chore(deps): update dependency sinon to v22 - #537

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/sinon-22.x
Open

chore(deps): update dependency sinon to v22#537
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/sinon-22.x

Conversation

@renovate

@renovaterenovateBot commented May 9, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeConfidence
sinon (source)21.0.1 → 22.1.0ageconfidence

Release Notes

sinonjs/sinon (sinon)

v22.1.0

Compare Source

  • d36e921b
    fix: let returns override returnsArg (王胜)

    Signed-off-by: 王胜 <2318857637@​qq.com>

  • 40c4caa0
    fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

    restoreObject was made idempotent in #​2737 — it no longer throws
    for objects with no restorable methods. Updates the docs page
    and its corresponding test to reflect this.

  • a68dac19
    fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)
    • fix: throw a clear error when throwArg index equals the argument count

    spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
    with pos equal to the number of recorded arguments slipped past the guard
    and reached throw this.args[pos], throwing undefined instead of the
    intended TypeError. A thrown undefined cannot be inspected as an Error and
    is reported by test frameworks as no exception thrown.

    Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
    which already reject an out-of-range index with a clear error.

  • 9ea504e3
    feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

    Passing an object with no live fakes to restoreObject now restores
    nothing instead of throwing, giving it symmetry with sinon.restore()
    and sandbox.restore(). The strict "found no methods" check is retained
    for spy(object) and stub(object), which now use a dedicated
    walkObjectStrict export, while restoreObject uses the loose walkObject.
    Passing a falsy value still throws.

    Fixes #​2736

  • 4db4feff
    fix: preserve fake undefined argument validation (Vishal Kumar Singh)
  • 755a40d7
    fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

    The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
    and calledImmediatelyAfter to fail when tests run in parallel with separate
    sandboxes. Each sandbox now maintains its own callId counter, passed through
    the spy/stub/fake creation chain via a context object.

    Fixes #​2472

Released by Morgan Roderick on 2026-07-20.

v22.0.0

Compare Source

  • ed911df5
    Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8
    Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608
    Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b
    Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6
    Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8
    Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)
    • refactor: global mutable call id can grow unbounded across l

    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.

    Affected files: proxy-invoke.js

    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com

    • Wrap around for all values that are too high

    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

  • f4f7d93b
    Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
  • 6199e9e4
    improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

    • fix(workflows): fetch-depth is for actions/checkout

    • chore(workflows): update

    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59
    Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393
    fix: make build and node test scripts cross-platform (laplace young)
  • a7692917
    fix: isolate walk state from Object prototype (laplace young)
  • 66df977a
    Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

    The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:

    createSandbox: function createSandbox(config) {
const s = createConfiguredSandbox(config);
sandbox.getFakes().push(s);
return s;
}

    Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
    verifyAndRestore. This is the regression reported in #​2701.

    Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.

    Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
    end.

    Closes #​2701

  • f0bd6e1b
    fix: exclude proto from walk() (#​2699) (Kevin Locke)

    __proto__ is a special property to access an object's prototype. It
    has many pitfalls:

    • Setting it to an object value changes an object's prototype, which is
      generally discouraged and may be unexpected by the iterator callback.
    • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
    • When Node.js is run with the --disable-proto=throw option, getting
      or setting __proto__ causes an exception with code
      ERR_PROTO_ACCESS to be thrown.

    Additionally, since this property (and all properties of
    Object.prototype) are currently unused in this project by consumers of
    walk(), it is both safe and preferable to exclude.

    Fixes: #​2695

    Signed-off-by: Kevin Locke kevin@kevinlocke.name

  • 1f8afd50
    chore: add context7.json for ownership confirmation (Morgan Roderick)

Released by Carl-Erik Kopseng on 2026-05-05.

v21.1.2

Compare Source

  • 53817f7d
    Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)
    • Upgrade to ESLint 10 and new shared config
    • Update deps
  • d7a682e0
    fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

    used only during dev, and caused a considerable dep count jump downstream

  • 5b8720ec
    use latest shared eslint-config (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-11.

v21.1.1

Compare Source

  • 3c8b023b
    Update deps (Carl-Erik Kopseng)
  • 2eabf5da
    fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)
    • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports

Released by Carl-Erik Kopseng on 2026-04-10.

v21.1.0

Compare Source

  • 0a5526c5
    updated deps (Carl-Erik Kopseng)
  • 5262204f
    fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
  • 819bb64b
    Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

    This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib

    • Modern ignores 😁
    • test: add distribution harness
    • test: verify packed cjs and esm entrypoints
    • test: lock distribution api manifest
    • test: smoke test built pkg artifacts
    • docs: require contract tests for package migration
    • test: guard esm migration regressions
    • docs: require contract gate for esm migration
    • build: generate cjs lib from esm source entries
    • refactor: port root api surface to esm
    • build: clean port of root api to esm
    • docs: include implementation plans
    • fix: align lint and smoke tests with esm migration
    • refactor: complete esm port of all core components
    • refactor: finalize esm migration with sandbox and naming fixes
    • fix: finish esm migration stabilization
    • chore: stop tracking generated lib output
    • remove plans
    • prettier
    • linting
    • fix: make distribution tests self-contained
    • fix: build before coverage test bundle
    • refactor: move simple unit tests to src
    • refactor: flatten test and coverage script chains
    • refactor: use parallel mocha for node tests
    • test: restore fake timers cleanup
    • refactor: remove node test runner script
    • remove unneccessary clutter
    • fix: make mocha watch use polling
    • simplify
    • Increase coverage
    • Fix coverage by removing duplicated tests

    These were covering the generated lib/ folder.

    • Move shared util into esm dir
    • fix package dep issues
    • Adjust coverage
    • Upgrade all dependencies

    npx npm-check-updates -u

  • cd2bf5a3
    Use newer endpoint (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-09.

v21.0.3

Compare Source

  • 0494251b
    fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-16.

v21.0.2

Compare Source

  • 024321c4
    fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
  • b836fccb
    fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
  • ebf0c431
    docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)
    • docs: add how-to article for stubbing ES module imports with esm package

    Adds a comprehensive How-To guide that addresses issue #​1832, documenting
    how to configure Node.js to allow Sinon stubs to work with ES modules.

    • Explains why ES module namespace bindings are immutable by spec
    • Shows how to use the 'esm' npm package with mutableNamespace: true
    • Provides a complete working example with project layout, package.json,
      loader file, source modules, and a full test suite
    • Documents limitations (destructured imports, non-standard behavior)
    • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference

    Closes #​1832
    Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
    Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

  • ebcd506c
    Fix spies not being reset properly (#​2673) (simon-id)
  • 3beab2ba
    Make doc tests pass with new jQuery (Carl-Erik Kopseng)
  • 766715c6
    build: reduce transitive audit findings (Carl-Erik Kopseng)
  • 92aaf5c9
    build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
  • c6aaa871
    chore: ignore project worktrees (Carl-Erik Kopseng)
  • ef387e8e
    Upgrade most deps (Carl-Erik Kopseng)
  • 3cf4e77d
    docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
  • 6349032f
    Check login status before publishing steps are performed (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-04.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security

socket-securityBot commented May 9, 2026•
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedsinon@​21.0.1 ⏵ 22.1.0100+110098+193+4100

