fix(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint/config-helpers (source)	0.5.4 → 0.5.5
dotenv	17.4.1 → 17.4.2
sinon (source)	21.0.3 → 21.1.2

---

Release Notes

eslint/rewrite (@​eslint/config-helpers)

v0.5.5

Compare Source

Bug Fixes

• revert re-export ESM types in CommonJS (#​427) (9b16fe1)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

motdotla/dotenv (dotenv)

v17.4.2

Compare Source

sinonjs/sinon (sinon)

v21.1.2

Compare Source

• 53817f7d
  Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)

  • Upgrade to ESLint 10 and new shared config
  • Update deps

• d7a682e0
  fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

  used only during dev, and caused a considerable dep count jump downstream

• 5b8720ec
  use latest shared eslint-config (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-11.

v21.1.1

Compare Source

• 3c8b023b
  Update deps (Carl-Erik Kopseng)
• 2eabf5da
  fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)

  • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports

Released by Carl-Erik Kopseng on 2026-04-10.

v21.1.0

Compare Source

• 0a5526c5
  updated deps (Carl-Erik Kopseng)
• 5262204f
  fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
• 819bb64b
  Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

  This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib

  • Modern ignores 😁
  • test: add distribution harness
  • test: verify packed cjs and esm entrypoints
  • test: lock distribution api manifest
  • test: smoke test built pkg artifacts
  • docs: require contract tests for package migration
  • test: guard esm migration regressions
  • docs: require contract gate for esm migration
  • build: generate cjs lib from esm source entries
  • refactor: port root api surface to esm
  • build: clean port of root api to esm
  • docs: include implementation plans
  • fix: align lint and smoke tests with esm migration
  • refactor: complete esm port of all core components
  • refactor: finalize esm migration with sandbox and naming fixes
  • fix: finish esm migration stabilization
  • chore: stop tracking generated lib output
  • remove plans
  • prettier
  • linting
  • fix: make distribution tests self-contained
  • fix: build before coverage test bundle
  • refactor: move simple unit tests to src
  • refactor: flatten test and coverage script chains
  • refactor: use parallel mocha for node tests
  • test: restore fake timers cleanup
  • refactor: remove node test runner script
  • remove unneccessary clutter
  • fix: make mocha watch use polling
  • simplify
  • Increase coverage
  • Fix coverage by removing duplicated tests

  These were covering the generated lib/ folder.

  • Move shared util into esm dir
  • fix package dep issues
  • Adjust coverage
  • Upgrade all dependencies

  npx npm-check-updates -u

• cd2bf5a3
  Use newer endpoint (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-09.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

This PR will trigger a patch release when merged.

[adobe-bot]

🎉 This PR is included in version 16.18.7 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