I updated all test dependencies. I didn't touch any build (browserify) or runtime (polyfills) dependencies.

Are you interested in setting up Github Actions to run the tests like we did for networked-aframe?
See https://github.com/networked-aframe/networked-aframe/blob/master/.github/workflows/ci.yml
I can do that in a separate PR once this one is merged.

What's the benefit of updating the dependencies? I usually only like to update when there's a reason to do so.

We used to have travis-ci running the tests per commit. Never got around to investigate why it broke:

https://github.com/aframevr/aframe/commits/master?before=27f55a6e88666eadfed4066bfc39e289fc931339+175&branch=master&qualified_name=refs%2Fheads%2Fmaster

See commits Aug 2021 and earlier (x or tick next to the commit). Any ideas?

Travis stopped offering CI minutes for open source projects at that time, travis.org was shut down.
You have this warning in a failed travis: "Since June 15th, 2021, the building on travis-ci.org is ceased. Please use travis-ci.com from now on."

Updating the versions is just a matter of keeping them up to date to versions that are maintained, mainly for vulnerabilities, although for a test stack this is probably not as important.
I think it's good for time to time to upgrade to latest versions, because at one point you will probably need to upgrade to benefit a fix for newer OS version or a compatibility for new nodejs version for example. Note that sinon latest 1.x release was in December 2016, 5 years ago.
I found that more time goes by, the more difficult it is to understand what's need to be changed to adapt to newer versions. You need to do lots of archaeologic work, reading all changelogs and documentation to understand what need to be modified. As you can see in the changes, some sinon API changed.

I saw that message but not clear what that meant. I assume travis-co.com is now a paid product. no longer free?

Where do the test run with your Github Actions setup?

I saw that message but not clear what that meant. I assume travis-co.com is now a paid product. no longer free?

That's right.

Where do the test run with your Github Actions setup?

On Github. Github does CI now with Github Actions.
https://github.com/features/actions

I looked at the current .travis.yml, it downloaded latest firefox with the mozilla-download package in devDependencies. But it doesn't seem to work anymore:

./node_modules/.bin/mozilla-download ./firefox/ --product firefox --branch mozilla-aurora
Error: getaddrinfo ENOTFOUND index.taskcluster.net

For networked-aframe, I disabled Firefox in the CI and only test on Chrome. I had flaky tests on Firefox. Having random test failure in CI is bad because at one point you won't look at those failures anymore.

For codecov, I don't know how it works, but the badge is at 0% as well, so may not be working anymore, maybe since travis was down?

Ok I found it, coverage was setup in #1783
Looking at the karma.conf.js, code coverage is enabled only on CI with browserify-istanbul that generates tests/coverage/ folder, travis then publish the artifact to codecov. You can generate the folder by executing:

TEST_ENV=ci npm run test:chrome -- --single-run

For codecov, the old uploader has been shut down as well. We need to remove codecov dependency and script in package.json and use the Github Action codecov-action instead.

I successfully set up GitHub Actions in #5092.

Thanks!