View full report

@renovate
renovateBotforce-pushed the renovate/sinon-22.x branch from 5be5e55 to 92e1c35CompareJuly 23, 2026 18:46
@renovate
renovateBotforce-pushed the renovate/sinon-22.x branch from 92e1c35 to fc526ecCompareAugust 3, 2026 14:14
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approverenovate-approve[bot]renovate-approve[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(deps): update dependency sinon to v22 - #537
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Open
chore(deps): update dependency sinon to v22#537
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Conversation
@renovate
@renovaterenovateBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
sinon (source)21.0.1 → 22.1.0ageconfidence
Release Notes
sinonjs/sinon (sinon)
v22.1.0
Compare Source
  • d36e921b
    
fix: let returns override returnsArg (王胜)

    Signed-off-by: 王胜 <2318857637@​qq.com>
  • 40c4caa0
    
fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

    restoreObject was made idempotent in #​2737 — it no longer throws
    
for objects with no restorable methods. Updates the docs page
    
and its corresponding test to reflect this.
  • a68dac19
    
fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

    • fix: throw a clear error when throwArg index equals the argument count
    spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
    
with pos equal to the number of recorded arguments slipped past the guard
    
and reached throw this.args[pos], throwing undefined instead of the
    
intended TypeError. A thrown undefined cannot be inspected as an Error and
    
is reported by test frameworks as no exception thrown.
    Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
    
which already reject an out-of-range index with a clear error.
  • 9ea504e3
    
feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

    Passing an object with no live fakes to restoreObject now restores
    
nothing instead of throwing, giving it symmetry with sinon.restore()
    
and sandbox.restore(). The strict "found no methods" check is retained
    
for spy(object) and stub(object), which now use a dedicated
    
walkObjectStrict export, while restoreObject uses the loose walkObject.
    
Passing a falsy value still throws.
    Fixes #​2736
  • 4db4feff
    
fix: preserve fake undefined argument validation (Vishal Kumar Singh)
  • 755a40d7
    
fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

    The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
    
and calledImmediatelyAfter to fail when tests run in parallel with separate
    
sandboxes. Each sandbox now maintains its own callId counter, passed through
    
the spy/stub/fake creation chain via a context object.
    Fixes #​2472
Released by Morgan Roderick on 2026-07-20.
v22.0.0
Compare Source
  • ed911df5
    
Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8
    
Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608
    
Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b
    
Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6
    
Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8
    
Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)

    • refactor: global mutable call id can grow unbounded across l
    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.
    Affected files: proxy-invoke.js
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    • Wrap around for all values that are too high
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • f4f7d93b
    
Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
  • 6199e9e4
    
improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

    • fix(workflows): fetch-depth is for actions/checkout
    • chore(workflows): update
    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59
    
Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393
    
fix: make build and node test scripts cross-platform (laplace young)
  • a7692917
    
fix: isolate walk state from Object prototype (laplace young)
  • 66df977a
    
Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

    The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:
    createSandbox: function createSandbox(config) {
const s = createConfiguredSandbox(config);
sandbox.getFakes().push(s);
return s;
}

    Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
    verifyAndRestore. This is the regression reported in #​2701.
    Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.
    Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
    
end.
    Closes #​2701
  • f0bd6e1b
    
fix: exclude proto from walk() (#​2699) (Kevin Locke)

    __proto__ is a special property to access an object's prototype. It
    
has many pitfalls:
    • Setting it to an object value changes an object's prototype, which is
      
generally discouraged and may be unexpected by the iterator callback.
    • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
    • When Node.js is run with the --disable-proto=throw option, getting
      
or setting __proto__ causes an exception with code
      ERR_PROTO_ACCESS to be thrown.
    Additionally, since this property (and all properties of
    Object.prototype) are currently unused in this project by consumers of
    walk(), it is both safe and preferable to exclude.
    Fixes: #​2695
    Signed-off-by: Kevin Locke kevin@kevinlocke.name
  • 1f8afd50
    
chore: add context7.json for ownership confirmation (Morgan Roderick)
Released by Carl-Erik Kopseng on 2026-05-05.
v21.1.2
Compare Source
  • 53817f7d
    
Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)

    • Upgrade to ESLint 10 and new shared config
    • Update deps
  • d7a682e0
    
fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

    used only during dev, and caused a considerable dep count jump downstream
  • 5b8720ec
    
use latest shared eslint-config (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-11.
v21.1.1
Compare Source
  • 3c8b023b
    
Update deps (Carl-Erik Kopseng)
  • 2eabf5da
    
fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)

    • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports
Released by Carl-Erik Kopseng on 2026-04-10.
v21.1.0
Compare Source
  • 0a5526c5
    
updated deps (Carl-Erik Kopseng)
  • 5262204f
    
fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
  • 819bb64b
    
Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

    This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib
    • Modern ignores 😁
    • test: add distribution harness
    • test: verify packed cjs and esm entrypoints
    • test: lock distribution api manifest
    • test: smoke test built pkg artifacts
    • docs: require contract tests for package migration
    • test: guard esm migration regressions
    • docs: require contract gate for esm migration
    • build: generate cjs lib from esm source entries
    • refactor: port root api surface to esm
    • build: clean port of root api to esm
    • docs: include implementation plans
    • fix: align lint and smoke tests with esm migration
    • refactor: complete esm port of all core components
    • refactor: finalize esm migration with sandbox and naming fixes
    • fix: finish esm migration stabilization
    • chore: stop tracking generated lib output
    • remove plans
    • prettier
    • linting
    • fix: make distribution tests self-contained
    • fix: build before coverage test bundle
    • refactor: move simple unit tests to src
    • refactor: flatten test and coverage script chains
    • refactor: use parallel mocha for node tests
    • test: restore fake timers cleanup
    • refactor: remove node test runner script
    • remove unneccessary clutter
    • fix: make mocha watch use polling
    • simplify
    • Increase coverage
    • Fix coverage by removing duplicated tests
    These were covering the generated lib/ folder.
    • Move shared util into esm dir
    • fix package dep issues
    • Adjust coverage
    • Upgrade all dependencies
    npx npm-check-updates -u
  • cd2bf5a3
    
Use newer endpoint (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-09.
v21.0.3
Compare Source
  • 0494251b
    
fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-16.
v21.0.2
Compare Source
  • 024321c4
    
fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
  • b836fccb
    
fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
  • ebf0c431
    
docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)

    • docs: add how-to article for stubbing ES module imports with esm package
    Adds a comprehensive How-To guide that addresses issue #​1832, documenting
    
how to configure Node.js to allow Sinon stubs to work with ES modules.
    • Explains why ES module namespace bindings are immutable by spec
    • Shows how to use the 'esm' npm package with mutableNamespace: true
    • Provides a complete working example with project layout, package.json,
      
loader file, source modules, and a full test suite
    • Documents limitations (destructured imports, non-standard behavior)
    • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference
    Closes #​1832
    
Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • ebcd506c
    
Fix spies not being reset properly (#​2673) (simon-id)
  • 3beab2ba
    
Make doc tests pass with new jQuery (Carl-Erik Kopseng)
  • 766715c6
    
build: reduce transitive audit findings (Carl-Erik Kopseng)
  • 92aaf5c9
    
build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
  • c6aaa871
    
chore: ignore project worktrees (Carl-Erik Kopseng)
  • ef387e8e
    
Upgrade most deps (Carl-Erik Kopseng)
  • 3cf4e77d
    
docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
  • 6349032f
    
Check login status before publishing steps are performed (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-04.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@socket-security
socket-securityBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedsinon@​21.0.1 ⏵ 22.1.0100+110098+193+4100
View full report
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
5be5e55 to
92e1c35CompareJuly 23, 2026 18:46
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
92e1c35 to
fc526ecCompareAugust 3, 2026 14:14
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@renovate-approverenovate-approve[bot]renovate-approve[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency sinon to v22 - #537
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Open
chore(deps): update dependency sinon to v22#537
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Conversation
@renovate
@renovaterenovateBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
sinon (source)21.0.1 → 22.1.0ageconfidence
Release Notes
sinonjs/sinon (sinon)
v22.1.0
Compare Source
  • d36e921b
    
fix: let returns override returnsArg (王胜)

