Alternative: override debug-fabulous + es5-ext to eliminate quarantined dependency

[jiridanek]

Summary

Alternative to #315063 — instead of only aliasing es5-ext, this PR also upgrades debug-fabulous to v2.0.69 which dropped the memoizee dependency that was the main consumer of es5-ext in the build tooling chain.

Two overrides:

1. "debug-fabulous": "^2.0.69" — this version (published today) removed memoizee as a dependency, completely eliminating es5-ext from the gulp-sourcemaps → debug-fabulous → memoizee → es5-ext chain. The entire d/es6-*/esniff/timers-ext/lru-queue family is removed from the dependency tree.

2. "es5-ext": "npm:@unes/es5-ext@0.10.64-1" — still needed for the remaining production path: @microsoft/dev-tunnels-connections → es5-ext + websocket → es5-ext. Uses a community fork without the postinstall script.

Why this may be preferred over #315063: The debug-fabulous override removes es5-ext from the build tooling tree entirely rather than aliasing it. Fewer transitive dependencies overall.

Fixes #310541

References

• Add es5-ext to moduleignore #315063 — companion PR (es5-ext alias only)
• medikoo/es5-ext#186 — upstream protestware discussion
• theturtle32/WebSocket-Node#473 — upstream websocket dropping es5-ext

Made with Cursor

[Copilot]

Pull request overview

This PR adjusts the root npm dependency resolution to reduce exposure to the quarantined es5-ext package by (1) overriding debug-fabulous to a newer release that drops the memoizee -> es5-ext toolchain path, and (2) overriding remaining es5-ext uses to the @unes/es5-ext fork.

Changes:

• Add npm overrides for debug-fabulous@^2.0.69 and es5-ext → npm:@unes/es5-ext@0.10.64-1.
• Update package-lock.json to reflect the new resolution: remove memoizee (and related transitive deps) and rewrite es5-ext occurrences to @unes/es5-ext.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds dependency overrides for debug-fabulous and es5-ext to alter the transitive dependency graph.
package-lock.json	Updates the resolved dependency tree to reflect the new overrides (including removing memoizee and swapping es5-ext to @unes/es5-ext).

[jiridanek]

Closing in favor of #315063, which now uses the simpler .moduleignore approach as suggested by @connor4312. That strips es5-ext from the build output entirely without changing the dependency tree or risking semver breakage from the debug-fabulous major version override (valid concern from Copilot's review).