chore(deps-dev): bump sinon from 9.2.4 to 21.1.2

[dependabot]

Bumps sinon from 9.2.4 to 21.1.2.

Changelog

Sourced from sinon's changelog.

21.1.2

• 53817f7d Upgrade to ESLint 10 and new shared config (#2696) (Carl-Erik Kopseng)

  • Upgrade to ESLint 10 and new shared config
  • Update deps

• d7a682e0 fix: move npm-run-all to devDeps (#2694) (Avi Vahl)

  used only during dev, and caused a considerable dep count jump downstream

• 5b8720ec use latest shared eslint-config (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-11.

21.1.1

• 3c8b023b Update deps (Carl-Erik Kopseng)
• 2eabf5da fix(#2692): Remove ESM-only supports-color as it breaks CJS exports (#2693) (Carl-Erik Kopseng)

  • fix(#2692): Remove ESM-only supports-color as it breaks CJS exports

Released by Carl-Erik Kopseng on 2026-04-10.

21.1.0

• 0a5526c5 updated deps (Carl-Erik Kopseng)
• 5262204f fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
• 819bb64b Migration to ECMAScript modules (ESM) (#2683) (Carl-Erik Kopseng)

  This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib

  • Modern ignores 😁
  • test: add distribution harness
  • test: verify packed cjs and esm entrypoints
  • test: lock distribution api manifest
  • test: smoke test built pkg artifacts
  • docs: require contract tests for package migration
  • test: guard esm migration regressions
  • docs: require contract gate for esm migration
  • build: generate cjs lib from esm source entries
  • refactor: port root api surface to esm
  • build: clean port of root api to esm
  • docs: include implementation plans
  • fix: align lint and smoke tests with esm migration
  • refactor: complete esm port of all core components
  • refactor: finalize esm migration with sandbox and naming fixes
  • fix: finish esm migration stabilization

... (truncated)

Commits

• c9ee063 21.1.2
• 53817f7 Upgrade to ESLint 10 and new shared config (#2696)
• d7a682e fix: move npm-run-all to devDeps (#2694)
• 5b8720e use latest shared eslint-config
• 40f9d6b 21.1.1
• 3c8b023 Update deps
• 2eabf5d fix(#2692): Remove ESM-only supports-color as it breaks CJS exports (#2693)
• 30cf67e 21.1.0
• 0a5526c updated deps
• 5262204 fix: build artifacts before running bundled tests
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by fatso83, a new releaser for sinon since your current version.

[nirinchev]

@copilot resolve the failures introduced by the version upgrade

[Copilot]

@copilot resolve the failures introduced by the version upgrade

Fixed in d038836. In sinon 21, useFakeTimers() now defaults to faking setImmediate and other async primitives in addition to Date, causing the tests that use nock for HTTP mocking to hang indefinitely (timeout). Fixed by passing toFake: ['Date'] to both useFakeTimers calls so only the Date object is mocked, leaving async mechanisms untouched. All 41 tests in @mongodb-js/sbom-tools now pass.

[coveralls]

coverage: 78.705%. remained the same — dependabot/npm_and_yarn/sinon-21.1.2 into main

[nirinchev]

@copilot resolve the merge conflicts. Additionally, it appears a lot of sinon deps got unhoisted and are now copied across each package's node_modules - is that expected and is can we hoist them back at the top level?

[Copilot]

@copilot resolve the merge conflicts. Additionally, it appears a lot of sinon deps got unhoisted and are now copied across each package's node_modules - is that expected and is can we hoist them back ...

Resolved in 312a79e.

Merge conflicts: Merged latest main into the branch.

Sinon hoisting: The root cause was ts-sinon (used only in devtools-connect) pinning sinon to ^9.0.3. npm installed sinon 9.2.4 at root (for ts-sinon) and sinon 21.1.2 nested under each workspace package — resulting in 23+ copies.

Fixed by:

1. Removing ts-sinon from devtools-connect and replacing it with a local stubConstructor helper that uses native sinon
2. Adding sinon ^21.1.2 to the root devDependencies — this ensures it gets hoisted to node_modules/sinon and shared across all workspaces (down to 1 copy)
3. Added sinon to root .depcheckrc ignores since it's not directly used in root source files