    Signed-off-by: 王胜 <2318857637@​qq.com>
  • 40c4caa0
    
fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

    restoreObject was made idempotent in #​2737 — it no longer throws
    
for objects with no restorable methods. Updates the docs page
    
and its corresponding test to reflect this.
  • a68dac19
    
fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

    • fix: throw a clear error when throwArg index equals the argument count
    spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
    
with pos equal to the number of recorded arguments slipped past the guard
    
and reached throw this.args[pos], throwing undefined instead of the
    
intended TypeError. A thrown undefined cannot be inspected as an Error and
    
is reported by test frameworks as no exception thrown.
    Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
    
which already reject an out-of-range index with a clear error.
  • 9ea504e3
    
feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

    Passing an object with no live fakes to restoreObject now restores
    
nothing instead of throwing, giving it symmetry with sinon.restore()
    
and sandbox.restore(). The strict "found no methods" check is retained
    
for spy(object) and stub(object), which now use a dedicated
    
walkObjectStrict export, while restoreObject uses the loose walkObject.
    
Passing a falsy value still throws.
    Fixes #​2736
  • 4db4feff
    
fix: preserve fake undefined argument validation (Vishal Kumar Singh)
  • 755a40d7
    
fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

    The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
    
and calledImmediatelyAfter to fail when tests run in parallel with separate
    
sandboxes. Each sandbox now maintains its own callId counter, passed through
    
the spy/stub/fake creation chain via a context object.
    Fixes #​2472
Released by Morgan Roderick on 2026-07-20.
v22.0.0
Compare Source
  • ed911df5
    
Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8
    
Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608
    
Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b
    
Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6
    
Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8
    
Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)

    • refactor: global mutable call id can grow unbounded across l
    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.
    Affected files: proxy-invoke.js
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    • Wrap around for all values that are too high
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • f4f7d93b
    
Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
  • 6199e9e4
    
improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

    • fix(workflows): fetch-depth is for actions/checkout
    • chore(workflows): update
    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59
    
Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393
    
fix: make build and node test scripts cross-platform (laplace young)
  • a7692917
    
fix: isolate walk state from Object prototype (laplace young)
  • 66df977a
    
Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

    The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:
    createSandbox: function createSandbox(config) {
const s = createConfiguredSandbox(config);
sandbox.getFakes().push(s);
return s;
}

    Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
    verifyAndRestore. This is the regression reported in #​2701.
    Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.
    Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
    
end.
    Closes #​2701
  • f0bd6e1b
    
fix: exclude proto from walk() (#​2699) (Kevin Locke)

    __proto__ is a special property to access an object's prototype. It
    
has many pitfalls:
    • Setting it to an object value changes an object's prototype, which is
      
generally discouraged and may be unexpected by the iterator callback.
    • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
    • When Node.js is run with the --disable-proto=throw option, getting
      
or setting __proto__ causes an exception with code
      ERR_PROTO_ACCESS to be thrown.
    Additionally, since this property (and all properties of
    Object.prototype) are currently unused in this project by consumers of
    walk(), it is both safe and preferable to exclude.
    Fixes: #​2695
    Signed-off-by: Kevin Locke kevin@kevinlocke.name
  • 1f8afd50
    
chore: add context7.json for ownership confirmation (Morgan Roderick)
Released by Carl-Erik Kopseng on 2026-05-05.
v21.1.2
Compare Source
  • 53817f7d
    
Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)

    • Upgrade to ESLint 10 and new shared config
    • Update deps
  • d7a682e0
    
fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

    used only during dev, and caused a considerable dep count jump downstream
  • 5b8720ec
    
use latest shared eslint-config (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-11.
v21.1.1
Compare Source
  • 3c8b023b
    
Update deps (Carl-Erik Kopseng)
  • 2eabf5da
    
fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)

    • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports
Released by Carl-Erik Kopseng on 2026-04-10.
v21.1.0
Compare Source
  • 0a5526c5
    
updated deps (Carl-Erik Kopseng)
  • 5262204f
    
fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
  • 819bb64b
    
Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

    This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib
    • Modern ignores 😁
    • test: add distribution harness
    • test: verify packed cjs and esm entrypoints
    • test: lock distribution api manifest
    • test: smoke test built pkg artifacts
    • docs: require contract tests for package migration
    • test: guard esm migration regressions
    • docs: require contract gate for esm migration
    • build: generate cjs lib from esm source entries
    • refactor: port root api surface to esm
    • build: clean port of root api to esm
    • docs: include implementation plans
    • fix: align lint and smoke tests with esm migration
    • refactor: complete esm port of all core components
    • refactor: finalize esm migration with sandbox and naming fixes
    • fix: finish esm migration stabilization
    • chore: stop tracking generated lib output
    • remove plans
    • prettier
    • linting
    • fix: make distribution tests self-contained
    • fix: build before coverage test bundle
    • refactor: move simple unit tests to src
    • refactor: flatten test and coverage script chains
    • refactor: use parallel mocha for node tests
    • test: restore fake timers cleanup
    • refactor: remove node test runner script
    • remove unneccessary clutter
    • fix: make mocha watch use polling
    • simplify
    • Increase coverage
    • Fix coverage by removing duplicated tests
    These were covering the generated lib/ folder.
    • Move shared util into esm dir
    • fix package dep issues
    • Adjust coverage
    • Upgrade all dependencies
    npx npm-check-updates -u
  • cd2bf5a3
    
Use newer endpoint (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-09.
v21.0.3
Compare Source
  • 0494251b
    
fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-16.
v21.0.2
Compare Source
  • 024321c4
    
fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
  • b836fccb
    
fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
  • ebf0c431
    
docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)

    • docs: add how-to article for stubbing ES module imports with esm package
    Adds a comprehensive How-To guide that addresses issue #​1832, documenting
    
how to configure Node.js to allow Sinon stubs to work with ES modules.
    • Explains why ES module namespace bindings are immutable by spec
    • Shows how to use the 'esm' npm package with mutableNamespace: true
    • Provides a complete working example with project layout, package.json,
      
loader file, source modules, and a full test suite
    • Documents limitations (destructured imports, non-standard behavior)
    • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference
    Closes #​1832
    
Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • ebcd506c
    
Fix spies not being reset properly (#​2673) (simon-id)
  • 3beab2ba
    
Make doc tests pass with new jQuery (Carl-Erik Kopseng)
  • 766715c6
    
build: reduce transitive audit findings (Carl-Erik Kopseng)
  • 92aaf5c9
    
build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
  • c6aaa871
    
chore: ignore project worktrees (Carl-Erik Kopseng)
  • ef387e8e
    
Upgrade most deps (Carl-Erik Kopseng)
  • 3cf4e77d
    
docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
  • 6349032f
    
Check login status before publishing steps are performed (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-04.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@socket-security
socket-securityBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedsinon@​21.0.1 ⏵ 22.1.0100+110098+193+4100
View full report
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
5be5e55 to
92e1c35CompareJuly 23, 2026 18:46
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
92e1c35 to
fc526ecCompareAugust 3, 2026 14:14
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@renovate-approverenovate-approve[bot]renovate-approve[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency sinon to v22 - #537
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Open
chore(deps): update dependency sinon to v22#537
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Conversation
@renovate
@renovaterenovateBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
sinon (source)21.0.1 → 22.1.0ageconfidence
Release Notes
sinonjs/sinon (sinon)
v22.1.0
Compare Source
  • d36e921b
    
fix: let returns override returnsArg (王胜)

