fix: drop cpx and child-process-promise to clear vulnerable transitive deps

Both packages were only used by build/test tooling but pulled vulnerable
transitive dependencies into the published package's runtime tree:

- cpx@1 -> chokidar@2 -> micromatch@3 -> braces 1.x/2.x
  (GHSA-grv7-fg5c-xmjg, no patch on the 1.x/2.x line)
- child-process-promise@2 -> cross-spawn@4.0.2
  (GHSA-3xgq-45jj-v275)

Replace them with Node built-ins so both advisories are resolved at the
source with zero new dependencies:

- copy-templates: swap `cpx` for scripts/copy-templates.js, a small
  fs-based recursive copy of src/**/*.template.* into dist/.
- generateReadme.ts / tests/driver.ts: swap child-process-promise for
  the built-in child_process module (util.promisify(exec) and a small
  spawn->Promise wrapper).
- Remove cpx, child-process-promise, and @types/child-process-promise
  from package.json and regenerate yarn.lock.

The only remaining braces/cross-spawn copies now come exclusively from
devDependencies (eslint, lint-staged), are already patched
(braces@3.0.3, cross-spawn@7.0.3), and are never installed by consumers
of the published package.

Reported-by: Anchor engineering (SOC2 Dependabot triage, ANCR-3208)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: varzager

.eslintignore

@@ -1 +1,2 @@
-__generated__
+__generated__
+scripts/copy-templates.js

package.json

@@ -12,14 +12,12 @@
     "pretest": "yarn run clean-generated && yarn run generate-for-type-tests && yarn run lint && yarn run typecheck && yarn run build",
     "test": "jest -i",
     "build": "tsc -p tsconfig.build.json && yarn copy-templates",
-    "copy-templates": "cpx 'src/**/*.template.*' dist/",
+    "copy-templates": "node scripts/copy-templates.js",
     "generate-readme": "ts-node scripts/generateReadme.ts"
   },
   "dependencies": {
     "@types/flat": "^5.0.2",
-    "child-process-promise": "^2.2.1",
     "cosmiconfig": "^7.0.1",
-    "cpx": "^1.5.0",
     "flat": "^5.0.2",
     "format-message-parse": "^6.2.4",
     "handlebars": "^4.7.7",
@@ -38,7 +36,6 @@
   },
   "devDependencies": {
     "@testing-library/react": "^12.1.0",
-    "@types/child-process-promise": "^2.2.2",
     "@types/jest": "^27.0.1",
     "@types/react": "^17.0.21",
     "@typescript-eslint/eslint-plugin": "^4.32.0",

scripts/copy-templates.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+// Copies template files (src/**/*.template.*) into dist/, preserving the
+// directory structure relative to src/. Replaces the previous `cpx` dependency,
+// which pulled in a vulnerable chokidar@2 -> micromatch@3 -> braces chain
+// (GHSA-grv7-fg5c-xmjg) with no patch available for the 1.x/2.x line.
+const fs = require('fs');
+const path = require('path');
+
+const SRC_DIR = path.resolve(__dirname, '..', 'src');
+const DIST_DIR = path.resolve(__dirname, '..', 'dist');
+const TEMPLATE_RE = /\.template\.[^.]+$/;
+
+function collectTemplates(dir) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) return collectTemplates(fullPath);
+    return TEMPLATE_RE.test(entry.name) ? [fullPath] : [];
+  });
+}
+
+const templates = collectTemplates(SRC_DIR);
+
+for (const srcPath of templates) {
+  const relPath = path.relative(SRC_DIR, srcPath);
+  const destPath = path.join(DIST_DIR, relPath);
+  fs.mkdirSync(path.dirname(destPath), { recursive: true });
+  fs.copyFileSync(srcPath, destPath);
+}
+
+console.log(`copy-templates: ${templates.length} file(s) copied to dist/`);

scripts/generateReadme.ts

@@ -1,14 +1,15 @@
+import { exec as execCallback } from 'child_process';
 import fs from 'fs';
 import util from 'util';
 
-import { exec } from 'child-process-promise';
 import Handlebars from 'handlebars';
 
 import { Generator } from '../src/Generator';
 import { DEFAULT_FN_NAME } from '../src/constants';
 
 const readFile = util.promisify(fs.readFile);
 const writeFile = util.promisify(fs.writeFile);
+const exec = util.promisify(execCallback);
 
 void (async () => {
   const template = Handlebars.compile(

tests/driver.ts

@@ -1,7 +1,7 @@
+import { spawn as spawnProcess } from 'child_process';
 import fs from 'fs';
 import path from 'path';
 import util from 'util';
-import { spawn } from 'child-process-promise';
 import jsonStringify from 'fast-json-stable-stringify';
 import { Generator } from '../src/Generator';
 import { CliParams } from '../src/bin';
@@ -10,6 +10,26 @@ import { getFileExtension } from '../src/utils';
 
 const readFile = util.promisify(fs.readFile);
 
+const spawn = (
+  command: string,
+  args: string[],
+  options: { cwd: string }
+): Promise<void> =>
+  new Promise((resolve, reject) => {
+    const child = spawnProcess(command, args, {
+      ...options,
+      stdio: 'inherit',
+    });
+    child.on('error', reject);
+    child.on('close', (code) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(`${command} exited with code ${code ?? 'null'}`));
+      }
+    });
+  });
+
 export class Driver {
   private cwd: string = process.cwd();
   private cliParams: Partial<CliParams> = {