Add es5-ext to moduleignore

[jiridanek]

Summary

• es5-ext (0.10.63 and 0.10.64) is quarantined by Nexus Firewall (sonatype-2022-2248) because its _postinstall.js makes network calls to geolocate the host and executes undisclosed code (protestware). Both versions are flagged; there is no clean upstream version.
• This blocks hardened supply chain builds (Konflux, Cachi2, Hermeto) with 403 Forbidden when prefetching npm dependencies.
• This PR adds an npm overrides entry to alias es5-ext to @unes/es5-ext@0.10.64-1, a community fork that strips the postinstall script and rebases daily against upstream.
• The override covers all transitive consumers: gulp-sourcemaps → debug-fabulous → memoizee → es5-ext, and the d / es6-* / esniff / timers-ext family, as well as @microsoft/dev-tunnels-connections → es5-ext + websocket → es5-ext.

Fixes #310541

References

• medikoo/es5-ext#186 — upstream protestware discussion
• microsoft/vscode#160012 — older duplicate
• theturtle32/WebSocket-Node#473 — upstream websocket package dropping es5-ext

Made with Cursor

[Copilot]

Pull request overview

Adds an npm overrides rule at the repository root to ensure any transitive es5-ext dependency is resolved to the community fork @unes/es5-ext (intended to avoid quarantine/protestware postinstall behavior and unblock hardened dependency prefetch/build pipelines).

Changes:

• Add overrides.es5-ext = "npm:@unes/es5-ext@0.10.64-1" to force resolution to @unes/es5-ext.
• Reformat the root package.json (indentation/whitespace).

[jiridanek]

@microsoft-github-policy-service agree company="Red Hat"

[connor4312]

We can actually just add es5-ext to our moduleignore entirely. It is only consumed in websocket's browser version, and is already in a try/catch and unnecssary in the browsers we support. Feel free to make that change if you would like.

[jiridanek]

Thanks @connor4312! That's much cleaner. Confirmed — browser.js checks globalThis first, then falls back to require('es5-ext/global') inside a try/catch, so stripping es5-ext is safe.

This is consistent with your earlier comment on #310541 noting that es5-ext is "otherwise benign/useful (though technically extraneous as it's a polyfill for older browsers we don't support anyway)."

I'll push the .moduleignore change to this PR.

[connor4312]

Ah, sorry, our CI blocks external contribs to ./build. I'll reopen this under my account to unlock