    Signed-off-by: 王胜 <2318857637@​qq.com>
  • 40c4caa0
    
fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

    restoreObject was made idempotent in #​2737 — it no longer throws
    
for objects with no restorable methods. Updates the docs page
    
and its corresponding test to reflect this.
  • a68dac19
    
fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

    • fix: throw a clear error when throwArg index equals the argument count
    spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
    
with pos equal to the number of recorded arguments slipped past the guard
    
and reached throw this.args[pos], throwing undefined instead of the
    
intended TypeError. A thrown undefined cannot be inspected as an Error and
    
is reported by test frameworks as no exception thrown.
    Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
    
which already reject an out-of-range index with a clear error.
  • 9ea504e3
    
feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

    Passing an object with no live fakes to restoreObject now restores
    
nothing instead of throwing, giving it symmetry with sinon.restore()
    
and sandbox.restore(). The strict "found no methods" check is retained
    
for spy(object) and stub(object), which now use a dedicated
    
walkObjectStrict export, while restoreObject uses the loose walkObject.
    
Passing a falsy value still throws.
    Fixes #​2736
  • 4db4feff
    
fix: preserve fake undefined argument validation (Vishal Kumar Singh)
  • 755a40d7
    
fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

    The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
    
and calledImmediatelyAfter to fail when tests run in parallel with separate
    
sandboxes. Each sandbox now maintains its own callId counter, passed through
    
the spy/stub/fake creation chain via a context object.
    Fixes #​2472
Released by Morgan Roderick on 2026-07-20.
v22.0.0
Compare Source
  • ed911df5
    
Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8
    
Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608
    
Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b
    
Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6
    
Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8
    
Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)

    • refactor: global mutable call id can grow unbounded across l
    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.
    Affected files: proxy-invoke.js
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    • Wrap around for all values that are too high
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • f4f7d93b
    
Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
  • 6199e9e4
    
improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

    • fix(workflows): fetch-depth is for actions/checkout
    • chore(workflows): update
    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59
    
Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393
    
fix: make build and node test scripts cross-platform (laplace young)
  • a7692917
    
fix: isolate walk state from Object prototype (laplace young)
  • 66df977a
    
Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

    The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:
    createSandbox: function createSandbox(config) {
const s = createConfiguredSandbox(config);
sandbox.getFakes().push(s);
return s;
}

    Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
    verifyAndRestore. This is the regression reported in #​2701.
    Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.
    Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
    
end.
    Closes #​2701
  • f0bd6e1b
    
fix: exclude proto from walk() (#​2699) (Kevin Locke)

    __proto__ is a special property to access an object's prototype. It
    
has many pitfalls:
    • Setting it to an object value changes an object's prototype, which is
      
generally discouraged and may be unexpected by the iterator callback.
    • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
    • When Node.js is run with the --disable-proto=throw option, getting
      
or setting __proto__ causes an exception with code
      ERR_PROTO_ACCESS to be thrown.
    Additionally, since this property (and all properties of
    Object.prototype) are currently unused in this project by consumers of
    walk(), it is both safe and preferable to exclude.
    Fixes: #​2695
    Signed-off-by: Kevin Locke kevin@kevinlocke.name
  • 1f8afd50
    
chore: add context7.json for ownership confirmation (Morgan Roderick)
Released by Carl-Erik Kopseng on 2026-05-05.
v21.1.2
Compare Source
  • 53817f7d
    
Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)

    • Upgrade to ESLint 10 and new shared config
    • Update deps
  • d7a682e0
    
fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

    used only during dev, and caused a considerable dep count jump downstream
  • 5b8720ec
    
use latest shared eslint-config (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-11.
v21.1.1
Compare Source
  • 3c8b023b
    
Update deps (Carl-Erik Kopseng)
  • 2eabf5da
    
fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)

    • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports
Released by Carl-Erik Kopseng on 2026-04-10.
v21.1.0
Compare Source
  • 0a5526c5
    
updated deps (Carl-Erik Kopseng)
  • 5262204f
    
fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
  • 819bb64b
    
Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

    This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib
    • Modern ignores 😁
    • test: add distribution harness
    • test: verify packed cjs and esm entrypoints
    • test: lock distribution api manifest
    • test: smoke test built pkg artifacts
    • docs: require contract tests for package migration
    • test: guard esm migration regressions
    • docs: require contract gate for esm migration
    • build: generate cjs lib from esm source entries
    • refactor: port root api surface to esm
    • build: clean port of root api to esm
    • docs: include implementation plans
    • fix: align lint and smoke tests with esm migration
    • refactor: complete esm port of all core components
    • refactor: finalize esm migration with sandbox and naming fixes
    • fix: finish esm migration stabilization
    • chore: stop tracking generated lib output
    • remove plans
    • prettier
    • linting
    • fix: make distribution tests self-contained
    • fix: build before coverage test bundle
    • refactor: move simple unit tests to src
    • refactor: flatten test and coverage script chains
    • refactor: use parallel mocha for node tests
    • test: restore fake timers cleanup
    • refactor: remove node test runner script
    • remove unneccessary clutter
    • fix: make mocha watch use polling
    • simplify
    • Increase coverage
    • Fix coverage by removing duplicated tests
    These were covering the generated lib/ folder.
    • Move shared util into esm dir
    • fix package dep issues
    • Adjust coverage
    • Upgrade all dependencies
    npx npm-check-updates -u
  • cd2bf5a3
    
Use newer endpoint (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-09.
v21.0.3
Compare Source
  • 0494251b
    
fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-16.
v21.0.2
Compare Source
  • 024321c4
    
fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
  • b836fccb
    
fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
  • ebf0c431
    
docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)

    • docs: add how-to article for stubbing ES module imports with esm package
    Adds a comprehensive How-To guide that addresses issue #​1832, documenting
    
how to configure Node.js to allow Sinon stubs to work with ES modules.
    • Explains why ES module namespace bindings are immutable by spec
    • Shows how to use the 'esm' npm package with mutableNamespace: true
    • Provides a complete working example with project layout, package.json,
      
loader file, source modules, and a full test suite
    • Documents limitations (destructured imports, non-standard behavior)
    • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference
    Closes #​1832
    
Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • ebcd506c
    
Fix spies not being reset properly (#​2673) (simon-id)
  • 3beab2ba
    
Make doc tests pass with new jQuery (Carl-Erik Kopseng)
  • 766715c6
    
build: reduce transitive audit findings (Carl-Erik Kopseng)
  • 92aaf5c9
    
build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
  • c6aaa871
    
chore: ignore project worktrees (Carl-Erik Kopseng)
  • ef387e8e
    
Upgrade most deps (Carl-Erik Kopseng)
  • 3cf4e77d
    
docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
  • 6349032f
    
Check login status before publishing steps are performed (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-04.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@socket-security
socket-securityBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedsinon@​21.0.1 ⏵ 22.1.0100+110098+193+4100
View full report
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
5be5e55 to
92e1c35CompareJuly 23, 2026 18:46
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
92e1c35 to
fc526ecCompareAugust 3, 2026 14:14
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@renovate-approverenovate-approve[bot]renovate-approve[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(deps): update dependency sinon to v22 - #537
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Open
chore(deps): update dependency sinon to v22#537
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Conversation
@renovate
@renovaterenovateBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
sinon (source)21.0.1 → 22.1.0ageconfidence
Release Notes
sinonjs/sinon (sinon)
v22.1.0
Compare Source
  • d36e921b
    
fix: let returns override returnsArg (王胜)

