chore(deps): update dependency style-dictionary to v5.4.4 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
style-dictionary (source)	5.0.1 → 5.4.4

---

Style Dictionary - Prototype Pollution in convertTokenData utility function

CVE-2026-54639 / GHSA-vj5c-m527-mpff

More information

Details

Impact

Prototype pollution.
A malicious user can create a token array [{ key: '{__proto__.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key: '{__proto__.foo}', value: 'malicious' }.

This has been confirmed with a test/reproduction.

You are impacted when:

• direct usage of convertTokenData(tokens, { output: 'object' });
• indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it necessary to run expand (this means, if NOT: 1) set to false, 2) all subprops set to false, or 3) undefined), then we sync the sd.tokens property with the sd.tokenMap property by converting tokenData map back to object.
• indirect usage via SD's transform lifecycle. Once your tokens are transformed, we also have to sync the sd.tokens property with the sd.tokenMap property.

Impact is high for this when style-dictionary is used as an integration in a NodeJS server application.
Impact is moderate for when style-dictionary is used as an integration in a Web application.
Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used.

Patches

A patch has been published: version 5.4.4.
Any version within range >=4.3.0 <5.4.4 contains this vulnerability, see commit hash 209085d for when the vulnerability was added.

See PR with repro + fix https://github.com/style-dictionary/style-dictionary/pull/1702

Workarounds

A workaround is to sanitize your token data first. Whether using DTCG format or old Style Dictionary format, you have to check the token data object recursively for any object keys that include __proto__.

You can do this with the StyleDictionary instance too, just ensure that expand has to be set to false to prevent the second method of this vulnerability from happening.

const sd = new StyleDictionary({ expand: false });

if (sd.allTokens.some(tok => tok.key.includes('__proto__')) {
  throw new Error('Found malicious token key, attempting to do prototype pollution.')
}

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

• https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff
• https://nvd.nist.gov/vuln/detail/CVE-2026-54639
• https://github.com/style-dictionary/style-dictionary/pull/1702
• https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec
• https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5
• https://github.com/style-dictionary/style-dictionary/releases/tag/v5.4.4
• https://github.com/advisories/GHSA-vj5c-m527-mpff

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

style-dictionary/style-dictionary (style-dictionary)

v5.4.4

Compare Source

Patch Changes

• 23b5e8d: Fix prototype pollution vulnerability in the convertTokenData utility function, this was introduced in version 4.3.0.
  Any token key that includes __proto__ will be ignored.
  See Security Advisory GHSA-vj5c-m527-mpff.

v5.4.3

Compare Source

Patch Changes

• 371dbcb: Get proper deepmerge types in, fix small potential bug for StyleDictionary.extend(), flagged by type safety improvement.

v5.4.2

Compare Source

Patch Changes

• 60d16e1: Fix sizeRem and sizePxToRem transform to keep the 0-valued tokens type number/string intact in the result (regression 5.4.0)

v5.4.1

Compare Source

Patch Changes

• 46ec860: Fix size/rem transform stripping the unit from zero-magnitude dimension values (e.g. "0em"), which caused downstream CSS variables to serialize as undefined. Unit preservation now runs before the unitless-zero short-circuit.

v5.4.0

Compare Source

Minor Changes

• edceda7: Add support for DTCG v2025.10 dimension token type object value, while remaining backwards compatible for dimension tokens using string values.

  All built-in transforms can now handle dimension tokens.

  This includes CSS shorthand transforms for composed token types such as typography, border and shadows, which can contain properties that are dimensions.

  {
    "spacing": {
      "$type": "dimension",
      "$value": { "value": 1, "unit": "px" }
    },
    "shadow": {
      "$type": "shadow",
      "$value": {
        "color": { "colorSpace": "srgb", "components": [0, 0, 0], "alpha": 0.4 },
        "offsetX": { "value": 2, "unit": "px" },
        "offsetY": { "value": 2, "unit": "px" },
        "blur": { "value": 4, "unit": "px" },
        "spread": { "value": 6, "unit": "px" }
      }
    }
  }

