chore(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
lint-staged	17.0.8 → 17.1.0
semantic-release	25.0.7 → 25.0.8
sinon (source)	22.0.0 → 22.1.0

---

Release Notes

lint-staged/lint-staged (lint-staged)

v17.1.0

Compare Source

Minor Changes

• #​1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

  Before:

  Size of node_modules/ after installing: 1561.7 kB with 29 packages.

  Fancy interactive spinners, but output dynamically changes:

  ✔ Backed up original state in git stash (0b191303)
  ✔ Running tasks for staged files...
  ✔ Staging changes from tasks...
  ✔ Cleaning up temporary files...

  After:

  Size of node_modules/ after installing: 974.0 kB with 5 packages (37.6 % smaller, 82.7 % less transitive dependencies).

  Simpler but more explicit output:

  ⋯ Backing up original state…
  ✔ Done backing up original state (35b38ed1)!
  ⋯ Running tasks for staged files…
      *.js — 1 file
        ⋯ oxlint --fix
      *.{json,md} — 1 file
        ⋯ oxfmt --write
  
  ✔ oxfmt --write
  ✔ oxlint --fix
  
  ✔ Done running tasks for staged files!
  ⋯ Staging changes from tasks…
  ✔ Done staging changes from tasks!
  ⋯ Cleaning up temporary files…
  ✔ Done cleaning up temporary files!

Patch Changes

• #​1816 c19079d - Try to restore hidden unstaged changes when using --no-revert.

• #​1818 efb23a2 - Console output colors are enabled/disabled more consistently.

• #​1818 26112a1 - Failed JS function tasks now properly kill other tasks, unless --continue-on-error is used. Previously their failure didn't affect other tasks.

semantic-release/semantic-release (semantic-release)

v25.0.8

Compare Source

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#​4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

sinonjs/sinon (sinon)

v22.1.0

Compare Source

• d36e921b
  fix: let returns override returnsArg (王胜)

  Signed-off-by: 王胜 <2318857637@​qq.com>

• 40c4caa0
  fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

  restoreObject was made idempotent in #​2737 — it no longer throws
  for objects with no restorable methods. Updates the docs page
  and its corresponding test to reflect this.

• a68dac19
  fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

  • fix: throw a clear error when throwArg index equals the argument count

  spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
  with pos equal to the number of recorded arguments slipped past the guard
  and reached throw this.args[pos], throwing undefined instead of the
  intended TypeError. A thrown undefined cannot be inspected as an Error and
  is reported by test frameworks as no exception thrown.

  Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
  which already reject an out-of-range index with a clear error.

• 9ea504e3
  feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

  Passing an object with no live fakes to restoreObject now restores
  nothing instead of throwing, giving it symmetry with sinon.restore()
  and sandbox.restore(). The strict "found no methods" check is retained
  for spy(object) and stub(object), which now use a dedicated
  walkObjectStrict export, while restoreObject uses the loose walkObject.
  Passing a falsy value still throws.

  Fixes #​2736

• 4db4feff
  fix: preserve fake undefined argument validation (Vishal Kumar Singh)
• 755a40d7
  fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

  The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
  and calledImmediatelyAfter to fail when tests run in parallel with separate
  sandboxes. Each sandbox now maintains its own callId counter, passed through
  the spy/stub/fake creation chain via a context object.

  Fixes #​2472

Released by Morgan Roderick on 2026-07-20.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!