    Signed-off-by: 王胜 <2318857637@​qq.com>
  • 40c4caa0
    
fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

    restoreObject was made idempotent in #​2737 — it no longer throws
    
for objects with no restorable methods. Updates the docs page
    
and its corresponding test to reflect this.
  • a68dac19
    
fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

    • fix: throw a clear error when throwArg index equals the argument count
    spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
    
with pos equal to the number of recorded arguments slipped past the guard
    
and reached throw this.args[pos], throwing undefined instead of the
    
intended TypeError. A thrown undefined cannot be inspected as an Error and
    
is reported by test frameworks as no exception thrown.
    Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
    
which already reject an out-of-range index with a clear error.
  • 9ea504e3
    
feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

    Passing an object with no live fakes to restoreObject now restores
    
nothing instead of throwing, giving it symmetry with sinon.restore()
    
and sandbox.restore(). The strict "found no methods" check is retained
    
for spy(object) and stub(object), which now use a dedicated
    
walkObjectStrict export, while restoreObject uses the loose walkObject.
    
Passing a falsy value still throws.
    Fixes #​2736
  • 4db4feff
    
fix: preserve fake undefined argument validation (Vishal Kumar Singh)
  • 755a40d7
    
fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

    The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
    
and calledImmediatelyAfter to fail when tests run in parallel with separate
    
sandboxes. Each sandbox now maintains its own callId counter, passed through
    
the spy/stub/fake creation chain via a context object.
    Fixes #​2472
Released by Morgan Roderick on 2026-07-20.
v22.0.0
Compare Source
  • ed911df5
    
Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8
    
Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608
    
Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b
    
Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6
    
Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8
    
Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)

    • refactor: global mutable call id can grow unbounded across l
    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.
    Affected files: proxy-invoke.js
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    • Wrap around for all values that are too high
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • f4f7d93b
    
Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
  • 6199e9e4
    
improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

    • fix(workflows): fetch-depth is for actions/checkout
    • chore(workflows): update
    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59
    
Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393
    
fix: make build and node test scripts cross-platform (laplace young)
  • a7692917
    
fix: isolate walk state from Object prototype (laplace young)
  • 66df977a
    
Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

    The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:
    createSandbox: function createSandbox(config) {
const s = createConfiguredSandbox(config);
sandbox.getFakes().push(s);
return s;
}

    Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
    verifyAndRestore. This is the regression reported in #​2701.
    Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.
    Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
    
end.
    Closes #​2701
  • f0bd6e1b
    
fix: exclude proto from walk() (#​2699) (Kevin Locke)

    __proto__ is a special property to access an object's prototype. It
    
has many pitfalls:
    • Setting it to an object value changes an object's prototype, which is
      
generally discouraged and may be unexpected by the iterator callback.
    • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
    • When Node.js is run with the --disable-proto=throw option, getting
      
or setting __proto__ causes an exception with code
      ERR_PROTO_ACCESS to be thrown.
    Additionally, since this property (and all properties of
    Object.prototype) are currently unused in this project by consumers of
    walk(), it is both safe and preferable to exclude.
    Fixes: #​2695
    Signed-off-by: Kevin Locke kevin@kevinlocke.name
  • 1f8afd50
    
chore: add context7.json for ownership confirmation (Morgan Roderick)
Released by Carl-Erik Kopseng on 2026-05-05.
v21.1.2
Compare Source
  • 53817f7d
    
Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)

    • Upgrade to ESLint 10 and new shared config
    • Update deps
  • d7a682e0
    
fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

    used only during dev, and caused a considerable dep count jump downstream
  • 5b8720ec
    
use latest shared eslint-config (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-11.
v21.1.1
Compare Source
  • 3c8b023b
    
Update deps (Carl-Erik Kopseng)
  • 2eabf5da
    
fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)

    • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports
Released by Carl-Erik Kopseng on 2026-04-10.
v21.1.0
Compare Source
  • 0a5526c5
    
updated deps (Carl-Erik Kopseng)
  • 5262204f
    
fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
  • 819bb64b
    
Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

    This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib
    • Modern ignores 😁
    • test: add distribution harness
    • test: verify packed cjs and esm entrypoints
    • test: lock distribution api manifest
    • test: smoke test built pkg artifacts
    • docs: require contract tests for package migration
    • test: guard esm migration regressions
    • docs: require contract gate for esm migration
    • build: generate cjs lib from esm source entries
    • refactor: port root api surface to esm
    • build: clean port of root api to esm
    • docs: include implementation plans
    • fix: align lint and smoke tests with esm migration
    • refactor: complete esm port of all core components
    • refactor: finalize esm migration with sandbox and naming fixes
    • fix: finish esm migration stabilization
    • chore: stop tracking generated lib output
    • remove plans
    • prettier
    • linting
    • fix: make distribution tests self-contained
    • fix: build before coverage test bundle
    • refactor: move simple unit tests to src
    • refactor: flatten test and coverage script chains
    • refactor: use parallel mocha for node tests
    • test: restore fake timers cleanup
    • refactor: remove node test runner script
    • remove unneccessary clutter
    • fix: make mocha watch use polling
    • simplify
    • Increase coverage
    • Fix coverage by removing duplicated tests
    These were covering the generated lib/ folder.
    • Move shared util into esm dir
    • fix package dep issues
    • Adjust coverage
    • Upgrade all dependencies
    npx npm-check-updates -u
  • cd2bf5a3
    
Use newer endpoint (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-09.
v21.0.3
Compare Source
  • 0494251b
    
fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-16.
v21.0.2
Compare Source
  • 024321c4
    
fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
  • b836fccb
    
fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
  • ebf0c431
    
docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)

    • docs: add how-to article for stubbing ES module imports with esm package
    Adds a comprehensive How-To guide that addresses issue #​1832, documenting
    
how to configure Node.js to allow Sinon stubs to work with ES modules.
    • Explains why ES module namespace bindings are immutable by spec
    • Shows how to use the 'esm' npm package with mutableNamespace: true
    • Provides a complete working example with project layout, package.json,
      
loader file, source modules, and a full test suite
    • Documents limitations (destructured imports, non-standard behavior)
    • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference
    Closes #​1832
    
Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • ebcd506c
    
Fix spies not being reset properly (#​2673) (simon-id)
  • 3beab2ba
    
Make doc tests pass with new jQuery (Carl-Erik Kopseng)
  • 766715c6
    
build: reduce transitive audit findings (Carl-Erik Kopseng)
  • 92aaf5c9
    
build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
  • c6aaa871
    
chore: ignore project worktrees (Carl-Erik Kopseng)
  • ef387e8e
    
Upgrade most deps (Carl-Erik Kopseng)
  • 3cf4e77d
    
docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
  • 6349032f
    
Check login status before publishing steps are performed (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-04.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@socket-security
socket-securityBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedsinon@​21.0.1 ⏵ 22.1.0100+110098+193+4100
View full report
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
5be5e55 to
92e1c35CompareJuly 23, 2026 18:46
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
92e1c35 to
fc526ecCompareAugust 3, 2026 14:14
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@renovate-approverenovate-approve[bot]renovate-approve[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency sinon to v22 - #537
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Open
chore(deps): update dependency sinon to v22#537
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Conversation
@renovate
@renovaterenovateBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
sinon (source)21.0.1 → 22.1.0ageconfidence
Release Notes
sinonjs/sinon (sinon)
v22.1.0
Compare Source
  • d36e921b
    
fix: let returns override returnsArg (王胜)

