chore(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
semantic-release	25.0.7 → 25.0.8
sinon (source)	22.0.0 → 22.1.0
stylelint (source)	17.14.0 → 17.14.1

---

Release Notes

semantic-release/semantic-release (semantic-release)

v25.0.8

Compare Source

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#​4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

sinonjs/sinon (sinon)

v22.1.0

Compare Source

• d36e921b
  fix: let returns override returnsArg (王胜)

  Signed-off-by: 王胜 <2318857637@​qq.com>

• 40c4caa0
  fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

  restoreObject was made idempotent in #​2737 — it no longer throws
  for objects with no restorable methods. Updates the docs page
  and its corresponding test to reflect this.

• a68dac19
  fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

  • fix: throw a clear error when throwArg index equals the argument count

  spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
  with pos equal to the number of recorded arguments slipped past the guard
  and reached throw this.args[pos], throwing undefined instead of the
  intended TypeError. A thrown undefined cannot be inspected as an Error and
  is reported by test frameworks as no exception thrown.

  Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
  which already reject an out-of-range index with a clear error.

• 9ea504e3
  feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

  Passing an object with no live fakes to restoreObject now restores
  nothing instead of throwing, giving it symmetry with sinon.restore()
  and sandbox.restore(). The strict "found no methods" check is retained
  for spy(object) and stub(object), which now use a dedicated
  walkObjectStrict export, while restoreObject uses the loose walkObject.
  Passing a falsy value still throws.

  Fixes #​2736

• 4db4feff
  fix: preserve fake undefined argument validation (Vishal Kumar Singh)
• 755a40d7
  fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

  The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
  and calledImmediatelyAfter to fail when tests run in parallel with separate
  sandboxes. Each sandbox now maintains its own callId counter, passed through
  the spy/stub/fake creation chain via a context object.

  Fixes #​2472

Released by Morgan Roderick on 2026-07-20.

stylelint/stylelint (stylelint)

v17.14.1

Compare Source

• Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#​9364) (@​sarathfrancis90).
• Fixed: quiet option suppresses report* warning reports. (#​9387) (@​ychampion).
• Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#​9394) (@​sarathfrancis90).
• Fixed: reported range of unknown rules (#​9385) (@​ybiquitous).

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[trieloff]

🎉 This PR is included in version 3.1.8 🎉

The release is available on:

• GitHub release
• v3.1.8

Your semantic-release bot 📦🚀