chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the dev-minor-and-patch-dependencies group with 4 updates in the / directory: @eslint/js, bun, eslint and sinon.

Updates @eslint/js from 9.39.1 to 9.39.2

Release notes

Sourced from @​eslint/js's releases.

v9.39.2

Bug Fixes

• 5705833 fix: warn when eslint-env configuration comments are found (#20381) (sethamus)

Build Related

• 506f154 build: add .scss files entry to knip (#20391) (Milos Djermanovic)

Chores

• 7ca0af7 chore: upgrade to @eslint/js@9.39.2 (#20394) (Francesco Trotta)
• c43ce24 chore: package.json update for @​eslint/js release (Jenkins)
• 4c9858e ci: add v9.x-dev branch (#20382) (Milos Djermanovic)

Commits

• c43ce24 chore: package.json update for @​eslint/js release
• See full diff in compare view

Updates bun from 1.3.3 to 1.3.5

Release notes

Sourced from bun's releases.

Bun v1.3.5

To install Bun v1.3.5

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.5:

bun upgrade

Read Bun v1.3.5's release notes on Bun's blog

Thanks to 10 contributors!

• @​alii
• @​cirospaciari
• @​crishoj
• @​dylan-conway
• @​elfayer
• @​hamidrezahanafi
• @​jarred-sumner
• @​kylekz
• @​robobun
• @​ryangst

Bun v1.3.4

To install Bun v1.3.4

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.4:

bun upgrade

... (truncated)

Commits

• fa5a5bb fix: v8::Value::IsInt32()/IsUint32() edge cases (#25548)
• 1e86ceb Add bun_version to link metadata (#25545)
• bc47f87 fix(ini): support env var expansion in quoted .npmrc values (#25518)
• 698b004 Add step in CI to upload link metadata (#25448)
• b135c20 fix(yaml): remove YAML 1.1 legacy boolean values for YAML 1.2 compliance (#25...
• a1dd26d fix(usockets) fix last_write_failed flag (#25496)
• 7c06320 fix(ws): fix zlib version mismatch on Windows (segfault) (#25538)
• dd04c57 feat: implement V8 Value type checking APIs (#22462)
• 344b2c1 fix: Response.clone() no longer locks body when body was accessed before clon...
• aef0b5b fix(usockets): safely handle socket reallocation during context adoption (#25...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jarred, a new releaser for bun since your current version.

Updates eslint from 9.39.1 to 9.39.2

Release notes

Sourced from eslint's releases.

v9.39.2

Bug Fixes

• 5705833 fix: warn when eslint-env configuration comments are found (#20381) (sethamus)

Build Related

• 506f154 build: add .scss files entry to knip (#20391) (Milos Djermanovic)

Chores

• 7ca0af7 chore: upgrade to @eslint/js@9.39.2 (#20394) (Francesco Trotta)
• c43ce24 chore: package.json update for @​eslint/js release (Jenkins)
• 4c9858e ci: add v9.x-dev branch (#20382) (Milos Djermanovic)

Commits

• 9278324 9.39.2
• 542266a Build: changelog update for 9.39.2
• 7ca0af7 chore: upgrade to @eslint/js@9.39.2 (#20394)
• c43ce24 chore: package.json update for @​eslint/js release
• 5705833 fix: warn when eslint-env configuration comments are found (#20381)
• 506f154 build: add .scss files entry to knip (#20391)
• 4c9858e ci: add v9.x-dev branch (#20382)
• See full diff in compare view

Updates sinon from 21.0.0 to 21.0.1

Changelog

Sourced from sinon's changelog.

21.0.1

• 456a65c2 Update dependencies - except @​sinonjs/samsam (#2669) (Carl-Erik Kopseng)
• f04f3eb1 Fix issue 2618 - Remove browserify in favor of esbuild (#2661) (Artur Parkhisenko)
• 48b69df2 fix(docs): remove assert.failException from documentation (#2666) (Steffen Schroeder)
• 13b27ccc Fix sandbox restore not handling stubbed functions (#2667) (thamion)
• ae9e09ac Update compatibility target to ES2023 (Carl-Erik Kopseng)

  Updated compatibility target from ES2017 to ES2023 and clarified the note on breaking changes.