    Signed-off-by: 王胜 <2318857637@​qq.com>
  • 40c4caa0
    
fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

    restoreObject was made idempotent in #​2737 — it no longer throws
    
for objects with no restorable methods. Updates the docs page
    
and its corresponding test to reflect this.
  • a68dac19
    
fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

    • fix: throw a clear error when throwArg index equals the argument count
    spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
    
with pos equal to the number of recorded arguments slipped past the guard
    
and reached throw this.args[pos], throwing undefined instead of the
    
intended TypeError. A thrown undefined cannot be inspected as an Error and
    
is reported by test frameworks as no exception thrown.
    Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
    
which already reject an out-of-range index with a clear error.
  • 9ea504e3
    
feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

    Passing an object with no live fakes to restoreObject now restores
    
nothing instead of throwing, giving it symmetry with sinon.restore()
    
and sandbox.restore(). The strict "found no methods" check is retained
    
for spy(object) and stub(object), which now use a dedicated
    
walkObjectStrict export, while restoreObject uses the loose walkObject.
    
Passing a falsy value still throws.
    Fixes #​2736
  • 4db4feff
    
fix: preserve fake undefined argument validation (Vishal Kumar Singh)
  • 755a40d7
    
fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

    The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
    
and calledImmediatelyAfter to fail when tests run in parallel with separate
    
sandboxes. Each sandbox now maintains its own callId counter, passed through
    
the spy/stub/fake creation chain via a context object.
    Fixes #​2472
Released by Morgan Roderick on 2026-07-20.
v22.0.0
Compare Source
  • ed911df5
    
Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8
    
Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608
    
Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b
    
Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6
    
Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8
    
Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)

    • refactor: global mutable call id can grow unbounded across l
    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.
    Affected files: proxy-invoke.js
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    • Wrap around for all values that are too high
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • f4f7d93b
    
Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
  • 6199e9e4
    
improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

    • fix(workflows): fetch-depth is for actions/checkout
    • chore(workflows): update
    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59
    
Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393
    
fix: make build and node test scripts cross-platform (laplace young)
  • a7692917
    
fix: isolate walk state from Object prototype (laplace young)
  • 66df977a
    
Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

    The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:
    createSandbox: function createSandbox(config) {
const s = createConfiguredSandbox(config);
sandbox.getFakes().push(s);
return s;
}

    Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
    verifyAndRestore. This is the regression reported in #​2701.
    Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.
    Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
    
end.
    Closes #​2701
  • f0bd6e1b
    
fix: exclude proto from walk() (#​2699) (Kevin Locke)

    __proto__ is a special property to access an object's prototype. It
    
has many pitfalls:
    • Setting it to an object value changes an object's prototype, which is
      
generally discouraged and may be unexpected by the iterator callback.
    • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
    • When Node.js is run with the --disable-proto=throw option, getting
      
or setting __proto__ causes an exception with code
      ERR_PROTO_ACCESS to be thrown.
    Additionally, since this property (and all properties of
    Object.prototype) are currently unused in this project by consumers of
    walk(), it is both safe and preferable to exclude.
    Fixes: #​2695
    Signed-off-by: Kevin Locke kevin@kevinlocke.name
  • 1f8afd50
    
chore: add context7.json for ownership confirmation (Morgan Roderick)
Released by Carl-Erik Kopseng on 2026-05-05.
v21.1.2
Compare Source
  • 53817f7d
    
Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)

    • Upgrade to ESLint 10 and new shared config
    • Update deps
  • d7a682e0
    
fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

    used only during dev, and caused a considerable dep count jump downstream
  • 5b8720ec
    
use latest shared eslint-config (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-11.
v21.1.1
Compare Source
  • 3c8b023b
    
Update deps (Carl-Erik Kopseng)
  • 2eabf5da
    
fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)

    • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports
Released by Carl-Erik Kopseng on 2026-04-10.
v21.1.0
Compare Source
  • 0a5526c5
    
updated deps (Carl-Erik Kopseng)
  • 5262204f
    
fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
  • 819bb64b
    
Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

    This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib
    • Modern ignores 😁
    • test: add distribution harness
    • test: verify packed cjs and esm entrypoints
    • test: lock distribution api manifest
    • test: smoke test built pkg artifacts
    • docs: require contract tests for package migration
    • test: guard esm migration regressions
    • docs: require contract gate for esm migration
    • build: generate cjs lib from esm source entries
    • refactor: port root api surface to esm
    • build: clean port of root api to esm
    • docs: include implementation plans
    • fix: align lint and smoke tests with esm migration
    • refactor: complete esm port of all core components
    • refactor: finalize esm migration with sandbox and naming fixes
    • fix: finish esm migration stabilization
    • chore: stop tracking generated lib output
    • remove plans
    • prettier
    • linting
    • fix: make distribution tests self-contained
    • fix: build before coverage test bundle
    • refactor: move simple unit tests to src
    • refactor: flatten test and coverage script chains
    • refactor: use parallel mocha for node tests
    • test: restore fake timers cleanup
    • refactor: remove node test runner script
    • remove unneccessary clutter
    • fix: make mocha watch use polling
    • simplify
    • Increase coverage
    • Fix coverage by removing duplicated tests
    These were covering the generated lib/ folder.
    • Move shared util into esm dir
    • fix package dep issues
    • Adjust coverage
    • Upgrade all dependencies
    npx npm-check-updates -u
  • cd2bf5a3
    
Use newer endpoint (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-09.
v21.0.3
Compare Source
  • 0494251b
    
fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-16.
v21.0.2
Compare Source
  • 024321c4
    
fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
  • b836fccb
    
fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
  • ebf0c431
    
docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)

    • docs: add how-to article for stubbing ES module imports with esm package
    Adds a comprehensive How-To guide that addresses issue #​1832, documenting
    
how to configure Node.js to allow Sinon stubs to work with ES modules.
    • Explains why ES module namespace bindings are immutable by spec
    • Shows how to use the 'esm' npm package with mutableNamespace: true
    • Provides a complete working example with project layout, package.json,
      
loader file, source modules, and a full test suite
    • Documents limitations (destructured imports, non-standard behavior)
    • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference
    Closes #​1832
    
Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • ebcd506c
    
Fix spies not being reset properly (#​2673) (simon-id)
  • 3beab2ba
    
Make doc tests pass with new jQuery (Carl-Erik Kopseng)
  • 766715c6
    
build: reduce transitive audit findings (Carl-Erik Kopseng)
  • 92aaf5c9
    
build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
  • c6aaa871
    
chore: ignore project worktrees (Carl-Erik Kopseng)
  • ef387e8e
    
Upgrade most deps (Carl-Erik Kopseng)
  • 3cf4e77d
    
docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
  • 6349032f
    
Check login status before publishing steps are performed (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-04.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@socket-security
socket-securityBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedsinon@​21.0.1 ⏵ 22.1.0100+110098+193+4100
View full report
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
5be5e55 to
92e1c35CompareJuly 23, 2026 18:46
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
92e1c35 to
fc526ecCompareAugust 3, 2026 14:14
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@renovate-approverenovate-approve[bot]renovate-approve[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency sinon to v22 - #537
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Open
chore(deps): update dependency sinon to v22#537
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Conversation
@renovate
@renovaterenovateBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
sinon (source)21.0.1 → 22.1.0ageconfidence
Release Notes
sinonjs/sinon (sinon)
v22.1.0
Compare Source
  • d36e921b
    
fix: let returns override returnsArg (王胜)

