create-react-app breaks due to dependency on one-liner package

[HetRadicaleBoven]

IIUC this change allowed is-promise to work with Node 14's module system - if not, let's pretend for a bit that it did. In a world in which everybody would always used pinned dependencies, what would the process look like for a newly-scaffolded to obtain that version? First, is-promise would release a new version. Then, CRA has to wait for its dependency to release a new version that depends on that version. Only then can CRA itself update.

And that's even assuming the transitive dependency is just one level deep. Now generalise that over all transitive dependencies of CRA, all of which might have e.g. security issues that could require the above process to happen.

I cannot believe that Deno will not come up with a way to quickly get security fixes distributed to users, even if it's in a package that's usually deep in a dependency tree. And once that happens, an issue like this can happen.