fix: drop cpx and child-process-promise to clear vulnerable transitive deps

[varzager]

Summary

cpx@1 and child-process-promise@2 are listed as runtime dependencies but are only used by build/test tooling. Both drag vulnerable transitive packages into the published tree, which Dependabot flags for consumers:

• cpx@^1.5.0 → chokidar@2 → micromatch@3 → braces@1.x/2.x — GHSA-grv7-fg5c-xmjg (no patch on the 1.x/2.x line)
• child-process-promise@^2.2.1 → cross-spawn@4.0.2 — GHSA-3xgq-45jj-v275

This PR removes both and replaces them with Node built-ins, so both advisories are fixed at the source with zero new dependencies.

Changes

• copy-templates: replaced cpx 'src/**/*.template.*' dist/ with scripts/copy-templates.js — a small, dependency-free fs-based recursive copy that preserves the src/-relative structure into dist/.
• scripts/generateReadme.ts / tests/driver.ts: replaced child-process-promise with the built-in child_process module — util.promisify(exec) for the readme script and a tiny spawn → Promise wrapper for the test driver.
• Removed cpx, child-process-promise, and @types/child-process-promise from package.json; regenerated yarn.lock.
• Added scripts/copy-templates.js to .eslintignore (the repo's lint script only targets .ts/.tsx).

Result

cpx, child-process-promise, cross-spawn@4, and the chokidar@2 → micromatch@3 → braces@2 chain are gone from the tree entirely. The only remaining braces/cross-spawn copies now come exclusively from devDependencies (eslint, lint-staged), are already patched (braces@3.0.3, cross-spawn@7.0.3), and are never installed by consumers of the published package.

Verification

yarn test (clean-generated → generate-for-type-tests → lint → typecheck → build → jest) passes locally: 31/31 tests, 7/7 snapshots, and the build confirms the template is copied to dist/proxyEngine/proxyEngine.template.ts.

---

Surfaced by Dependabot in a downstream project consuming this package. Thanks for maintaining this! 🙏

🤖 Generated with Claude Code

[eliranhWix]

#skipreview

[wix-s-github-tools]

skipreview by eliranhWix is not available in org wix-incubator.
If the issue persists, contact #dx-platform.

[Copilot]

Pull request overview

This PR removes two runtime dependencies (cpx and child-process-promise) that are only used for build/test tooling, replacing them with Node.js built-ins to eliminate vulnerable transitive dependencies from the published dependency tree.

Changes:

• Replace cpx with a small fs-based recursive template copy script.
• Replace child-process-promise usage with built-in child_process (exec + spawn wrapper).
• Remove the unused deps from package.json and regenerate yarn.lock.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
scripts/copy-templates.js	Adds a dependency-free template copier to replace cpx.
package.json	Removes cpx / child-process-promise from runtime deps and updates the copy script.
scripts/generateReadme.ts	Switches to child_process.exec (promisified) instead of child-process-promise.
tests/driver.ts	Replaces child-process-promise spawn with a small Promise-wrapped child_process.spawn.
.eslintignore	Excludes the new script file (though lint targets TS/TSX only).
yarn.lock	Lockfile update reflecting dependency removals and transitive changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.