chore: remove unused shadcn generator dependency (#31737)

config/patches/dependency-security.md

@@ -11,16 +11,17 @@ versions or suppress advisories.
 | node-forge 1.4.0 | GHSA-86w9-cpqp-85rv | Require exactly the captured OID and optional NULL in the nested DigestAlgorithm sequence, rejecting unconsumed elements during RSA signature verification.      |
 | sprintf-js 1.1.3 | GHSA-hp3w-g68c-fv3c | Clamp numeric precision to the ECMAScript range before formatting; protect both Node and browser entries.                                                        |
 
-The braces patch applies to desktop, mobile, docs tooling, and isolated audit
-tools. The formatting patch applies to desktop and mobile; mobile's older
-sprintf-js 1.0.3 is first upgraded to 1.1.3. Mobile carries the RSA patch.
+The braces patch applies to mobile, docs tooling, and isolated audit tools.
+Desktop no longer installs braces after removing the unused shadcn generator CLI.
+The formatting patch applies to desktop and mobile; mobile's older sprintf-js
+1.0.3 is first upgraded to 1.1.3. Mobile carries the RSA patch.
 Mobile patch files stay inside its independent workspace for standalone builds.
 
-`config/scripts/dependency-security-patches.test.mjs` exercises the installed
-desktop packages with deeply nested patterns, direct AST inputs, and excessive
-precision in both formatting entries. The mobile regression in
-`mobile/scripts/dependency-security-patches.test.ts` checks the installed Expo
-dependency and rejects a signed malformed DigestInfo while accepting a valid
+`config/scripts/dependency-security-patches.test.mjs` exercises excessive numeric
+precision in both installed desktop formatting entries. The mobile regressions in
+`mobile/scripts/dependency-security-patches.test.ts` exercise deeply nested brace
+and parenthesis patterns and direct AST inputs, then check the installed Expo
+RSA dependency rejects a signed malformed DigestInfo while accepting a valid
 signature. Both suites use the packages installed from the workspace lockfiles;
 they do not run installs or access the registry. Normal patterns and formatting
 retain their previous behavior. Excessive brace patterns now fail explicitly;

config/scripts/dependency-security-patches.test.mjs

@@ -10,7 +10,6 @@ function dependencyRequire(packages) {
 }
 
 // Resolve through declared consumers so hoisting cannot select another workspace's copy.
-const braces = dependencyRequire(['shadcn', 'fast-glob', 'micromatch'])('braces')
 const sprintfRequire = dependencyRequire([
   'electron-builder',
   'app-builder-lib',
@@ -20,33 +19,6 @@ const sprintfRequire = dependencyRequire([
 ])
 
 describe('installed dependency security patches', () => {
-  it.each([
-    ['braces', '{', '}'],
-    ['parentheses', '(', ')'],
-    ['mixed nesting', '{(', ')}']
-  ])('bounds %s during parsing', (_name, open, close) => {
-    expect(() => braces.parse(`${open.repeat(512)}a,b${close.repeat(512)}`)).toThrow(
-      'maximum nesting depth'
-    )
-  })
-
-  it.each(['compile', 'expand', 'stringify'])('bounds nested patterns in braces.%s', (method) => {
-    const pattern = `${'{'.repeat(4_000)}a,b${'}'.repeat(4_000)}`
-    expect(() => braces[method](pattern)).toThrow('maximum nesting depth')
-    expect(braces.expand('src/{main,shared}/*.ts')).toEqual(['src/main/*.ts', 'src/shared/*.ts'])
-  })
-
-  it.each(['compile', 'expand', 'stringify'])(
-    'bounds directly supplied ASTs in braces.%s',
-    (method) => {
-      let ast = { type: 'text', value: 'ok' }
-      for (let depth = 0; depth < 10_000; depth += 1) {
-        ast = { type: 'root', nodes: [ast] }
-      }
-      expect(() => braces[method](ast)).toThrow('maximum nesting depth')
-    }
-  )
-
   it.each(['src/sprintf.js', 'dist/sprintf.min.js'])('bounds numeric precision in %s', (entry) => {
     const { sprintf } = sprintfRequire(`sprintf-js/${entry}`)
     for (const type of ['e', 'f', 'g']) {

mobile/scripts/dependency-security-patches.test.ts

@@ -2,12 +2,46 @@ import { generateKeyPairSync } from 'node:crypto'
 import { createRequire } from 'node:module'
 import { describe, expect, it } from 'vitest'
 
+const require = createRequire(import.meta.url)
+const expoRequire = createRequire(require.resolve('expo'))
+const metroRequire = createRequire(expoRequire.resolve('@expo/metro/package.json'))
+const fileMapRequire = createRequire(metroRequire.resolve('metro-file-map'))
+const micromatchRequire = createRequire(fileMapRequire.resolve('micromatch'))
+const braces = micromatchRequire('braces')
+
+type BraceNode = { type: string; value?: string; nodes?: BraceNode[] }
+
 describe('installed mobile dependency security patches', () => {
+  it.each([
+    ['braces', '{', '}'],
+    ['parentheses', '(', ')'],
+    ['mixed nesting', '{(', ')}']
+  ])('bounds %s during parsing', (_name, open, close) => {
+    expect(() => braces.parse(`${open.repeat(512)}a,b${close.repeat(512)}`)).toThrow(
+      'maximum nesting depth'
+    )
+  })
+
+  it.each(['compile', 'expand', 'stringify'])('bounds nested patterns in braces.%s', (method) => {
+    const pattern = `${'{'.repeat(4_000)}a,b${'}'.repeat(4_000)}`
+    expect(() => braces[method](pattern)).toThrow('maximum nesting depth')
+    expect(braces.expand('src/{main,shared}/*.ts')).toEqual(['src/main/*.ts', 'src/shared/*.ts'])
+  })
+
+  it.each(['compile', 'expand', 'stringify'])(
+    'bounds directly supplied ASTs in braces.%s',
+    (method) => {
+      let ast: BraceNode = { type: 'text', value: 'ok' }
+      for (let depth = 0; depth < 10_000; depth += 1) {
+        ast = { type: 'root', nodes: [ast] }
+      }
+      expect(() => braces[method](ast)).toThrow('maximum nesting depth')
+    }
+  )
+
   it.each([true, false])(
     'rejects extra DigestAlgorithm elements with NULL parameters: %s',
     (parameters) => {
-      const require = createRequire(import.meta.url)
-      const expoRequire = createRequire(require.resolve('expo'))
       const cliRequire = createRequire(expoRequire.resolve('@expo/cli'))
       const forge = cliRequire('node-forge')
       const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024, publicExponent: 3 })

package.json

@@ -334,7 +334,6 @@
     "remark-parse": "^11.0.0",
     "remark-rehype": "11.1.2",
     "remend": "1.4.0",
-    "shadcn": "^4.13.1",
     "shiki": "4.5.0",
     "sonner": "2.0.7",
     "tailwind-merge": "^3.7.0",

pnpm-workspace.yaml

@@ -184,5 +184,4 @@ patchedDependencies:
   ws@8.22.0: config/patches/ws@8.22.0.patch
   oxlint-plugin-anti-slop@0.1.2: config/patches/oxlint-plugin-anti-slop@0.1.2.patch
   monaco-editor@0.55.1: config/patches/monaco-editor@0.55.1.patch
-  braces@3.0.3: config/patches/braces@3.0.3.patch
   sprintf-js@1.1.3: config/patches/sprintf-js@1.1.3.patch