chore(deps): update dependency sinon to v21

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sinon (source)	17.0.2 → 21.1.0
@types/sinon (source)	17.0.4 → 21.0.1

---

Release Notes

sinonjs/sinon (sinon)

v21.1.0

Compare Source

• 0a5526c5
  updated deps (Carl-Erik Kopseng)
• 5262204f
  fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
• 819bb64b
  Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

  This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib

  • Modern ignores 😁
  • test: add distribution harness
  • test: verify packed cjs and esm entrypoints
  • test: lock distribution api manifest
  • test: smoke test built pkg artifacts
  • docs: require contract tests for package migration
  • test: guard esm migration regressions
  • docs: require contract gate for esm migration
  • build: generate cjs lib from esm source entries
  • refactor: port root api surface to esm
  • build: clean port of root api to esm
  • docs: include implementation plans
  • fix: align lint and smoke tests with esm migration
  • refactor: complete esm port of all core components
  • refactor: finalize esm migration with sandbox and naming fixes
  • fix: finish esm migration stabilization
  • chore: stop tracking generated lib output
  • remove plans
  • prettier
  • linting
  • fix: make distribution tests self-contained
  • fix: build before coverage test bundle
  • refactor: move simple unit tests to src
  • refactor: flatten test and coverage script chains
  • refactor: use parallel mocha for node tests
  • test: restore fake timers cleanup
  • refactor: remove node test runner script
  • remove unneccessary clutter
  • fix: make mocha watch use polling
  • simplify
  • Increase coverage
  • Fix coverage by removing duplicated tests

  These were covering the generated lib/ folder.

  • Move shared util into esm dir
  • fix package dep issues
  • Adjust coverage
  • Upgrade all dependencies

  npx npm-check-updates -u

• cd2bf5a3
  Use newer endpoint (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-09.

v21.0.3

Compare Source

• 0494251b
  fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-16.

v21.0.2

Compare Source

• 024321c4
  fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
• b836fccb
  fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
• ebf0c431
  docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)

  • docs: add how-to article for stubbing ES module imports with esm package

  Adds a comprehensive How-To guide that addresses issue #​1832, documenting
  how to configure Node.js to allow Sinon stubs to work with ES modules.

  • Explains why ES module namespace bindings are immutable by spec
  • Shows how to use the 'esm' npm package with mutableNamespace: true
  • Provides a complete working example with project layout, package.json,
    loader file, source modules, and a full test suite
  • Documents limitations (destructured imports, non-standard behavior)
  • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference

  Closes #​1832
  Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
  Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

• ebcd506c
  Fix spies not being reset properly (#​2673) (simon-id)
• 3beab2ba
  Make doc tests pass with new jQuery (Carl-Erik Kopseng)
• 766715c6
  build: reduce transitive audit findings (Carl-Erik Kopseng)
• 92aaf5c9
  build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
• c6aaa871
  chore: ignore project worktrees (Carl-Erik Kopseng)
• ef387e8e
  Upgrade most deps (Carl-Erik Kopseng)
• 3cf4e77d
  docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
• 6349032f
  Check login status before publishing steps are performed (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-04.

v21.0.1

Compare Source

• 456a65c2
  Update dependencies - except @​sinonjs/samsam (#​2669) (Carl-Erik Kopseng)
• f04f3eb1
  Fix issue 2618 - Remove browserify in favor of esbuild (#​2661) (Artur Parkhisenko)
• 48b69df2
  fix(docs): remove assert.failException from documentation (#​2666) (Steffen Schroeder)
• 13b27ccc
  Fix sandbox restore not handling stubbed functions (#​2667) (thamion)
• ae9e09ac
  Update compatibility target to ES2023 (Carl-Erik Kopseng)

  Updated compatibility target from ES2017 to ES2023 and clarified the note on breaking changes.

• 26055043
  Improve error message for immutable descriptors (#​2664) (Stuart Dotson)
• 80fa9a5b
  Also mirror the calledOnceWith assertion (#​2660) (Benedikt Meurer)

Released by Carl-Erik Kopseng on 2025-12-19.

v21.0.0

Compare Source

• fd10f13f
  chore!: remove assert.failException property (#​2659) (Morgan Roderick)

  This was used for allowing customisation of the thrown error between
  sandboxes and for customisation for integrations (most likely from the
  days of BusterJS).