• 26055043 Improve error message for immutable descriptors (#2664) (Stuart Dotson)
• 80fa9a5b Also mirror the calledOnceWith assertion (#2660) (Benedikt Meurer)

Released by Carl-Erik Kopseng on 2025-12-19.

Commits

• a8bebe0 21.0.1
• 456a65c Update dependencies - except @​sinonjs/samsam (#2669)
• f04f3eb Fix issue 2618 - Remove browserify in favor of esbuild (#2661)
• 48b69df fix(docs): remove assert.failException from documentation (#2666)
• 13b27cc Fix sandbox restore not handling stubbed functions (#2667)
• ae9e09a Update compatibility target to ES2023
• 2605504 Improve error message for immutable descriptors (#2664)
• 6d48f12 Update text to emphasise that the target is moving
• 3d852ae Remember to quit on first error
• 43c88c9 Add some output
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Overall package size

Self size: 4.39 MB
Deduped: 5.21 MB
No deduping: 5.21 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 2.0.0 | 68.46 kB | 797.03 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.36%. Comparing base (f92d86e) to head (ee48c87).
⚠️ Report is 8 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #7166      +/-   ##
==========================================
+ Coverage   83.49%   84.36%   +0.87%     
==========================================
  Files         523      524       +1     
  Lines       22461    22463       +2     
==========================================
+ Hits        18754    18952     +198     
+ Misses       3707     3511     -196     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-01-05 17:19:05

Comparing candidate commit ee48c87 in PR branch dependabot/npm_and_yarn/dev-minor-and-patch-dependencies-f557cffada with baseline commit f92d86e in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 291 metrics, 29 unstable metrics.

[datadog-datadog-prod-us1]

⚠️ Tests

✨ Fix all issues with Cursor

⚠️ Warnings

❄️ 1 New flaky test detected

cypress@latest commonJS flaky test retries retries flaky tests in the correct order (right after original test) from integration-tests/cypress/cypress.spec.js (Datadog) (Fix with Cursor)

Expected values to be strictly equal:

18 !== 10

🧪 18 Tests failed

with express >=4.0.0 <4.3.0 (4.0.0) Suspicious request blocking - path parameters path parameter callback should block the request when attack is detected from path parameter callback (Datadog) (Fix with Cursor)

expected paramCallback to not have been called but was called once
    paramCallback(<ref *1> IncomingMessage {
  _readableState: ReadableState {
    state: 194614,
    highWaterMark: 16384,
    buffer: BufferList { head: null, tail: null, length: 0 },
    length: 0,
    pipes: [],
    flowing: true,
    errored: null,
...

with express >=4.0.0 <4.3.0 (4.2.0) Suspicious request blocking - path parameters path parameter callback should block the request when attack is detected from path parameter callback (Datadog) (Fix with Cursor)

expected paramCallback to not have been called but was called once
    paramCallback(<ref *1> IncomingMessage {
  _readableState: ReadableState {
    state: 194614,
    highWaterMark: 16384,
    buffer: BufferList { head: null, tail: null, length: 0 },
    length: 0,
    pipes: [],
    flowing: true,
    errored: null,
...

with express >=4.3.0 <5.0.0 (4.22.1) Suspicious request blocking - path parameters path parameter callback should block the request when attack is detected from path parameter callback (Datadog) (Fix with Cursor)

expected paramCallback to not have been called but was called once
    paramCallback(<ref *1> IncomingMessage {
  _readableState: ReadableState {
    state: 194614,
    highWaterMark: 16384,
    buffer: BufferList { head: null, tail: null, length: 0 },
    length: 0,
    pipes: [],
    flowing: true,
    errored: null,
...

View all

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: ee48c87 | Docs | Datadog PR Page | Was this helpful? Give us feedback!}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.