build(deps): bump isbot from 5.1.40 to 5.2.1

[dependabot]

Bumps isbot from 5.1.40 to 5.2.1.

Changelog

Sourced from isbot's changelog.

5.2.1

• Pattern updates

5.2.0

• Rename all imports but keep backwards compatibility with the old names. The new names are more consistent with common Javascript naming conventions. No breaking changes.
• Pattern updates

New Names Map

Old Name	New Name
isbot	isBot
isbotNaive	isBotNaive
createIsbot	createIsBot
createIsbotFromList	createIsBotFromList
isbotMatch	findBotMatch
isbotMatches	findBotMatches
isbotPattern	findBotPattern
isbotPatterns	findBotPatterns

† All old names are still available for backwards compatibility, but can be deprecated in future major versions.

5.1.44

• Pattern updates
• Maintenance: remove defunct services from crawlers list

5.1.43

• Pattern updates

5.1.42

• Pattern updates

5.1.41

• [FIX] Browser entry: was missing from package output
• Pattern updates

Commits

• 87b685a Pattern update (#315)
• 041c832 Autofix
• dfa56df Add crawler list from ua-parser-js as data source
• 24a2c2c Change naming to support common naming conventions (#313)
• 8174f53 Autofix
• 85ec80f Pattern updates + maintenance
• bdf0821 Pattern updates (#309)
• 8aab754 Add bot list source
• 682b6a1 pattern updates
• c2732e2 [FIX] Browser entry missing from pack (#306)
• See full diff in compare view

[alanorth]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[alanorth]

@dependabot recreate

[alanorth]

Something is going on with the dependabot recreate command. The error in CI is that the package-lock.json is out of date with package.json—and it's true, despite me trying to tell dependabot to create the pull request on top of current main.

[alanorth]

@dependabot rebase

[alanorth]

I think what happens is that dependabot rebase and recreate commands don't actually re-run npm install to update the package-lock.json. This is the same as what @tdonohue noticed in #6128. I will run npm install locally and push here.

[tdonohue]

@alanorth : I've been noticing this oddity as well. I think dependabot is somehow getting confused by our package.json and is pulling things out of package-lock.json which are needed there. It's also doing that in other recent PRs to main like #6152.

After talking today with Claude Code AI about this odd behavior from dependabot, it suggested possibly issues with different versions of React were to blame & are causing confusion. We are seeing warnings related to React versions whenever you run npm install (at least I'm seeing them).

I just created a PR (with some AI assistance) to try to solve the React issues (which all relate back to Mirador v3): #6171

However, I will readily admit, I'm not 100% sure if that PR will fix these odd dependabot related issues. The PR definitely removes a ton of warnings from npm install, but it only makes minimal changes to package-lock.json. But, it might be that the new overrides rules that I added in the PR will help dependabot behave better.

(To reword that last paragraph. I'm AM certain the PR solves issues with our install/build related to Mirador. But, I'm NOT certain it fixes this dependabot issue... I just hope it does!)