Remove cpx from package.json in twenty-ui since it was unused and caused dependabot alert. (#15147)
Fixes [Dependabot Alert 102](https://github.com/twentyhq/twenty/security/dependabot/102) - uncontrolled resource consumption in braces. braces@1.8.5 was coming from the cpx@1.5.0 dependency in packages/twenty-ui/package.json. That release of cpx dragged in chokidar@1.7.0 → micromatch@2.3.11 → braces@^1.8.2. Now, even though there are mentions of `braces: "npm:~3.0.2"` in yarn.lock, it resolves to `3.0.3` since ~ allows latest patch in semver.
This commit is contained in:
@@ -16,7 +16,6 @@
|
||||
"babel-plugin-inline-import": "^3.0.0",
|
||||
"babel-plugin-inline-react-svg": "^2.0.2",
|
||||
"babel-plugin-module-resolver": "^5.0.2",
|
||||
"cpx": "^1.5.0",
|
||||
"tsx": "^4.19.3",
|
||||
"vite-plugin-svgr": "^4.3.0"
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user