v48.3.7

Update dependency sinon to v22.1.0

Notable changes

• d36e921b
• 40c4caa0
• a68dac19
• 9ea504e3
• 4db4feff
• 755a40d7

sinonjs/sinon (sinon)

v22.1.0

Compare Source

• d36e921b
  fix: let returns override returnsArg (王胜)

  Signed-off-by: 王胜 <2318857637@​qq.com>

• 40c4caa0
  fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

  restoreObject was made idempotent in #​2737 — it no longer throws
  for objects with no restorable methods. Updates the docs page
  and its corresponding test to reflect this.

• a68dac19
  fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

  • fix: throw a clear error when throwArg index equals the argument count

  spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
  with pos equal to the number of recorded arguments slipped past the guard
  and reached throw this.args[pos], throwing undefined instead of the
  intended TypeError. A thrown undefined cannot be inspected as an Error and
  is reported by test frameworks as no exception thrown.

  Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
  which already reject an out-of-range index with a clear error.

• 9ea504e3
  feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

  Passing an object with no live fakes to restoreObject now restores
  nothing instead of throwing, giving it symmetry with sinon.restore()
  and sandbox.restore(). The strict "found no methods" check is retained
  for spy(object) and stub(object), which now use a dedicated
  walkObjectStrict export, while restoreObject uses the loose walkObject.
  Passing a falsy value still throws.

  Fixes #​2736

• 4db4feff
  fix: preserve fake undefined argument validation (Vishal Kumar Singh)
• 755a40d7
  fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

  The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
  and calledImmediatelyAfter to fail when tests run in parallel with separate
  sandboxes. Each sandbox now maintains its own callId counter, passed through
  the spy/stub/fake creation chain via a context object.

  Fixes #​2472

Released by Morgan Roderick on 2026-07-20.

List of commits

041c2c3 (Update dependency sinon to v22.1.0, 2026-07-30)