storm-software / storm-stack

⚡The Storm Stack monorepo contains utility applications, tools, and various libraries to create modern and scalable web applications.
Apache License 2.0
3 stars 0 forks source link

fix(deps): update dependency @tokens-studio/sd-transforms to v1 - autoclosed #92

Closed renovate[bot] closed 1 month ago

renovate[bot] commented 2 months ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@tokens-studio/sd-transforms ^0.14.2 -> ^1.0.0 age adoption passing confidence

Release Notes

tokens-studio/sd-transforms (@​tokens-studio/sd-transforms) ### [`v1.1.0`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#110) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v1.0.1...v1.1.0) ##### Minor Changes - [`c687817`](https://togithub.com/tokens-studio/sd-transforms/commit/c687817): Add the `originalType` property to `$extensions.['studio.tokens']` to store the original Tokens Studio token type, when the type is aligned to DTCG types. LetterSpacing transform is the transform in this package that actually needs to use this, because it doesn't want to match all dimension tokens, but it does want to match letterSpacing tokens. - [`ed10715`](https://togithub.com/tokens-studio/sd-transforms/commit/ed10715): Allow changing the resolve math transform amount of decimals to round for using platform options `mathFractionDigits`, change default value from 3 to 4. ##### Patch Changes - [`c687817`](https://togithub.com/tokens-studio/sd-transforms/commit/c687817): Fix alignTypes to also include `borderWidth`, `letterSpacing`, `paragraphSpacing` and `paragraphIndent` and align them to `dimension`. - [`9c02741`](https://togithub.com/tokens-studio/sd-transforms/commit/9c02741): Fix bug where usesDtcg flag was not passed to resolveReference utility. ### [`v1.0.1`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#101) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v1.0.0...v1.0.1) ##### Patch Changes - [`6c7b2ff`](https://togithub.com/tokens-studio/sd-transforms/commit/6c7b2ff): Fix tsconfig to exclude test files and ensure dist folder structure is correct. ### [`v1.0.0`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#100) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v0.16.1...v1.0.0) ##### Major Changes - [`67edf4b`](https://togithub.com/tokens-studio/sd-transforms/commit/67edf4b): BREAKING: `descriptionToComment` transform no longer removes newlines, just turns carriage returns into newlines. Style Dictionary now handles comments with newlines properly in its createPropertyFormatter utility. - [`67edf4b`](https://togithub.com/tokens-studio/sd-transforms/commit/67edf4b): BREAKING: Remove `expand` option, composite/object-value tokens must be expanded by using [Style Dictionary Expand](https://v4.styledictionary.com/reference/config/#expand). - [`67edf4b`](https://togithub.com/tokens-studio/sd-transforms/commit/67edf4b): BREAKING: remove CommonJS entrypoint and tools/scripts required to dual publish. Now that Style Dictionary v4 is ESM-only, this library will follow suit. - [`67edf4b`](https://togithub.com/tokens-studio/sd-transforms/commit/67edf4b): BREAKING: `transformFontWeights` has been renamed to `transformFontWeight` for consistency. Apply transforms to object-value (composite) token types: - HEXRGBa transform applies to border and shadow colors - Px dimension transform applies to border, typography and shadow dimensions - Letterspacing, lineheights and fontweights transforms apply to these respective typography properties - Resolve math transform applies to all properties of border, typography and shadow tokens This also means that all transforms except for description to comment mapping are now transitive transforms, since the math resolve transform must be transitive and all other transforms must apply after the math one. - [`67edf4b`](https://togithub.com/tokens-studio/sd-transforms/commit/67edf4b): BREAKING: remove CSS shorthand transforms for border, typography and shadow. Use the Style Dictionary transforms instead: https://styledictionary.com/reference/hooks/transforms/predefined/#bordercssshorthand. Note that if you're not disabling the `withSDBuiltins` option, the `tokens-studio` transformGroup will include the ones in the `css` built-in transformGroup, so you might not notice the fact that they are moved. - [`67edf4b`](https://togithub.com/tokens-studio/sd-transforms/commit/67edf4b): - BREAKING: Compatible with Style Dictionary >= v4.0.0. Not compatible with anything below that SD version. - BREAKING: `registerTransforms` function has been renamed to `register`. - BREAKING: `transforms` array has been refactored to `getTransforms()`, which is a function you should call. Optionally pass in the new platform option as parameter `{ platform: 'css' /* or 'compose' */}` - BREAKING: By default, registered `tokens-studio` transformGroup will include the platform's Style Dictionary built-in transforms. E.g. if you're registering for platform `css` it will include the `css` transformGroup transforms from Style Dictionary, appended to the Tokens Studio specific transforms. This