chore(repo): Remove eslint-config-custom from react's deps

[brkalow]

Description

eslint-config-custom should only be a devDependency, not a direct dependency. This ensures we don't attempt to download the package when @clerk/clerk-react is installed.

Checklist

• npm test runs as expected.
• npm run build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[changeset-bot]

🦋 Changeset detected

Latest commit: da492a3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages

Name	Type
@clerk/eslint-config-custom	Patch
@clerk/clerk-react	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/elements	Patch
@clerk/clerk-expo	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/nextjs	Patch
@clerk/remix	Patch
@clerk/clerk-sdk-node	Patch
@clerk/testing	Patch
@clerk/themes	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[blaine-arcjet]

I think this exists as a dependency in other package.json files in the monorepo.

[blaine-arcjet]

Also, why doesn't this use a scoped package so there is no risk at all of downloading the published package?

[brkalow]

@blaine-arcjet This was the only entry under dependencies that I could find 🤔. devDependencies should be a non-issue. Yeah, agreed on the package name. Will update, thanks!

[blaine-arcjet]

Are y'all planning to roll this out? It's a supply chain vulnerability in your packages