Update dependency sinon to v21

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
sinon (source)	^20.0.0 → ^21.0.0
@types/sinon (source)	^17.0.0 → ^21.0.0

---

Release Notes

sinonjs/sinon (sinon)

v21.1.2

Compare Source

• 53817f7d
  Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)

  • Upgrade to ESLint 10 and new shared config
  • Update deps

• d7a682e0
  fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

  used only during dev, and caused a considerable dep count jump downstream

• 5b8720ec
  use latest shared eslint-config (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-11.

v21.1.1

Compare Source

• 3c8b023b
  Update deps (Carl-Erik Kopseng)
• 2eabf5da
  fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)

  • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports

Released by Carl-Erik Kopseng on 2026-04-10.

v21.1.0

Compare Source

• 0a5526c5
  updated deps (Carl-Erik Kopseng)
• 5262204f
  fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
• 819bb64b
  Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

  This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib

  • Modern ignores 😁
  • test: add distribution harness
  • test: verify packed cjs and esm entrypoints
  • test: lock distribution api manifest
  • test: smoke test built pkg artifacts
  • docs: require contract tests for package migration
  • test: guard esm migration regressions
  • docs: require contract gate for esm migration
  • build: generate cjs lib from esm source entries
  • refactor: port root api surface to esm
  • build: clean port of root api to esm
  • docs: include implementation plans
  • fix: align lint and smoke tests with esm migration
  • refactor: complete esm port of all core components
  • refactor: finalize esm migration with sandbox and naming fixes
  • fix: finish esm migration stabilization
  • chore: stop tracking generated lib output
  • remove plans
  • prettier
  • linting
  • fix: make distribution tests self-contained
  • fix: build before coverage test bundle
  • refactor: move simple unit tests to src
  • refactor: flatten test and coverage script chains
  • refactor: use parallel mocha for node tests
  • test: restore fake timers cleanup
  • refactor: remove node test runner script
  • remove unneccessary clutter
  • fix: make mocha watch use polling
  • simplify
  • Increase coverage
  • Fix coverage by removing duplicated tests

  These were covering the generated lib/ folder.

  • Move shared util into esm dir
  • fix package dep issues
  • Adjust coverage
  • Upgrade all dependencies

  npx npm-check-updates -u

• cd2bf5a3
  Use newer endpoint (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-09.

v21.0.3

Compare Source

• 0494251b
  fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-16.

v21.0.2

Compare Source

• 024321c4
  fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
• b836fccb
  fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
• ebf0c431
  docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)

  • docs: add how-to article for stubbing ES module imports with esm package

  Adds a comprehensive How-To guide that addresses issue #​1832, documenting
  how to configure Node.js to allow Sinon stubs to work with ES modules.

  • Explains why ES module namespace bindings are immutable by spec
  • Shows how to use the 'esm' npm package with mutableNamespace: true
  • Provides a complete working example with project layout, package.json,
    loader file, source modules, and a full test suite
  • Documents limitations (destructured imports, non-standard behavior)
  • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference

  Closes #​1832
  Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
  Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

• ebcd506c
  Fix spies not being reset properly (#​2673) (simon-id)
• 3beab2ba
  Make doc tests pass with new jQuery (Carl-Erik Kopseng)
• 766715c6
  build: reduce transitive audit findings (Carl-Erik Kopseng)
• 92aaf5c9
  build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
• c6aaa871
  chore: ignore project worktrees (Carl-Erik Kopseng)
• ef387e8e
  Upgrade most deps (Carl-Erik Kopseng)
• 3cf4e77d
  docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
• 6349032f
  Check login status before publishing steps are performed (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-04.

v21.0.1

Compare Source

• 456a65c2
  Update dependencies - except @​sinonjs/samsam (#​2669) (Carl-Erik Kopseng)
• f04f3eb1
  Fix issue 2618 - Remove browserify in favor of esbuild (#​2661) (Artur Parkhisenko)
• 48b69df2
  fix(docs): remove assert.failException from documentation (#​2666) (Steffen Schroeder)
• 13b27ccc
  Fix sandbox restore not handling stubbed functions (#​2667) (thamion)
• ae9e09ac
  Update compatibility target to ES2023 (Carl-Erik Kopseng)

  Updated compatibility target from ES2017 to ES2023 and clarified the note on breaking changes.

• 26055043
  Improve error message for immutable descriptors (#​2664) (Stuart Dotson)
• 80fa9a5b
  Also mirror the calledOnceWith assertion (#​2660) (Benedikt Meurer)

Released by Carl-Erik Kopseng on 2025-12-19.

v21.0.0

Compare Source

• fd10f13f
  chore!: remove assert.failException property (#​2659) (Morgan Roderick)

  This was used for allowing customisation of the thrown error between
  sandboxes and for customisation for integrations (most likely from the
  days of BusterJS).

  To my knowledge and what I've been able to find on GitHub, this has
  never had any production use by end users.

  BREAKING CHANGE: this removes assert.failException from the API

Released by Morgan Roderick on 2025-06-13.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​sinon@​17.0.3 ⏵ 21.0.1
	sinon@​20.0.0 ⏵ 21.1.2			+1	+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report