behavior can be disabled by passing `{ withSDBuiltins: false }`. - Allow passing platform to the `register()` call: `register(SD, { platform: 'compose' })`. Default value is `'css'`. This means your `tokens-studio` group will be registered for that specific platform. - Allow passing `name` to the `register()` call to configure the transformGroup name: `register(SD, { name: 'tokens-studio-css' })`. Default value is `tokens-studio`. ##### Minor Changes - [`67edf4b`](https://togithub.com/tokens-studio/sd-transforms/commit/67edf4b): Adjust add-font-styles parser to also run on tokens of type fontWeight, to create a sibling token for the fontStyle if it is included in the fontWeight token. - [`67edf4b`](https://togithub.com/tokens-studio/sd-transforms/commit/67edf4b): Add an adjust-types preprocessor utility that aligns the Tokens Studio types / object-value props with the DTCG ones. ### [`v0.16.1`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#0161) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v0.16.0...v0.16.1) ##### Patch Changes - [`3ab8d64`](https://togithub.com/tokens-studio/sd-transforms/commit/3ab8d64): Restructure evaluate math util to support expr eval expressions in combination with regular math. - [`3ab8d64`](https://togithub.com/tokens-studio/sd-transforms/commit/3ab8d64): Allow math expressions where multiple components contain units, as long as they are still computable. ### [`v0.16.0`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#0160) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v0.15.2...v0.16.0) ##### Minor Changes - [`5856621`](https://togithub.com/tokens-studio/sd-transforms/commit/5856621): BREAKING: update to Style Dictionary `v4.0.0-prerelease.27`, set preprocessor name to `'tokens-studio'`, which now has to be applied if you want to exclude parent keys, expand composite types or add font style properties to typography values. ### [`v0.15.2`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#0152) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v0.15.1...v0.15.2) ##### Patch Changes - [`7617f9d`](https://togithub.com/tokens-studio/sd-transforms/commit/7617f9d): Pass colorspace to mix modifier, to use the correct color space to mix in. ### [`v0.15.1`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#0151) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v0.15.0...v0.15.1) ##### Patch Changes - [`000b202`](https://togithub.com/tokens-studio/sd-transforms/commit/000b202): Update to latest style-dictionary pre.22 ### [`v0.15.0`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#0150) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v0.14.4...v0.15.0) ##### Minor Changes - [`09b1fc0`](https://togithub.com/tokens-studio/sd-transforms/commit/09b1fc0): BREAKING: remove options `addAttributeCTI` & `casing`. Since `transformGroup` can now be combined with `transforms`, this is now much easier to accomplish in Style-Dictionary without additional sd-transforms options. Before: ```js registerTransforms(StyleDictionary, { addAttributeCTI: true, casing: 'kebab' }); ``` After: ```json { "platforms": { "css": { "transformGroup": "tokens-studio", "transforms": ["attribute/cti", "name/kebab"] } } } ``` > From this version onwards, Style-Dictionary v4.0.0-prerelease.19 minimum is required. ### [`v0.14.4`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#0144) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v0.14.3...v0.14.4) ##### Patch Changes - [`41d83fa`](https://togithub.com/tokens-studio/sd-transforms/commit/41d83fa): Add "book" to named font weights, converted to 400 ### [`v0.14.3`](https://togithub.com/tokens-studio/sd-transforms/blob/HEAD/CHANGELOG.md#0143) [Compare Source](https://togithub.com/tokens-studio/sd-transforms/compare/v0.14.2...v0.14.3) ##### Patch Changes - [`9351782`](https://togithub.com/tokens-studio/sd-transforms/commit/9351782): Fix expand utility with latest style-dictionary prerelease.16, values would end up undefined due to bad reference resolve.

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.



This PR has been generated by Mend Renovate. View repository job log here.

socket-security[bot] commented 2 months ago

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@opentelemetry/api@1.9.0 None 0 1.22 MB pichlermarc
npm/@tamagui/web@1.101.7 environment +11 3.01 MB nwienert
npm/@types/fs-extra@11.0.4 None +1 42.5 kB types
npm/@types/mdx@2.0.11 None 0 9.71 kB types
npm/@vercel/edge-config@0.4.1 environment, network +1 132 kB vercel-release-bot
npm/@vercel/otel@0.3.0 Transitive: environment, eval, filesystem, network, shell, unsafe +59 24.6 MB vercel-release-bot
npm/esbuild@0.20.0 environment, filesystem, network, shell +23 224 MB evanw

View full report↗︎

socket-security[bot] commented 2 months ago

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
Install scripts npm/esbuild@0.20.0 🚫
Install scripts npm/protobufjs@7.3.2
  • Install script: postinstall
  • Source: node scripts/postinstall
🚫

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/esbuild@0.20.0
  • @SocketSecurity ignore npm/protobufjs@7.3.2