chore(deps-dev): bump sinon and @types/sinon

[dependabot]

Bumps sinon and @types/sinon. These dependencies needed to be updated together.
Updates sinon from 21.0.2 to 22.1.0

Changelog

Sourced from sinon's changelog.

22.1.0

• d36e921b fix: let returns override returnsArg (王胜)

  Signed-off-by: 王胜 2318857637@qq.com

• 40c4caa0 fix: align restoreObject docs test with idempotent behavior (#2745) (Julia Miller)

  restoreObject was made idempotent in #2737 — it no longer throws for objects with no restorable methods. Updates the docs page and its corresponding test to reflect this.

• a68dac19 fix: throw a clear error when throwArg index equals the argument count (#2743) (spokodev)

  • fix: throw a clear error when throwArg index equals the argument count

  spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it with pos equal to the number of recorded arguments slipped past the guard and reached throw this.args[pos], throwing undefined instead of the intended TypeError. A thrown undefined cannot be inspected as an Error and is reported by test frameworks as no exception thrown.

  Use >= to match ensureArgs in behavior.js and the sibling callArg helpers, which already reject an out-of-range index with a clear error.

• 9ea504e3 feat: make sinon.restoreObject idempotent (#2737) (Ilia Choly)

  Passing an object with no live fakes to restoreObject now restores nothing instead of throwing, giving it symmetry with sinon.restore() and sandbox.restore(). The strict "found no methods" check is retained for spy(object) and stub(object), which now use a dedicated walkObjectStrict export, while restoreObject uses the loose walkObject. Passing a falsy value still throws.

  Fixes #2736

• 4db4feff fix: preserve fake undefined argument validation (Vishal Kumar Singh)
• 755a40d7 fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

  The global callId counter in proxy-invoke.js caused calledImmediatelyBefore and calledImmediatelyAfter to fail when tests run in parallel with separate sandboxes. Each sandbox now maintains its own callId counter, passed through the spy/stub/fake creation chain via a context object.

  Fixes #2472

Released by Morgan Roderick on 2026-07-20.

22.0.0

• ed911df5 Update Ruby gems (Carl-Erik Kopseng)
• 75a1e5b8

... (truncated)

Commits

• ab289e9 22.1.0
• bb3b75a chore: remove Jekyll steps from version hook
• bb38f25 chore: run docs tests in preversion hook
• d36e921 fix: let returns override returnsArg
• 11db213 ci: run docs tests on every PR (#2746)
• 40c4caa fix: align restoreObject docs test with idempotent behavior (#2745)
• 5ccb7fd build(deps): bump the action-deps group with 4 updates (#2744)
• a68dac1 fix: throw a clear error when throwArg index equals the argument count (#2743)
• 9ea504e feat: make sinon.restoreObject idempotent (#2737)
• cf5d9e8 fix: remove dead link and exclude code example URLs from link check
• Additional commits viewable in compare view

Updates @types/sinon from 17.0.4 to 22.0.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6a3e343

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.11%. Comparing base (f5e9a01) to head (6a3e343).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2683   +/-   ##
=======================================
  Coverage   89.11%   89.11%           
=======================================
  Files          65       65           
  Lines       10339    10339           
  Branches      471      471           
=======================================
  Hits         9214     9214           
  Misses       1095     1095           
  Partials       30       30           

Flag	Coverage Δ
cli-hooks	89.11% <ø> (ø)
cli-test	89.11% <ø> (ø)
logger	89.11% <ø> (ø)
oauth	89.11% <ø> (ø)
socket-mode	89.11% <ø> (ø)
web-api	89.11% <ø> (ø)
webhook	89.11% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.