• 3d5c140: Generate strict types (tuples) for the tokens of the same type

Patch Changes

• edceda7: Fix very old bug where size/remToPt wasn't converting to pt unit, but rather to f (iOS float). Fixed this, added size/remToFloat to use the old behavior, and updated the ios transformGroup to use this instead. This is technically potentially "breaking" but because it is a bugfix, this is a patch.

v5.3.3

Compare Source

Patch Changes

• 52817e1: Fix vulnerability in bundled version of glob -> minimatch.

v5.3.2

Compare Source

Patch Changes

• a7986d2: Support DTCG inset boolean property in shadow/css/shorthand transform, in addition to the existing type: "inset" format.
  Don't put invalid inset values in shadow/css/shorthand box-shadow values, they are ignored now. E.g. if you put type: "innerShadow" or some other unrecognized string.

v5.3.1

Compare Source

Patch Changes

• 9f51f0d: Fix shadow and border CSS shorthands to also support latest DTCG color module. Add platform options to configure how the shorthand transforms stringify the color property.

v5.3.0

Compare Source

Minor Changes

• b5adbc0: Add support for DTCG v2025.10 structured color format in color transformers.

  New features:

  • All color transformers now support both legacy string format and DTCG object format with colorSpace, components, alpha, and optional hex fallback properties
  • Support for all 14 DTCG color spaces: srgb, srgb-linear, display-p3, a98-rgb, prophoto-rgb, rec2020, xyz-d50, xyz-d65, lab, lch, oklab, oklch, hsl, hwb
  • New color/oklch transformer - outputs modern CSS oklch() function
  • New color/oklab transformer - outputs modern CSS oklab() function
  • New color/p3 transformer - outputs CSS color(display-p3 ...) function
  • New color/lch transformer - outputs modern CSS lch() function

  Types:

  • Added DTCGColorSpace and DTCGColorValue TypeScript types

  Hex fallback support:
  When a DTCG color object includes a hex property, it will be used as a fallback when the color is out-of-gamut for sRGB, allowing designers to provide pre-computed sRGB approximations.

Patch Changes

• 1187f60: Update vulnerable transitive lodash dependency inside @​bundled-es-modules/glob

v5.2.0

Compare Source

Minor Changes

• 752a50c: Add (wip) sort option to formattedVariables and formats css, scss, less, stylus. See format docs on how to use it.

Patch Changes

• 6e9164e: Small bugfix where formatting.commentStyle was not taken into account for fileHeader comments when possible.

v5.1.4

Compare Source

Patch Changes

• a9c11a2: Fix of a regression bug caused by sizeRem transform throwing an error for NaN values. Because a string was thrown instead of an Error, this wasn't handled correctly by the transforms wrapper utility. Now we handle this scenario, and we also changed it to throw an actual Error.

v5.1.3

Compare Source

Patch Changes

• 6e306bc: Upgrade glob@​11.1.0 forked package to fix vulnerability in origin package.

v5.1.1

Compare Source

Patch Changes

• 65745da: Fix outputReferences for tokens with 'value' in their name. Previously, references to tokens like object_type.value_chain were incorrectly resolved because the code removed the first occurrence of .value instead of only the trailing suffix.

v5.1.0

Compare Source

Minor Changes

• 97a209a: Add new size/compose/{sp,dp} transforms

Patch Changes

• dbcdae3: Fix fontName parsing to handle double quotes
• c47600d: Export expand DTCGTypesMap for extension use cases.

v5.0.4

Compare Source

Patch Changes

• 7a238af: Fix an issue with token collisions being way to eager about complaining when values that are identical are "colliding". This cuts collision warnings by 75% or more.

v5.0.3

Compare Source

Patch Changes

• 3d070f5: Move patch-package to devDependencies and run in prepare instead of postinstall, so it only runs when npm installing locally and not for consumers.
• 71614da: Wrap structuredClone in loadFile in a try catch, in case we have a JS/TS config file with dynamic content.

v5.0.2

Compare Source

Patch Changes

• 8e413a2: Fix vulnerable dependencies, patch-package and its transitive tmp dependency in particular.
• 9f84a81: Remove node-sass from create-react-app example, dart-sass is used now usually.
• da19c8f: Small patch to allow no-destination "files" to not cause errors when using clean methods.

---

Configuration

📅 Schedule: (in timezone Europe/Prague)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.