esm dependency vunerability

[tholman]

Getting some github alerts while using this lib due to "esm": "~3.0.84",

Do you think you could give them a bump?

[mourner]

Not at the moment, since newer versions completely break our setup. However, you can safely dismiss this warning because it doesn't affect users of GL JS in any way. esm is only used by contributors for running tests.

[woodhull]

In that case, could esm be moved to a dev dependency?

[mourner]

Yes, we should probably do that. Previously it was moved for easier integration with mapbox-gl-native which reuses the GL JS shaders, but I think we can live with maintaining the same dependency there — it overweighs GitHub/NPM showing security warnings for projects using GL JS.