  To my knowledge and what I've been able to find on GitHub, this has
  never had any production use by end users.

  BREAKING CHANGE: this removes assert.failException from the API

Released by Morgan Roderick on 2025-06-13.

v20.0.0

Compare Source

• b6daed26
  chore!: remove usingPromise (Morgan Roderick)

  Everyone should be using native promises by now, or should know how to stub natives

• 95d4b8fc
  chore!: remove fakeXMLHttpRequest and fakeServer (Morgan Roderick)

  BREAKING CHANGE: remove fakeXMLHttpRequest and fakeServer from the API

Released by Morgan Roderick on 2025-03-24.

v19.0.5

Compare Source

• 67d19ff0
  chore: deprecate usingPromise (#​2651) (Morgan Roderick)
• 598dddb6
  chore: deprecate useFakeXMLHttpRequest and useFakeServer (Morgan Roderick)

Released by Morgan Roderick on 2025-03-23.

v19.0.4

Compare Source

The release script failed half-way in 19.0.3, so re-releasing.

• da67311a
  Revert "Add version 19.0.3 to releases" (Carl-Erik Kopseng)
• 84d5c82a
  Add version 19.0.3 to releases (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2025-03-19.

v19.0.3

Compare Source

Basically just documentation updates

• 1f1d3706
  Verifying links procedure (Carl-Erik Kopseng)
• 37623efc
  Catch latest two missing redirects (Carl-Erik Kopseng)
• 2404a45f
  Ignore ancient deadlinks to Sinon child projects in previous releases (Carl-Erik Kopseng)
• fba6f877
  Ignore historic links in changelog (Carl-Erik Kopseng)
• e3950d9b
  Fix external link (Carl-Erik Kopseng)
• 0be40825
  Fix the missing redirects to the migration guide (Carl-Erik Kopseng)
• 108fbca0
  Fix internal ../assertions link in source (Carl-Erik Kopseng)
• bb10e53a
  Fix spy-call reference in source (Carl-Erik Kopseng)
• ef582e31
  Remove bash-ism from Makefile (use POSIX) (Carl-Erik Kopseng)
• 7af1d235
  chore: remove .unimportedrc.json (Morgan Roderick)
• dfcad710
  chore: fix codecov upload (Morgan Roderick)

  We are seeing errors uploading coverage reports to codecov:

  Rate limit reached. Please upload with the Codecov repository upload token to resolve issue
  

  I've added a repository token, as instructed in https://docs.codecov.com/docs/adding-the-codecov-token.

  This changeset should fix the upload issue.

• 0ca2e49e
  fix: browser-test job fails in ubuntu-latest (Morgan Roderick)
• e9eb2eb2
  chore: remove unused unused job (Morgan Roderick)

  This crucial part of this workflow was removed in
  278e667, we should have removed the entire job.

• 278e667e
  chore: remove unimported (Morgan Roderick)

  The repository has been archived. See https://github.com/smeijer/unimported

• 9e30835b
  npm audit (Morgan Roderick)
• a74301cf
  chore: remove RunKit (Morgan Roderick)

  This service is dead.

• 80bc1d96
  Fix out-of-date fake-timers docs (#​2628) (Carl-Erik Kopseng)

  • Fix documentation issue for fake-timers mentioned in #​2625

  The docs were out of sync with the fake-timers docs.

  • Update dependencies before new patch version

• 527568cc
  Bump rexml from 3.3.7 to 3.3.9 (#​2626) (dependabot[bot])

  Bumps rexml from 3.3.7 to 3.3.9.

  • Release notes
  • Changelog
  • Commits

  ---

  updated-dependencies:

  • dependency-name: rexml

    dependency-type: indirect

  ...

  Signed-off-by: dependabot[bot] support@github.com

  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@​users.noreply.github.com>

• ed029725
  Bump webrick from 1.8.1 to 1.8.2 (#​2623) (dependabot[bot])

  Bumps webrick from 1.8.1 to 1.8.2.

  • Release notes
  • Commits

  ---

  updated-dependencies:

  • dependency-name: webrick

    dependency-type: indirect

  ...

