replaceAll, and the regex with /g you no longer need

String.replace with a string pattern replaces the first occurrence only, which is the most surprised anybody has been by a standard library method.

'a-b-c'.replace('-', '_')       // 'a_b-c'
'a-b-c'.replace(/-/g, '_')      // 'a_b_c'
'a-b-c'.replaceAll('-', '_')    // 'a_b_c'

// and replaceAll THROWS on a non-global regex, which is
// a deliberate guard against the same confusion:
'a-b-c'.replaceAll(/-/, '_')    // TypeError

Escaping user input to build a global regex was the previous answer and was a source of injection bugs whenever the escaping was imperfect. The TypeError on a non-global regex looks pedantic and is the right call — a non-global pattern passed to a method named replaceAll means the author has misunderstood something, and failing is better than replacing once.