[dgesteves]

Fixes the open CodeQL alerts in the token readers, the token export and the site's docs links. Each regex matches the same strings as before, with the same capture groups. The only difference is that a failing input now has one way to match, not thousands.

Alerts

The numbers are code scanning alert numbers (Security > Code scanning), not issues or pull requests.

ReDoS. Times are for the attack input, before and after. Before means the old regex alone, measured at 10,000 characters where 100,000 did not finish; the growth is quadratic.

• fix: suggest equivalent props both ways, and imports relative to the checked file #30 js/polynomial-redos in src/tokens/units.ts: LENGTH is now /^(-?(?:\d+(?:\.\d*)?|\.\d+))(px|rem|em)?$/i, so a run of digits can only be split one way. lengthToPx on 9 x 100,000 + x: 25 s before, 0.6 ms after. End to end, check on <div className="p-[99…9x]" /> (the path from user code, the MCP tool and the Action): 1.1 s at 20,000 digits before, 5 ms after; 6 ms at 100,000 digits.
• fix: accurate get_component contracts for React Aria Components #31 js/polynomial-redos in src/tokens/units.ts: var() is read by the scanner described under chore: release #41, so the \s* before the fallback that overlapped [^)]+ is gone. var(---, + spaces + x: 142 ms at 10,000 before; 0.9 ms at 100,000 after. 20,000 nested var(--missing, fallbacks (280,000 characters) take 18 ms: the existing depth limit of 16 bounds how often a fallback is read again.
• chore: release #41 js/polynomial-redos in src/tokens/units.ts, which the first version of the fix: accurate get_component contracts for React Aria Components #31 fix raised: expandVars no longer uses a regex. It scans each var() to its matching parenthesis, so a fallback may hold calc() or another var(), and a var() that is never closed ends the scan, so no later var( is scanned to the end again. var(---, + var(---,( x 20,000: 7.4 s with a [^)]+ or ,\s*([^)]+) fallback, 0.5 ms now. A differential fuzz against a CSS-correct reference (300,009 generated expressions) finds no value it gets wrong, none main got right that it loses, 54,619 it now reads that main did not (calc(2 * var(--gap, var(--space-2)))), and 9,705 that main read wrong and it now reads right (calc(var(--gap, var(--space-2)) + 1px) was missing the + 1px). The changeset says so.
• feat(site): add social cards, sitemap, robots and llms.txt #26, fix: never throw on deeply nested code #27, chore: release #28, fix: check render props and style functions #29 js/polynomial-redos in src/tokens/color.ts: BARE_HSL and BARE_RGB read each number as \d+(?:\.\d+)?|\.\d+ rather than \d*\.?\d+. isBareHsl/parseColor on 9 x n: 141 ms at 10,000 before; 0.4 ms at 100,000 after. isBareRgb on 9 9 9/ + 9s + !: 235 ms at 10,000 before; 0.6 ms at 100,000 after.
• feat: find a flat src/ of components with zero config #32 js/polynomial-redos in src/tokens/export.ts: PLAIN_LENGTH gets the same change as LENGTH.
• docs: add setup for GitHub Copilot CLI, Windsurf, JetBrains IDEs and Grok Build #34, ci: don't deploy Dependabot and release branches to Vercel #35, docs: show the hero image instead of the demo video on npm #37 js/polynomial-redos in src/tokens/export.ts: NUMBER is now /^-?(?:\d+(?:\.\d*)?|\.\d+)$/. On 10,000 digits it went from 144 ms to 0.07 ms.
• docs: replace the README hero with a demo video #36, chore: release the refreshed README to npm #38, chore: release #39 js/polynomial-redos in src/tokens/export.ts: DESIGN_DIMENSION gets the same change.
• ci: publish to the MCP Registry once npm serves the version, and catch up on the next push #33 js/polynomial-redos and feat(site): add the rules catalog and the docs #25 js/redos in src/tokens/export.ts: COMPOSITE drops the \s* after each :, which overlapped the [^;]+ after it. \s is a subset of [^;], and the regex is only used with test(). -: + 100,000 spaces + ;!: 21.7 s before, 0.5 ms after. The exponential case, -::;-: + :;-: x 24 (126 characters), took 3.6 s in a real export before and under 1 ms after.

The export test's ten 100,000-character tokens plus the 126-character one go through toDtcg and toDesignMd in 34 ms, measured under coverage instrumentation. Before the fix, a single such token took tens of seconds.

Prototype pollution:

• ci: keep Dependabot off TypeScript majors #20, build(deps-dev): bump @types/node from 24.19.1 to 26.6.4 in the dev-dependencies group #21 js/prototype-polluting-assignment in src/tokens/export.ts: toDtcg creates the tree and every group with Object.create(null). A token path with a __proto__ part, such as CSS --color-__proto__ or --__proto__.polluted, is now an ordinary "__proto__" key in the JSON. Before, --color-__proto__ was dropped and --__proto__.polluted set Object.prototype.polluted. The JSON for every other token is unchanged.

URL check:

• feat(site): add the website, with the check_ui loop, the benchmark and how it works #23 js/incomplete-url-substring-sanitization in site/lib/site.ts: resolveDocHref makes a link a site path only when it is exactly https://onsystem.vercel.app or starts with https://onsystem.vercel.app/. A look-alike host such as https://onsystem.vercel.app.example.com/x stays as written; before, it became the broken path .example.com/x. Every docs link today starts with the site URL and /, so the site's output does not change.

Not in this PR: #3 js/incomplete-sanitization in action/check.mjs was triaged as a false positive and is handled separately.

Equivalence

The old and new regexes were compared on 400,000 random strings and 400,000 grammar-generated strings (HSL and RGB channels, composites). Matches and capture groups showed 0 differences. For var() the comparison covered the index, length, name and trimmed fallback.

The new tests check that the old valid forms read the same way, in both the DTCG and the DESIGN.md output. They include 1., .5rem, 1.5EM, -30deg, 50%, .5% / .5, 22,163,74 / 0.5, var( --missing , 0.5rem ) and composites with spaces around :.

Tests

• test/tokens.test.ts: lengths, var() fallbacks and bare channels read as before, and each 100,000-character attack input finishes in under 100 ms.
• test/export.test.ts: numbers, lengths, composites and channels export as before. The long tokens export in under 200 ms. A __proto__ token stays in its group, and Object.prototype gets no polluted property.
• site/test/markdown.test.ts: resolveDocHref on the site URL, a path under it and a look-alike host.

Patch changeset: .changeset/long-token-values.md.

Checks run

• pnpm lint, pnpm format:check and pnpm typecheck
• pnpm test: 1181 passed
• The new tests under --coverage
• pnpm build and pnpm --filter site generate
• Site test (274 passed), typecheck and lint