chore(deps): update dev dependencies (non-major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	24.13.2 → 24.19.2
eslint (source)	9.39.4 → 9.39.5
sinon (source)	22.0.0 → 22.1.0

---

Release Notes

eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #​20812 to v9.x) (#​21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#​20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#​20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)

sinonjs/sinon (sinon)

v22.1.0

Compare Source

• d36e921b
  fix: let returns override returnsArg (王胜)

  Signed-off-by: 王胜 <2318857637@​qq.com>

• 40c4caa0
  fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

  restoreObject was made idempotent in #​2737 — it no longer throws
  for objects with no restorable methods. Updates the docs page
  and its corresponding test to reflect this.

• a68dac19
  fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

  • fix: throw a clear error when throwArg index equals the argument count

  spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
  with pos equal to the number of recorded arguments slipped past the guard
  and reached throw this.args[pos], throwing undefined instead of the
  intended TypeError. A thrown undefined cannot be inspected as an Error and
  is reported by test frameworks as no exception thrown.

  Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
  which already reject an out-of-range index with a clear error.

• 9ea504e3
  feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

  Passing an object with no live fakes to restoreObject now restores
  nothing instead of throwing, giving it symmetry with sinon.restore()
  and sandbox.restore(). The strict "found no methods" check is retained
  for spy(object) and stub(object), which now use a dedicated
  walkObjectStrict export, while restoreObject uses the loose walkObject.
  Passing a falsy value still throws.

  Fixes #​2736

• 4db4feff
  fix: preserve fake undefined argument validation (Vishal Kumar Singh)
• 755a40d7
  fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

  The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
  and calledImmediatelyAfter to fail when tests run in parallel with separate
  sandboxes. Each sandbox now maintains its own callId counter, passed through
  the spy/stub/fake creation chain via a context object.

  Fixes #​2472

Released by Morgan Roderick on 2026-07-20.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.