    Signed-off-by: 王胜 <2318857637@​qq.com>
  • 40c4caa0
    
fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

    restoreObject was made idempotent in #​2737 — it no longer throws
    
for objects with no restorable methods. Updates the docs page
    
and its corresponding test to reflect this.
  • a68dac19
    
fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

    • fix: throw a clear error when throwArg index equals the argument count
    spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
    
with pos equal to the number of recorded arguments slipped past the guard
    
and reached throw this.args[pos], throwing undefined instead of the
    
intended TypeError. A thrown undefined cannot be inspected as an Error and
    
is reported by test frameworks as no exception thrown.
    Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
    
which already reject an out-of-range index with a clear error.
  • 9ea504e3
    
feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

    Passing an object with no live fakes to restoreObject now restores
    
nothing instead of throwing, giving it symmetry with sinon.restore()
    
and sandbox.restore(). The strict "found no methods" check is retained
    
for spy(object) and stub(object), which now use a dedicated
    
walkObjectStrict export, while restoreObject uses the loose walkObject.
    
Passing a falsy value still throws.
    Fixes #​2736
  • 4db4feff
    
fix: preserve fake undefined argument validation (Vishal Kumar Singh)
  • 755a40d7
    
fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

    The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
    
and calledImmediatelyAfter to fail when tests run in parallel with separate
    
sandboxes. Each sandbox now maintains its own callId counter, passed through
    
the spy/stub/fake creation chain via a context object.
    Fixes #​2472
Released by Morgan Roderick on 2026-07-20.
v22.0.0
Compare Source
  • ed911df5
    
Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8
    
Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608
    
Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b
    
Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6
    
Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8
    
Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)

    • refactor: global mutable call id can grow unbounded across l
    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.
    Affected files: proxy-invoke.js
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    • Wrap around for all values that are too high
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • f4f7d93b
    
Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
  • 6199e9e4
    
improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

    • fix(workflows): fetch-depth is for actions/checkout
    • chore(workflows): update
    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59
    
Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393
    
fix: make build and node test scripts cross-platform (laplace young)
  • a7692917
    
fix: isolate walk state from Object prototype (laplace young)
  • 66df977a
    
Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

    The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:
    createSandbox: function createSandbox(config) {
const s = createConfiguredSandbox(config);
sandbox.getFakes().push(s);
return s;
}

    Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
    verifyAndRestore. This is the regression reported in #​2701.
    Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.
    Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
    
end.
    Closes #​2701
  • f0bd6e1b
    
fix: exclude proto from walk() (#​2699) (Kevin Locke)

    __proto__ is a special property to access an object's prototype. It
    
has many pitfalls:
    • Setting it to an object value changes an object's prototype, which is
      
generally discouraged and may be unexpected by the iterator callback.
    • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
    • When Node.js is run with the --disable-proto=throw option, getting
      
or setting __proto__ causes an exception with code
      ERR_PROTO_ACCESS to be thrown.
    Additionally, since this property (and all properties of
    Object.prototype) are currently unused in this project by consumers of
    walk(), it is both safe and preferable to exclude.
    Fixes: #​2695
    Signed-off-by: Kevin Locke kevin@kevinlocke.name
  • 1f8afd50
    
chore: add context7.json for ownership confirmation (Morgan Roderick)
Released by Carl-Erik Kopseng on 2026-05-05.
v21.1.2
Compare Source
  • 53817f7d
    
Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)

    • Upgrade to ESLint 10 and new shared config
    • Update deps
  • d7a682e0
    
fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

    used only during dev, and caused a considerable dep count jump downstream
  • 5b8720ec
    
use latest shared eslint-config (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-11.
v21.1.1
Compare Source
  • 3c8b023b
    
Update deps (Carl-Erik Kopseng)
  • 2eabf5da
    
fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)

    • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports
Released by Carl-Erik Kopseng on 2026-04-10.
v21.1.0
Compare Source
  • 0a5526c5
    
updated deps (Carl-Erik Kopseng)
  • 5262204f
    
fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
  • 819bb64b
    
Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

    This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib
    • Modern ignores 😁
    • test: add distribution harness
    • test: verify packed cjs and esm entrypoints
    • test: lock distribution api manifest
    • test: smoke test built pkg artifacts
    • docs: require contract tests for package migration
    • test: guard esm migration regressions
    • docs: require contract gate for esm migration
    • build: generate cjs lib from esm source entries
    • refactor: port root api surface to esm
    • build: clean port of root api to esm
    • docs: include implementation plans
    • fix: align lint and smoke tests with esm migration
    • refactor: complete esm port of all core components
    • refactor: finalize esm migration with sandbox and naming fixes
    • fix: finish esm migration stabilization
    • chore: stop tracking generated lib output
    • remove plans
    • prettier
    • linting
    • fix: make distribution tests self-contained
    • fix: build before coverage test bundle
    • refactor: move simple unit tests to src
    • refactor: flatten test and coverage script chains
    • refactor: use parallel mocha for node tests
    • test: restore fake timers cleanup
    • refactor: remove node test runner script
    • remove unneccessary clutter
    • fix: make mocha watch use polling
    • simplify
    • Increase coverage
    • Fix coverage by removing duplicated tests
    These were covering the generated lib/ folder.
    • Move shared util into esm dir
    • fix package dep issues
    • Adjust coverage
    • Upgrade all dependencies
    npx npm-check-updates -u
  • cd2bf5a3
    
Use newer endpoint (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-09.
v21.0.3
Compare Source
  • 0494251b
    
fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-16.
v21.0.2
Compare Source
  • 024321c4
    
fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
  • b836fccb
    
fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
  • ebf0c431
    
docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)

    • docs: add how-to article for stubbing ES module imports with esm package
    Adds a comprehensive How-To guide that addresses issue #​1832, documenting
    
how to configure Node.js to allow Sinon stubs to work with ES modules.
    • Explains why ES module namespace bindings are immutable by spec
    • Shows how to use the 'esm' npm package with mutableNamespace: true
    • Provides a complete working example with project layout, package.json,
      
loader file, source modules, and a full test suite
    • Documents limitations (destructured imports, non-standard behavior)
    • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference
    Closes #​1832
    
Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • ebcd506c
    
Fix spies not being reset properly (#​2673) (simon-id)
  • 3beab2ba
    
Make doc tests pass with new jQuery (Carl-Erik Kopseng)
  • 766715c6
    
build: reduce transitive audit findings (Carl-Erik Kopseng)
  • 92aaf5c9
    
build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
  • c6aaa871
    
chore: ignore project worktrees (Carl-Erik Kopseng)
  • ef387e8e
    
Upgrade most deps (Carl-Erik Kopseng)
  • 3cf4e77d
    
docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
  • 6349032f
    
Check login status before publishing steps are performed (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-04.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@socket-security
socket-securityBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedsinon@​21.0.1 ⏵ 22.1.0100+110098+193+4100
View full report
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
5be5e55 to
92e1c35CompareJuly 23, 2026 18:46
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
92e1c35 to
fc526ecCompareAugust 3, 2026 14:14
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@renovate-approverenovate-approve[bot]renovate-approve[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(deps): update dependency sinon to v22 - #537
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Open
chore(deps): update dependency sinon to v22#537
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/sinon-22.x
Conversation
@renovate
@renovaterenovateBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
sinon (source)21.0.1 → 22.1.0ageconfidence
Release Notes
sinonjs/sinon (sinon)
v22.1.0
Compare Source
  • d36e921b
    
fix: let returns override returnsArg (王胜)

