Theme colors are now validated against an allow-list of CSS color formats
(hex, rgb/rgba, hsl/hsla, bare keywords) before being interpolated into
the inline style attribute of token spans. Untrusted custom themes
containing CSS injection (e.g. "red; background: url(...)") fall back to
"inherit".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>