  Signed-off-by: dependabot[bot] support@github.com

  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@​users.noreply.github.com>

Released by Carl-Erik Kopseng on 2025-03-19.

v19.0.2

Compare Source

• 4eb4c4bc
  Use fix 13.0.2 version of fake-timers to get Date to pass instanceof checks (Carl-Erik Kopseng)
• a5b03db3
  Add links to code that is affected by the breaking changes (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2024-09-13.

v19.0.1

Compare Source

• 037ec2d2
  Update migration docs (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2024-09-13.

v19.0.0

Compare Source

• 3534ab4f
  Bump samsam and nise to latest versions (#​2617) (Carl-Erik Kopseng)

  Ensures consistency and less breakage when there are "circular" dependencies.

• 912c568d
  upgrade fake timers and others (#​2612) (Carl-Erik Kopseng)

  • Upgrade dependencies (includes breaking API in Fake Timers)
  • fake-timers: no longer creating dates using the original Date class, but a subclass (proxy)

• 9715798e
  Use newer @​mochify/* packages (#​2609) (Carl-Erik Kopseng)

  Co-authored-by: Maximilian Antoni mail@maxantoni.de

Released by Carl-Erik Kopseng on 2024-09-13.

v18.0.1

Compare Source

Basically a patch release to update a transitive dependency in Nise.

• 03e33ec6
  Pin fake-timers@​11.2.2 to avoid breaking change (Carl-Erik Kopseng)
• 5a7924ad
  Add createStubInstance header in stubs.md (Daniel Kaplan)
• ad6804cd
  Bump elliptic from 6.5.5 to 6.5.7 (#​2608) (dependabot[bot])
• 033287bd
  Bump path-to-regexp and nise (#​2611) (dependabot[bot])

  Bumps path-to-regexp to 8.1.0 and updates ancestor dependency nise. These dependencies need to be updated together.

  Updates path-to-regexp from 6.2.2 to 8.1.0

  • Release notes
  • Changelog
  • Commits

  Updates nise from 6.0.0 to 6.0.1

  • Changelog
  • Commits

  ---

  updated-dependencies:

  • dependency-name: path-to-regexp

    dependency-type: indirect

  • dependency-name: nise

    dependency-type: direct:production

  ...

  Signed-off-by: dependabot[bot] support@github.com

  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@​users.noreply.github.com>

• 0c609f95
  re-add testing of esm browser builds (Carl-Erik Kopseng)

  It seems unclear why it was removed in the first place: I have tested extensively that it
  does work and it does fail the build if changing any assertion in the script

• da4230a0
  Bump braces from 3.0.2 to 3.0.3 (#​2605) (dependabot[bot])

  Bumps braces from 3.0.2 to 3.0.3.

  • Changelog
  • Commits

  ---

  updated-dependencies:

  • dependency-name: braces

    dependency-type: indirect

  ...

  Signed-off-by: dependabot[bot] support@github.com

  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@​users.noreply.github.com>

• 02542370
  feat(ci): add node v22 (#​2600) (Rotzbua)
• 794cb81a
  fix(tests): typo (#​2603) (Rotzbua)
• 1eb2a254
  Use NodeJS 22.2.0 as base development version (Carl-Erik Kopseng)
• 1aa713fd
  Bump rexml from 3.2.5 to 3.2.8 (#​2599) (dependabot[bot])

  Bumps rexml from 3.2.5 to 3.2.8. >

  • Release notes >
  • Changelog >
  • Commits > >
    --- >
    updated-dependencies: >
  • dependency-name: rexml >
    dependency-type: indirect >
    ... > >
    Signed-off-by: dependabot[bot] support@github.com >
    Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@​users.noreply.github.com>

Released by Carl-Erik Kopseng on 2024-09-10.

v18.0.0

Compare Source

This is what 17.0.2 should have been, as that contained two breaking changes. After updating
Nise we are down to one breaking change, which only affects sinon-test (which has been updated),
so most people are not affected. The legacyRoutes flag that is currently enabled in Nise by default
will at some later version be disabled. We will then issue a little migration note.

• 01d45312
  Use Nise 6 with legacyRoutes flag enabled (Carl-Erik Kopseng)

  This should be disabled in a future Sinon version by default.

• c618edc5
  fix #​2594: remove needless sandbox creation (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2024-05-15.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.