Remove cpx from package.json in twenty-ui since it was unused and caused dependabot alert.

[mabdullahabaid]

Fixes Dependabot Alert 102 - uncontrolled resource consumption in braces.

braces@1.8.5 was coming from the cpx@1.5.0 dependency in packages/twenty-ui/package.json. That release of cpx dragged in chokidar@1.7.0 → micromatch@2.3.11 → braces@^1.8.2.

Now, even though there are mentions of braces: "npm:~3.0.2" in yarn.lock, it resolves to 3.0.3 since ~ allows latest patch in semver.

[greptile-apps]

Greptile Overview

Greptile Summary

This PR removes the unused cpx dependency from the twenty-ui package's devDependencies to address Dependabot Alert 102. The alert flagged a security vulnerability in the braces library, which is a transitive dependency of cpx, involving uncontrolled resource consumption. The removal is safe because cpx was not being utilized anywhere in the build process - the package uses Vite for building (via "build": "npx vite build" script) and has no references to cpx in its configuration or scripts. This change aligns with security best practices of removing unused dependencies that introduce vulnerabilities.

Important Files Changed

Changed Files

Filename	Score	Overview
packages/twenty-ui/package.json	5/5	Removed unused cpx dependency from devDependencies to fix security vulnerability

Confidence score: 5/5

• This PR is extremely safe to merge with no risk of breaking functionality
• Score reflects straightforward dependency removal with clear security justification and no functional impact
• No files require special attention - the change is isolated and well-justified

_{1 file reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​oxc-parser/​binding-darwin-arm64@​0.36.0
	@​oxc-parser/​binding-darwin-x64@​0.36.0
	@​oxc-parser/​binding-linux-arm64-gnu@​0.36.0
	@​oxc-parser/​binding-linux-arm64-musl@​0.36.0
	@​oxc-parser/​binding-linux-x64-gnu@​0.36.0
	@​oxc-parser/​binding-linux-x64-musl@​0.36.0
	@​oxc-parser/​binding-win32-arm64-msvc@​0.36.0
	@​oxc-parser/​binding-win32-x64-msvc@​0.36.0
	@​nx/​nx-darwin-arm64@​21.3.11
	@​nx/​nx-darwin-x64@​21.3.11
	@​nx/​nx-freebsd-x64@​21.3.11
	@​nx/​nx-linux-arm-gnueabihf@​21.3.11
	@​nx/​nx-linux-arm64-gnu@​21.3.11
	@​nx/​nx-linux-arm64-musl@​21.3.11
	@​nx/​nx-linux-x64-gnu@​21.3.11
	@​nx/​nx-linux-x64-musl@​21.3.11
	@​nx/​nx-win32-arm64-msvc@​21.3.11
	@​nx/​nx-win32-x64-msvc@​21.3.11
	@​parcel/​watcher-android-arm64@​2.4.1
	@​parcel/​watcher-darwin-arm64@​2.4.1
	@​parcel/​watcher-darwin-x64@​2.4.1
	@​parcel/​watcher-freebsd-x64@​2.4.1
	@​parcel/​watcher-linux-arm-glibc@​2.4.1
	@​parcel/​watcher-linux-arm64-glibc@​2.4.1
	@​parcel/​watcher-linux-arm64-musl@​2.4.1
	@​parcel/​watcher-linux-x64-glibc@​2.4.1
	@​parcel/​watcher-linux-x64-musl@​2.4.1
	@​parcel/​watcher-win32-arm64@​2.4.1
	@​parcel/​watcher-win32-ia32@​2.4.1
	@​parcel/​watcher-win32-x64@​2.4.1
	@​esbuild/​aix-ppc64@​0.25.5
	@​esbuild/​android-arm64@​0.25.5
	@​esbuild/​darwin-arm64@​0.25.5
See 370 more rows in the dashboard

View full report

[FelixMalfait]

Thank you!