chore(deps): bump escape-string-regexp from 4.0.0 to 5.0.0

[dependabot]

Bumps escape-string-regexp from 4.0.0 to 5.0.0.

Release notes

Sourced from escape-string-regexp's releases.

v5.0.0

Breaking

• Require Node.js 12 aebb6e8
• This package is now pure ESM. Please read this.

sindresorhus/escape-string-regexp@v4.0.0...v5.0.0

Commits

• ba9a447 5.0.0
• aebb6e8 Require Node.js 12 and move to ESM
• 34ec4c6 Move to GitHub Actions (#31)
• b3eb767 Fix code comment
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[calebcartwright]

This package is now pure ESM. Please read this.

Nuts

[chris48s]

Given the frontend and server now each have their own package.json it should be possible for the frontend to depend on escape-string-regexp@4.0.0 (via frontend/package.json) but upgrade the server to escape-string-regexp@5.0.0 (in package.json). I haven't tried this. It might work out-of-the-box but we might need to do some more rejigging of the NPM scripts to make this actually work .
In the case of packages like this, the dependabot bumps/shared lockfile thing shouldn't be an issue as we will actively want to not upgrade any dependencies we lock in frontend/package.json.

[chris48s]

I tried just shoving "escape-string-regexp": "^4.0.0" in frontend/package.json and installing. That on its own doesn't do the job. Thinking about it a bit more, I guess because all the frontend/testing deps live in the root package.json they're using the dependencies from the main tree. I think "devDependencies": { "gatsby": "*" } in frontend/package.json is just to keep some tooling happy rather than actually doing anything so I might be wrong that we can work round this in that way :(

[calebcartwright]

Would changing into the frontend directory and npm installing do anything?

Nevermind sorry, I misread that first sentence 🤦‍♂️

[PyvesB]

Thinking about it a bit more, I guess because all the frontend/testing deps live in the root package.json they're using the dependencies from the main tree. I think "devDependencies": { "gatsby": "*" } in frontend/package.json is just to keep some tooling happy rather than actually doing anything so I might be wrong that we can work round this in that way :(

Exactly. I don't think there is an easy solution for this one that doesn't involve clunky workarounds.

There doesn't seem to be anything that is functionally new in version 5.0.0, and the package is rarely updated anyway. I suggest we close this and come back to it once #6717 is landed.

[chris48s]

Yes. I'm not super-worried about this particular package.

More widely I guess we're going to see more packages in the ecosystem moving from CommonJS to ESM, possibly before we're able to get #6717 done (which is also blocked on the movement of packages in the ecosystem). At some point this may become a problem but I guess we'll just have to see what moves when..

[PyvesB]

I guess we'll just have to see what moves when..

Yep! I'll close this one for the time being.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.