dev deps (#1711)
• b63dc05 feat: add emitEmptyFiles option to write files even when no tokens match (#1700)
• e319976 fix: gracefully handle unparseable dimension token values (#1710)
• 1c90088 chore: release (#1703)
• 23b5e8d fix: prototype pollution in convertTokenData utility GHSA-vj5c-m527-mpff (#1702)
• 5345c8c chore: release (#1698)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for style-dictionary since your current version.