    Signed-off-by: 王胜 <2318857637@​qq.com>
  • 40c4caa0
    
fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

    restoreObject was made idempotent in #​2737 — it no longer throws
    
for objects with no restorable methods. Updates the docs page
    
and its corresponding test to reflect this.
  • a68dac19
    
fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

    • fix: throw a clear error when throwArg index equals the argument count
    spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
    
with pos equal to the number of recorded arguments slipped past the guard
    
and reached throw this.args[pos], throwing undefined instead of the
    
intended TypeError. A thrown undefined cannot be inspected as an Error and
    
is reported by test frameworks as no exception thrown.
    Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
    
which already reject an out-of-range index with a clear error.
  • 9ea504e3
    
feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

    Passing an object with no live fakes to restoreObject now restores
    
nothing instead of throwing, giving it symmetry with sinon.restore()
    
and sandbox.restore(). The strict "found no methods" check is retained
    
for spy(object) and stub(object), which now use a dedicated
    
walkObjectStrict export, while restoreObject uses the loose walkObject.
    
Passing a falsy value still throws.
    Fixes #​2736
  • 4db4feff
    
fix: preserve fake undefined argument validation (Vishal Kumar Singh)
  • 755a40d7
    
fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

    The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
    
and calledImmediatelyAfter to fail when tests run in parallel with separate
    
sandboxes. Each sandbox now maintains its own callId counter, passed through
    
the spy/stub/fake creation chain via a context object.
    Fixes #​2472
Released by Morgan Roderick on 2026-07-20.
v22.0.0
Compare Source
  • ed911df5
    
Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8
    
Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608
    
Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b
    
Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6
    
Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8
    
Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)

    • refactor: global mutable call id can grow unbounded across l
    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.
    Affected files: proxy-invoke.js
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    • Wrap around for all values that are too high
    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • f4f7d93b
    
Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
  • 6199e9e4
    
improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

    • fix(workflows): fetch-depth is for actions/checkout
    • chore(workflows): update
    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59
    
Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393
    
fix: make build and node test scripts cross-platform (laplace young)
  • a7692917
    
fix: isolate walk state from Object prototype (laplace young)
  • 66df977a
    
Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

    The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:
    createSandbox: function createSandbox(config) {
const s = createConfiguredSandbox(config);
sandbox.getFakes().push(s);
return s;
}

    Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
    verifyAndRestore. This is the regression reported in #​2701.
    Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.
    Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
    
end.
    Closes #​2701
  • f0bd6e1b
    
fix: exclude proto from walk() (#​2699) (Kevin Locke)

    __proto__ is a special property to access an object's prototype. It
    
has many pitfalls:
    • Setting it to an object value changes an object's prototype, which is
      
generally discouraged and may be unexpected by the iterator callback.
    • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
    • When Node.js is run with the --disable-proto=throw option, getting
      
or setting __proto__ causes an exception with code
      ERR_PROTO_ACCESS to be thrown.
    Additionally, since this property (and all properties of
    Object.prototype) are currently unused in this project by consumers of
    walk(), it is both safe and preferable to exclude.
    Fixes: #​2695
    Signed-off-by: Kevin Locke kevin@kevinlocke.name
  • 1f8afd50
    
chore: add context7.json for ownership confirmation (Morgan Roderick)
Released by Carl-Erik Kopseng on 2026-05-05.
v21.1.2
Compare Source
  • 53817f7d
    
Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)

    • Upgrade to ESLint 10 and new shared config
    • Update deps
  • d7a682e0
    
fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

    used only during dev, and caused a considerable dep count jump downstream
  • 5b8720ec
    
use latest shared eslint-config (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-11.
v21.1.1
Compare Source
  • 3c8b023b
    
Update deps (Carl-Erik Kopseng)
  • 2eabf5da
    
fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)

    • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports
Released by Carl-Erik Kopseng on 2026-04-10.
v21.1.0
Compare Source
  • 0a5526c5
    
updated deps (Carl-Erik Kopseng)
  • 5262204f
    
fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
  • 819bb64b
    
Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

    This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib
    • Modern ignores 😁
    • test: add distribution harness
    • test: verify packed cjs and esm entrypoints
    • test: lock distribution api manifest
    • test: smoke test built pkg artifacts
    • docs: require contract tests for package migration
    • test: guard esm migration regressions
    • docs: require contract gate for esm migration
    • build: generate cjs lib from esm source entries
    • refactor: port root api surface to esm
    • build: clean port of root api to esm
    • docs: include implementation plans
    • fix: align lint and smoke tests with esm migration
    • refactor: complete esm port of all core components
    • refactor: finalize esm migration with sandbox and naming fixes
    • fix: finish esm migration stabilization
    • chore: stop tracking generated lib output
    • remove plans
    • prettier
    • linting
    • fix: make distribution tests self-contained
    • fix: build before coverage test bundle
    • refactor: move simple unit tests to src
    • refactor: flatten test and coverage script chains
    • refactor: use parallel mocha for node tests
    • test: restore fake timers cleanup
    • refactor: remove node test runner script
    • remove unneccessary clutter
    • fix: make mocha watch use polling
    • simplify
    • Increase coverage
    • Fix coverage by removing duplicated tests
    These were covering the generated lib/ folder.
    • Move shared util into esm dir
    • fix package dep issues
    • Adjust coverage
    • Upgrade all dependencies
    npx npm-check-updates -u
  • cd2bf5a3
    
Use newer endpoint (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-04-09.
v21.0.3
Compare Source
  • 0494251b
    
fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-16.
v21.0.2
Compare Source
  • 024321c4
    
fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
  • b836fccb
    
fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
  • ebf0c431
    
docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)

    • docs: add how-to article for stubbing ES module imports with esm package
    Adds a comprehensive How-To guide that addresses issue #​1832, documenting
    
how to configure Node.js to allow Sinon stubs to work with ES modules.
    • Explains why ES module namespace bindings are immutable by spec
    • Shows how to use the 'esm' npm package with mutableNamespace: true
    • Provides a complete working example with project layout, package.json,
      
loader file, source modules, and a full test suite
    • Documents limitations (destructured imports, non-standard behavior)
    • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference
    Closes #​1832
    
Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
    
Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com
  • ebcd506c
    
Fix spies not being reset properly (#​2673) (simon-id)
  • 3beab2ba
    
Make doc tests pass with new jQuery (Carl-Erik Kopseng)
  • 766715c6
    
build: reduce transitive audit findings (Carl-Erik Kopseng)
  • 92aaf5c9
    
build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
  • c6aaa871
    
chore: ignore project worktrees (Carl-Erik Kopseng)
  • ef387e8e
    
Upgrade most deps (Carl-Erik Kopseng)
  • 3cf4e77d
    
docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
  • 6349032f
    
Check login status before publishing steps are performed (Carl-Erik Kopseng)
Released by Carl-Erik Kopseng on 2026-03-04.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@socket-security
socket-securityBot
commented
May 9, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedsinon@​21.0.1 ⏵ 22.1.0100+110098+193+4100
View full report
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
5be5e55 to
92e1c35CompareJuly 23, 2026 18:46
@renovate
renovateBotforce-pushed
the
renovate/sinon-22.x
branch
from
92e1c35 to
fc526ecCompareAugust 3, 2026 14:14
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@renovate-approverenovate-approve[bot]renovate-approve[bot] approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants