initial commit of actions

github/codeql-action-v2/node_modules/@sinonjs/commons/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2018, Sinon.JS
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* Neither the name of the copyright holder nor the names of its
+  contributors may be used to endorse or promote products derived from
+  this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

github/codeql-action-v2/node_modules/@sinonjs/commons/README.md

@@ -0,0 +1,16 @@
+# commons
+
+[![CircleCI](https://circleci.com/gh/sinonjs/commons.svg?style=svg)](https://circleci.com/gh/sinonjs/commons)
+[![codecov](https://codecov.io/gh/sinonjs/commons/branch/master/graph/badge.svg)](https://codecov.io/gh/sinonjs/commons)
+<a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-v2.0%20adopted-ff69b4.svg" alt="Contributor Covenant" /></a>
+
+Simple functions shared among the sinon end user libraries
+
+## Rules
+
+-   Follows the [Sinon.JS compatibility](https://github.com/sinonjs/sinon/blob/master/CONTRIBUTING.md#compatibility)
+-   100% test coverage
+-   Code formatted using [Prettier](https://prettier.io)
+-   No side effects welcome! (only pure functions)
+-   No platform specific functions
+-   One export per file (any bundler can do tree shaking)

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/called-in-order.js

@@ -0,0 +1,55 @@
+"use strict";
+
+var every = require("./prototypes/array").every;
+
+/**
+ * @private
+ */
+function hasCallsLeft(callMap, spy) {
+    if (callMap[spy.id] === undefined) {
+        callMap[spy.id] = 0;
+    }
+
+    return callMap[spy.id] < spy.callCount;
+}
+
+/**
+ * @private
+ */
+function checkAdjacentCalls(callMap, spy, index, spies) {
+    var calledBeforeNext = true;
+
+    if (index !== spies.length - 1) {
+        calledBeforeNext = spy.calledBefore(spies[index + 1]);
+    }
+
+    if (hasCallsLeft(callMap, spy) && calledBeforeNext) {
+        callMap[spy.id] += 1;
+        return true;
+    }
+
+    return false;
+}
+
+/**
+ * A Sinon proxy object (fake, spy, stub)
+ * @typedef {object} SinonProxy
+ * @property {Function} calledBefore - A method that determines if this proxy was called before another one
+ * @property {string} id - Some id
+ * @property {number} callCount - Number of times this proxy has been called
+ */
+
+/**
+ * Returns true when the spies have been called in the order they were supplied in
+ * @param  {SinonProxy[] | SinonProxy} spies An array of proxies, or several proxies as arguments
+ * @returns {boolean} true when spies are called in order, false otherwise
+ */
+function calledInOrder(spies) {
+    var callMap = {};
+    // eslint-disable-next-line no-underscore-dangle
+    var _spies = arguments.length > 1 ? arguments : spies;
+
+    return every(_spies, checkAdjacentCalls.bind(null, callMap));
+}
+
+module.exports = calledInOrder;

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/called-in-order.test.js

@@ -0,0 +1,121 @@
+"use strict";
+
+var assert = require("@sinonjs/referee-sinon").assert;
+var calledInOrder = require("./called-in-order");
+var sinon = require("@sinonjs/referee-sinon").sinon;
+
+var testObject1 = {
+    someFunction: function () {
+        return;
+    },
+};
+var testObject2 = {
+    otherFunction: function () {
+        return;
+    },
+};
+var testObject3 = {
+    thirdFunction: function () {
+        return;
+    },
+};
+
+function testMethod() {
+    testObject1.someFunction();
+    testObject2.otherFunction();
+    testObject2.otherFunction();
+    testObject2.otherFunction();
+    testObject3.thirdFunction();
+}
+
+describe("calledInOrder", function () {
+    beforeEach(function () {
+        sinon.stub(testObject1, "someFunction");
+        sinon.stub(testObject2, "otherFunction");
+        sinon.stub(testObject3, "thirdFunction");
+        testMethod();
+    });
+    afterEach(function () {
+        testObject1.someFunction.restore();
+        testObject2.otherFunction.restore();
+        testObject3.thirdFunction.restore();
+    });
+
+    describe("given single array argument", function () {
+        describe("when stubs were called in expected order", function () {
+            it("returns true", function () {
+                assert.isTrue(
+                    calledInOrder([
+                        testObject1.someFunction,
+                        testObject2.otherFunction,
+                    ])
+                );
+                assert.isTrue(
+                    calledInOrder([
+                        testObject1.someFunction,
+                        testObject2.otherFunction,
+                        testObject2.otherFunction,
+                        testObject3.thirdFunction,
+                    ])
+                );
+            });
+        });
+
+        describe("when stubs were called in unexpected order", function () {
+            it("returns false", function () {
+                assert.isFalse(
+                    calledInOrder([
+                        testObject2.otherFunction,
+                        testObject1.someFunction,
+                    ])
+                );
+                assert.isFalse(
+                    calledInOrder([
+                        testObject2.otherFunction,
+                        testObject1.someFunction,
+                        testObject1.someFunction,
+                        testObject3.thirdFunction,
+                    ])
+                );
+            });
+        });
+    });
+
+    describe("given multiple arguments", function () {
+        describe("when stubs were called in expected order", function () {
+            it("returns true", function () {
+                assert.isTrue(
+                    calledInOrder(
+                        testObject1.someFunction,
+                        testObject2.otherFunction
+                    )
+                );
+                assert.isTrue(
+                    calledInOrder(
+                        testObject1.someFunction,
+                        testObject2.otherFunction,
+                        testObject3.thirdFunction
+                    )
+                );
+            });
+        });
+
+        describe("when stubs were called in unexpected order", function () {
+            it("returns false", function () {
+                assert.isFalse(
+                    calledInOrder(
+                        testObject2.otherFunction,
+                        testObject1.someFunction
+                    )
+                );
+                assert.isFalse(
+                    calledInOrder(
+                        testObject2.otherFunction,
+                        testObject1.someFunction,
+                        testObject3.thirdFunction
+                    )
+                );
+            });
+        });
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/class-name.js

@@ -0,0 +1,13 @@
+"use strict";
+
+/**
+ * Returns a display name for a value from a constructor
+ * @param  {object} value A value to examine
+ * @returns {(string|null)} A string or null
+ */
+function className(value) {
+    const name = value.constructor && value.constructor.name;
+    return name || null;
+}
+
+module.exports = className;

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/class-name.test.js

@@ -0,0 +1,37 @@
+"use strict";
+/* eslint-disable no-empty-function */
+
+var assert = require("@sinonjs/referee").assert;
+var className = require("./class-name");
+
+describe("className", function () {
+    it("returns the class name of an instance", function () {
+        // Because eslint-config-sinon disables es6, we can't
+        // use a class definition here
+        // https://github.com/sinonjs/eslint-config-sinon/blob/master/index.js
+        // var instance = new (class TestClass {})();
+        var instance = new (function TestClass() {})();
+        var name = className(instance);
+        assert.equals(name, "TestClass");
+    });
+
+    it("returns 'Object' for {}", function () {
+        var name = className({});
+        assert.equals(name, "Object");
+    });
+
+    it("returns null for an object that has no prototype", function () {
+        var obj = Object.create(null);
+        var name = className(obj);
+        assert.equals(name, null);
+    });
+
+    it("returns null for an object whose prototype was mangled", function () {
+        // This is what Node v6 and v7 do for objects returned by querystring.parse()
+        function MangledObject() {}
+        MangledObject.prototype = Object.create(null);
+        var obj = new MangledObject();
+        var name = className(obj);
+        assert.equals(name, null);
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/deprecated.js

@@ -0,0 +1,48 @@
+/* eslint-disable no-console */
+"use strict";
+
+/**
+ * Returns a function that will invoke the supplied function and print a
+ * deprecation warning to the console each time it is called.
+ * @param  {Function} func
+ * @param  {string} msg
+ * @returns {Function}
+ */
+exports.wrap = function (func, msg) {
+    var wrapped = function () {
+        exports.printWarning(msg);
+        return func.apply(this, arguments);
+    };
+    if (func.prototype) {
+        wrapped.prototype = func.prototype;
+    }
+    return wrapped;
+};
+
+/**
+ * Returns a string which can be supplied to `wrap()` to notify the user that a
+ * particular part of the sinon API has been deprecated.
+ * @param  {string} packageName
+ * @param  {string} funcName
+ * @returns {string}
+ */
+exports.defaultMsg = function (packageName, funcName) {
+    return `${packageName}.${funcName} is deprecated and will be removed from the public API in a future version of ${packageName}.`;
+};
+
+/**
+ * Prints a warning on the console, when it exists
+ * @param  {string} msg
+ * @returns {undefined}
+ */
+exports.printWarning = function (msg) {
+    /* istanbul ignore next */
+    if (typeof process === "object" && process.emitWarning) {
+        // Emit Warnings in Node
+        process.emitWarning(msg);
+    } else if (console.info) {
+        console.info(msg);
+    } else {
+        console.log(msg);
+    }
+};

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/deprecated.test.js

@@ -0,0 +1,101 @@
+/* eslint-disable no-console */
+"use strict";
+
+var assert = require("@sinonjs/referee-sinon").assert;
+var sinon = require("@sinonjs/referee-sinon").sinon;
+
+var deprecated = require("./deprecated");
+
+var msg = "test";
+
+describe("deprecated", function () {
+    describe("defaultMsg", function () {
+        it("should return a string", function () {
+            assert.equals(
+                deprecated.defaultMsg("sinon", "someFunc"),
+                "sinon.someFunc is deprecated and will be removed from the public API in a future version of sinon."
+            );
+        });
+    });
+
+    describe("printWarning", function () {
+        beforeEach(function () {
+            sinon.replace(process, "emitWarning", sinon.fake());
+        });
+
+        afterEach(sinon.restore);
+
+        describe("when `process.emitWarning` is defined", function () {
+            it("should call process.emitWarning with a msg", function () {
+                deprecated.printWarning(msg);
+                assert.calledOnceWith(process.emitWarning, msg);
+            });
+        });
+
+        describe("when `process.emitWarning` is undefined", function () {
+            beforeEach(function () {
+                sinon.replace(console, "info", sinon.fake());
+                sinon.replace(console, "log", sinon.fake());
+                process.emitWarning = undefined;
+            });
+
+            afterEach(sinon.restore);
+
+            describe("when `console.info` is defined", function () {
+                it("should call `console.info` with a message", function () {
+                    deprecated.printWarning(msg);
+                    assert.calledOnceWith(console.info, msg);
+                });
+            });
+
+            describe("when `console.info` is undefined", function () {
+                it("should call `console.log` with a message", function () {
+                    console.info = undefined;
+                    deprecated.printWarning(msg);
+                    assert.calledOnceWith(console.log, msg);
+                });
+            });
+        });
+    });
+
+    describe("wrap", function () {
+        // eslint-disable-next-line mocha/no-setup-in-describe
+        var method = sinon.fake();
+        var wrapped;
+
+        beforeEach(function () {
+            wrapped = deprecated.wrap(method, msg);
+        });
+
+        it("should return a wrapper function", function () {
+            assert.match(wrapped, sinon.match.func);
+        });
+
+        it("should assign the prototype of the passed method", function () {
+            assert.equals(method.prototype, wrapped.prototype);
+        });
+
+        context("when the passed method has falsy prototype", function () {
+            it("should not be assigned to the wrapped method", function () {
+                method.prototype = null;
+                wrapped = deprecated.wrap(method, msg);
+                assert.match(wrapped.prototype, sinon.match.object);
+            });
+        });
+
+        context("when invoking the wrapped function", function () {
+            before(function () {
+                sinon.replace(deprecated, "printWarning", sinon.fake());
+                wrapped({});
+            });
+
+            it("should call `printWarning` before invoking", function () {
+                assert.calledOnceWith(deprecated.printWarning, msg);
+            });
+
+            it("should invoke the passed method with the given arguments", function () {
+                assert.calledOnceWith(method, {});
+            });
+        });
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/every.js

@@ -0,0 +1,26 @@
+"use strict";
+
+/**
+ * Returns true when fn returns true for all members of obj.
+ * This is an every implementation that works for all iterables
+ * @param  {object}   obj
+ * @param  {Function} fn
+ * @returns {boolean}
+ */
+module.exports = function every(obj, fn) {
+    var pass = true;
+
+    try {
+        // eslint-disable-next-line @sinonjs/no-prototype-methods/no-prototype-methods
+        obj.forEach(function () {
+            if (!fn.apply(this, arguments)) {
+                // Throwing an error is the only way to break `forEach`
+                throw new Error();
+            }
+        });
+    } catch (e) {
+        pass = false;
+    }
+
+    return pass;
+};

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/every.test.js

@@ -0,0 +1,41 @@
+"use strict";
+
+var assert = require("@sinonjs/referee-sinon").assert;
+var sinon = require("@sinonjs/referee-sinon").sinon;
+var every = require("./every");
+
+describe("util/core/every", function () {
+    it("returns true when the callback function returns true for every element in an iterable", function () {
+        var obj = [true, true, true, true];
+        var allTrue = every(obj, function (val) {
+            return val;
+        });
+
+        assert(allTrue);
+    });
+
+    it("returns false when the callback function returns false for any element in an iterable", function () {
+        var obj = [true, true, true, false];
+        var result = every(obj, function (val) {
+            return val;
+        });
+
+        assert.isFalse(result);
+    });
+
+    it("calls the given callback once for each item in an iterable until it returns false", function () {
+        var iterableOne = [true, true, true, true];
+        var iterableTwo = [true, true, false, true];
+        var callback = sinon.spy(function (val) {
+            return val;
+        });
+
+        every(iterableOne, callback);
+        assert.equals(callback.callCount, 4);
+
+        callback.resetHistory();
+
+        every(iterableTwo, callback);
+        assert.equals(callback.callCount, 3);
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/function-name.js

@@ -0,0 +1,28 @@
+"use strict";
+
+/**
+ * Returns a display name for a function
+ * @param  {Function} func
+ * @returns {string}
+ */
+module.exports = function functionName(func) {
+    if (!func) {
+        return "";
+    }
+
+    try {
+        return (
+            func.displayName ||
+            func.name ||
+            // Use function decomposition as a last resort to get function
+            // name. Does not rely on function decomposition to work - if it
+            // doesn't debugging will be slightly less informative
+            // (i.e. toString will say 'spy' rather than 'myFunc').
+            (String(func).match(/function ([^\s(]+)/) || [])[1]
+        );
+    } catch (e) {
+        // Stringify may fail and we might get an exception, as a last-last
+        // resort fall back to empty string.
+        return "";
+    }
+};

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/function-name.test.js

@@ -0,0 +1,76 @@
+"use strict";
+
+var jsc = require("jsverify");
+var refute = require("@sinonjs/referee-sinon").refute;
+
+var functionName = require("./function-name");
+
+describe("function-name", function () {
+    it("should return empty string if func is falsy", function () {
+        jsc.assertForall("falsy", function (fn) {
+            return functionName(fn) === "";
+        });
+    });
+
+    it("should use displayName by default", function () {
+        jsc.assertForall("nestring", function (displayName) {
+            var fn = { displayName: displayName };
+
+            return functionName(fn) === fn.displayName;
+        });
+    });
+
+    it("should use name if displayName is not available", function () {
+        jsc.assertForall("nestring", function (name) {
+            var fn = { name: name };
+
+            return functionName(fn) === fn.name;
+        });
+    });
+
+    it("should fallback to string parsing", function () {
+        jsc.assertForall("nat", function (naturalNumber) {
+            var name = `fn${naturalNumber}`;
+            var fn = {
+                toString: function () {
+                    return `\nfunction ${name}`;
+                },
+            };
+
+            return functionName(fn) === name;
+        });
+    });
+
+    it("should not fail when a name cannot be found", function () {
+        refute.exception(function () {
+            var fn = {
+                toString: function () {
+                    return "\nfunction (";
+                },
+            };
+
+            functionName(fn);
+        });
+    });
+
+    it("should not fail when toString is undefined", function () {
+        refute.exception(function () {
+            functionName(Object.create(null));
+        });
+    });
+
+    it("should not fail when toString throws", function () {
+        refute.exception(function () {
+            var fn;
+            try {
+                // eslint-disable-next-line no-eval
+                fn = eval("(function*() {})")().constructor;
+            } catch (e) {
+                // env doesn't support generators
+                return;
+            }
+
+            functionName(fn);
+        });
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/global.js

@@ -0,0 +1,21 @@
+"use strict";
+
+/**
+ * A reference to the global object
+ * @type {object} globalObject
+ */
+var globalObject;
+
+/* istanbul ignore else */
+if (typeof global !== "undefined") {
+    // Node
+    globalObject = global;
+} else if (typeof window !== "undefined") {
+    // Browser
+    globalObject = window;
+} else {
+    // WebWorker
+    globalObject = self;
+}
+
+module.exports = globalObject;

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/global.test.js

@@ -0,0 +1,16 @@
+"use strict";
+
+var assert = require("@sinonjs/referee-sinon").assert;
+var globalObject = require("./global");
+
+describe("global", function () {
+    before(function () {
+        if (typeof global === "undefined") {
+            this.skip();
+        }
+    });
+
+    it("is same as global", function () {
+        assert.same(globalObject, global);
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/index.js

@@ -0,0 +1,14 @@
+"use strict";
+
+module.exports = {
+    global: require("./global"),
+    calledInOrder: require("./called-in-order"),
+    className: require("./class-name"),
+    deprecated: require("./deprecated"),
+    every: require("./every"),
+    functionName: require("./function-name"),
+    orderByFirstCall: require("./order-by-first-call"),
+    prototypes: require("./prototypes"),
+    typeOf: require("./type-of"),
+    valueToString: require("./value-to-string"),
+};

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/index.test.js

@@ -0,0 +1,31 @@
+"use strict";
+
+var assert = require("@sinonjs/referee-sinon").assert;
+var index = require("./index");
+
+var expectedMethods = [
+    "calledInOrder",
+    "className",
+    "every",
+    "functionName",
+    "orderByFirstCall",
+    "typeOf",
+    "valueToString",
+];
+var expectedObjectProperties = ["deprecated", "prototypes"];
+
+describe("package", function () {
+    // eslint-disable-next-line mocha/no-setup-in-describe
+    expectedMethods.forEach(function (name) {
+        it(`should export a method named ${name}`, function () {
+            assert.isFunction(index[name]);
+        });
+    });
+
+    // eslint-disable-next-line mocha/no-setup-in-describe
+    expectedObjectProperties.forEach(function (name) {
+        it(`should export an object property named ${name}`, function () {
+            assert.isObject(index[name]);
+        });
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/order-by-first-call.js

@@ -0,0 +1,34 @@
+"use strict";
+
+var sort = require("./prototypes/array").sort;
+var slice = require("./prototypes/array").slice;
+
+/**
+ * @private
+ */
+function comparator(a, b) {
+    // uuid, won't ever be equal
+    var aCall = a.getCall(0);
+    var bCall = b.getCall(0);
+    var aId = (aCall && aCall.callId) || -1;
+    var bId = (bCall && bCall.callId) || -1;
+
+    return aId < bId ? -1 : 1;
+}
+
+/**
+ * A Sinon proxy object (fake, spy, stub)
+ * @typedef {object} SinonProxy
+ * @property {Function} getCall - A method that can return the first call
+ */
+
+/**
+ * Sorts an array of SinonProxy instances (fake, spy, stub) by their first call
+ * @param  {SinonProxy[] | SinonProxy} spies
+ * @returns {SinonProxy[]}
+ */
+function orderByFirstCall(spies) {
+    return sort(slice(spies), comparator);
+}
+
+module.exports = orderByFirstCall;

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/order-by-first-call.test.js

@@ -0,0 +1,52 @@
+"use strict";
+
+var assert = require("@sinonjs/referee-sinon").assert;
+var knuthShuffle = require("knuth-shuffle").knuthShuffle;
+var sinon = require("@sinonjs/referee-sinon").sinon;
+var orderByFirstCall = require("./order-by-first-call");
+
+describe("orderByFirstCall", function () {
+    it("should order an Array of spies by the callId of the first call, ascending", function () {
+        // create an array of spies
+        var spies = [
+            sinon.spy(),
+            sinon.spy(),
+            sinon.spy(),
+            sinon.spy(),
+            sinon.spy(),
+            sinon.spy(),
+        ];
+
+        // call all the spies
+        spies.forEach(function (spy) {
+            spy();
+        });
+
+        // add a few uncalled spies
+        spies.push(sinon.spy());
+        spies.push(sinon.spy());
+
+        // randomise the order of the spies
+        knuthShuffle(spies);
+
+        var sortedSpies = orderByFirstCall(spies);
+
+        assert.equals(sortedSpies.length, spies.length);
+
+        var orderedByFirstCall = sortedSpies.every(function (spy, index) {
+            if (index + 1 === sortedSpies.length) {
+                return true;
+            }
+            var nextSpy = sortedSpies[index + 1];
+
+            // uncalled spies should be ordered first
+            if (!spy.called) {
+                return true;
+            }
+
+            return spy.calledImmediatelyBefore(nextSpy);
+        });
+
+        assert.isTrue(orderedByFirstCall);
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/README.md

@@ -0,0 +1,43 @@
+# Prototypes
+
+The functions in this folder are to be use for keeping cached references to the built-in prototypes, so that people can't inadvertently break the library by making mistakes in userland.
+
+See https://github.com/sinonjs/sinon/pull/1523
+
+## Without cached references
+
+```js
+// in userland, the library user needs to replace the filter method on
+// Array.prototype
+var array = [1, 2, 3];
+sinon.replace(array, "filter", sinon.fake.returns(2));
+
+// in a sinon module, the library author needs to use the filter method
+var someArray = ["a", "b", 42, "c"];
+var answer = filter(someArray, function (v) {
+    return v === 42;
+});
+
+console.log(answer);
+// => 2
+```
+
+## With cached references
+
+```js
+// in userland, the library user needs to replace the filter method on
+// Array.prototype
+var array = [1, 2, 3];
+sinon.replace(array, "filter", sinon.fake.returns(2));
+
+// in a sinon module, the library author needs to use the filter method
+// get a reference to the original Array.prototype.filter
+var filter = require("@sinonjs/commons").prototypes.array.filter;
+var someArray = ["a", "b", 42, "c"];
+var answer = filter(someArray, function (v) {
+    return v === 42;
+});
+
+console.log(answer);
+// => 42
+```

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/array.js

@@ -0,0 +1,5 @@
+"use strict";
+
+var copyPrototype = require("./copy-prototype-methods");
+
+module.exports = copyPrototype(Array.prototype);

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/copy-prototype-methods.js

@@ -0,0 +1,40 @@
+"use strict";
+
+var call = Function.call;
+var throwsOnProto = require("./throws-on-proto");
+
+var disallowedProperties = [
+    // ignore size because it throws from Map
+    "size",
+    "caller",
+    "callee",
+    "arguments",
+];
+
+// This branch is covered when tests are run with `--disable-proto=throw`,
+// however we can test both branches at the same time, so this is ignored
+/* istanbul ignore next */
+if (throwsOnProto) {
+    disallowedProperties.push("__proto__");
+}
+
+module.exports = function copyPrototypeMethods(prototype) {
+    // eslint-disable-next-line @sinonjs/no-prototype-methods/no-prototype-methods
+    return Object.getOwnPropertyNames(prototype).reduce(function (
+        result,
+        name
+    ) {
+        if (disallowedProperties.includes(name)) {
+            return result;
+        }
+
+        if (typeof prototype[name] !== "function") {
+            return result;
+        }
+
+        result[name] = call.bind(prototype[name]);
+
+        return result;
+    },
+    Object.create(null));
+};

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/copy-prototype-methods.test.js

@@ -0,0 +1,12 @@
+"use strict";
+
+var refute = require("@sinonjs/referee-sinon").refute;
+var copyPrototypeMethods = require("./copy-prototype-methods");
+
+describe("copyPrototypeMethods", function () {
+    it("does not throw for Map", function () {
+        refute.exception(function () {
+            copyPrototypeMethods(Map.prototype);
+        });
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/function.js

@@ -0,0 +1,5 @@
+"use strict";
+
+var copyPrototype = require("./copy-prototype-methods");
+
+module.exports = copyPrototype(Function.prototype);

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/index.js

@@ -0,0 +1,10 @@
+"use strict";
+
+module.exports = {
+    array: require("./array"),
+    function: require("./function"),
+    map: require("./map"),
+    object: require("./object"),
+    set: require("./set"),
+    string: require("./string"),
+};

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/index.test.js

@@ -0,0 +1,61 @@
+"use strict";
+
+var assert = require("@sinonjs/referee-sinon").assert;
+
+var arrayProto = require("./index").array;
+var functionProto = require("./index").function;
+var mapProto = require("./index").map;
+var objectProto = require("./index").object;
+var setProto = require("./index").set;
+var stringProto = require("./index").string;
+var throwsOnProto = require("./throws-on-proto");
+
+describe("prototypes", function () {
+    describe(".array", function () {
+        // eslint-disable-next-line mocha/no-setup-in-describe
+        verifyProperties(arrayProto, Array);
+    });
+    describe(".function", function () {
+        // eslint-disable-next-line mocha/no-setup-in-describe
+        verifyProperties(functionProto, Function);
+    });
+    describe(".map", function () {
+        // eslint-disable-next-line mocha/no-setup-in-describe
+        verifyProperties(mapProto, Map);
+    });
+    describe(".object", function () {
+        // eslint-disable-next-line mocha/no-setup-in-describe
+        verifyProperties(objectProto, Object);
+    });
+    describe(".set", function () {
+        // eslint-disable-next-line mocha/no-setup-in-describe
+        verifyProperties(setProto, Set);
+    });
+    describe(".string", function () {
+        // eslint-disable-next-line mocha/no-setup-in-describe
+        verifyProperties(stringProto, String);
+    });
+});
+
+function verifyProperties(p, origin) {
+    var disallowedProperties = ["size", "caller", "callee", "arguments"];
+    if (throwsOnProto) {
+        disallowedProperties.push("__proto__");
+    }
+
+    it("should have all the methods of the origin prototype", function () {
+        var methodNames = Object.getOwnPropertyNames(origin.prototype).filter(
+            function (name) {
+                if (disallowedProperties.includes(name)) {
+                    return false;
+                }
+
+                return typeof origin.prototype[name] === "function";
+            }
+        );
+
+        methodNames.forEach(function (name) {
+            assert.isTrue(Object.prototype.hasOwnProperty.call(p, name), name);
+        });
+    });
+}

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/map.js

@@ -0,0 +1,5 @@
+"use strict";
+
+var copyPrototype = require("./copy-prototype-methods");
+
+module.exports = copyPrototype(Map.prototype);

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/object.js

@@ -0,0 +1,5 @@
+"use strict";
+
+var copyPrototype = require("./copy-prototype-methods");
+
+module.exports = copyPrototype(Object.prototype);

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/set.js

@@ -0,0 +1,5 @@
+"use strict";
+
+var copyPrototype = require("./copy-prototype-methods");
+
+module.exports = copyPrototype(Set.prototype);

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/string.js

@@ -0,0 +1,5 @@
+"use strict";
+
+var copyPrototype = require("./copy-prototype-methods");
+
+module.exports = copyPrototype(String.prototype);

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/prototypes/throws-on-proto.js

@@ -0,0 +1,24 @@
+"use strict";
+
+/**
+ * Is true when the environment causes an error to be thrown for accessing the
+ * __proto__ property.
+ * This is necessary in order to support `node --disable-proto=throw`.
+ *
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/proto
+ * @type {boolean}
+ */
+let throwsOnProto;
+try {
+    const object = {};
+    // eslint-disable-next-line no-proto, no-unused-expressions
+    object.__proto__;
+    throwsOnProto = false;
+} catch (_) {
+    // This branch is covered when tests are run with `--disable-proto=throw`,
+    // however we can test both branches at the same time, so this is ignored
+    /* istanbul ignore next */
+    throwsOnProto = true;
+}
+
+module.exports = throwsOnProto;

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/type-of.js

@@ -0,0 +1,12 @@
+"use strict";
+
+var type = require("type-detect");
+
+/**
+ * Returns the lower-case result of running type from type-detect on the value
+ * @param  {*} value
+ * @returns {string}
+ */
+module.exports = function typeOf(value) {
+    return type(value).toLowerCase();
+};

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/type-of.test.js

@@ -0,0 +1,51 @@
+"use strict";
+
+var assert = require("@sinonjs/referee-sinon").assert;
+var typeOf = require("./type-of");
+
+describe("typeOf", function () {
+    it("returns boolean", function () {
+        assert.equals(typeOf(false), "boolean");
+    });
+
+    it("returns string", function () {
+        assert.equals(typeOf("Sinon.JS"), "string");
+    });
+
+    it("returns number", function () {
+        assert.equals(typeOf(123), "number");
+    });
+
+    it("returns object", function () {
+        assert.equals(typeOf({}), "object");
+    });
+
+    it("returns function", function () {
+        assert.equals(
+            typeOf(function () {
+                return undefined;
+            }),
+            "function"
+        );
+    });
+
+    it("returns undefined", function () {
+        assert.equals(typeOf(undefined), "undefined");
+    });
+
+    it("returns null", function () {
+        assert.equals(typeOf(null), "null");
+    });
+
+    it("returns array", function () {
+        assert.equals(typeOf([]), "array");
+    });
+
+    it("returns regexp", function () {
+        assert.equals(typeOf(/.*/), "regexp");
+    });
+
+    it("returns date", function () {
+        assert.equals(typeOf(new Date()), "date");
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/value-to-string.js

@@ -0,0 +1,16 @@
+"use strict";
+
+/**
+ * Returns a string representation of the value
+ * @param  {*} value
+ * @returns {string}
+ */
+function valueToString(value) {
+    if (value && value.toString) {
+        // eslint-disable-next-line @sinonjs/no-prototype-methods/no-prototype-methods
+        return value.toString();
+    }
+    return String(value);
+}
+
+module.exports = valueToString;

github/codeql-action-v2/node_modules/@sinonjs/commons/lib/value-to-string.test.js

@@ -0,0 +1,20 @@
+"use strict";
+
+var assert = require("@sinonjs/referee-sinon").assert;
+var valueToString = require("./value-to-string");
+
+describe("util/core/valueToString", function () {
+    it("returns string representation of an object", function () {
+        var obj = {};
+
+        assert.equals(valueToString(obj), obj.toString());
+    });
+
+    it("returns 'null' for literal null'", function () {
+        assert.equals(valueToString(null), "null");
+    });
+
+    it("returns 'undefined' for literal undefined", function () {
+        assert.equals(valueToString(undefined), "undefined");
+    });
+});

github/codeql-action-v2/node_modules/@sinonjs/commons/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@sinonjs/commons",
+  "version": "3.0.1",
+  "description": "Simple functions shared among the sinon end user libraries",
+  "main": "lib/index.js",
+  "types": "./types/index.d.ts",
+  "scripts": {
+    "build": "rm -rf types && tsc",
+    "lint": "eslint .",
+    "precommit": "lint-staged",
+    "test": "mocha --recursive -R dot \"lib/**/*.test.js\"",
+    "test-check-coverage": "npm run test-coverage && nyc check-coverage --branches 100 --functions 100 --lines 100",
+    "test-coverage": "nyc --reporter text --reporter html --reporter lcovonly npm run test",
+    "prepublishOnly": "npm run build",
+    "prettier:check": "prettier --check '**/*.{js,css,md}'",
+    "prettier:write": "prettier --write '**/*.{js,css,md}'",
+    "preversion": "npm run test-check-coverage",
+    "version": "changes --commits --footer",
+    "postversion": "git push --follow-tags && npm publish",
+    "prepare": "husky install"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sinonjs/commons.git"
+  },
+  "files": [
+    "lib",
+    "types"
+  ],
+  "author": "",
+  "license": "BSD-3-Clause",
+  "bugs": {
+    "url": "https://github.com/sinonjs/commons/issues"
+  },
+  "homepage": "https://github.com/sinonjs/commons#readme",
+  "lint-staged": {
+    "*.{js,css,md}": "prettier --check",
+    "*.js": "eslint"
+  },
+  "devDependencies": {
+    "@sinonjs/eslint-config": "^4.0.6",
+    "@sinonjs/eslint-plugin-no-prototype-methods": "^0.1.0",
+    "@sinonjs/referee-sinon": "^10.1.0",
+    "@studio/changes": "^2.2.0",
+    "husky": "^6.0.0",
+    "jsverify": "0.8.4",
+    "knuth-shuffle": "^1.0.8",
+    "lint-staged": "^13.0.3",
+    "mocha": "^10.1.0",
+    "nyc": "^15.1.0",
+    "prettier": "^2.7.1",
+    "typescript": "^4.8.4"
+  },
+  "dependencies": {
+    "type-detect": "4.0.8"
+  }
+}

github/codeql-action-v2/node_modules/@sinonjs/commons/types/called-in-order.d.ts

@@ -0,0 +1,34 @@
+export = calledInOrder;
+/**
+ * A Sinon proxy object (fake, spy, stub)
+ * @typedef {object} SinonProxy
+ * @property {Function} calledBefore - A method that determines if this proxy was called before another one
+ * @property {string} id - Some id
+ * @property {number} callCount - Number of times this proxy has been called
+ */
+/**
+ * Returns true when the spies have been called in the order they were supplied in
+ * @param  {SinonProxy[] | SinonProxy} spies An array of proxies, or several proxies as arguments
+ * @returns {boolean} true when spies are called in order, false otherwise
+ */
+declare function calledInOrder(spies: SinonProxy[] | SinonProxy, ...args: any[]): boolean;
+declare namespace calledInOrder {
+    export { SinonProxy };
+}
+/**
+ * A Sinon proxy object (fake, spy, stub)
+ */
+type SinonProxy = {
+    /**
+     * - A method that determines if this proxy was called before another one
+     */
+    calledBefore: Function;
+    /**
+     * - Some id
+     */
+    id: string;
+    /**
+     * - Number of times this proxy has been called
+     */
+    callCount: number;
+};

github/codeql-action-v2/node_modules/@sinonjs/commons/types/class-name.d.ts

@@ -0,0 +1,7 @@
+export = className;
+/**
+ * Returns a display name for a value from a constructor
+ * @param  {object} value A value to examine
+ * @returns {(string|null)} A string or null
+ */
+declare function className(value: object): (string | null);

github/codeql-action-v2/node_modules/@sinonjs/commons/types/deprecated.d.ts

@@ -0,0 +1,3 @@
+export function wrap(func: Function, msg: string): Function;
+export function defaultMsg(packageName: string, funcName: string): string;
+export function printWarning(msg: string): undefined;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/every.d.ts

@@ -0,0 +1,2 @@
+declare function _exports(obj: object, fn: Function): boolean;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/function-name.d.ts

@@ -0,0 +1,2 @@
+declare function _exports(func: Function): string;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/global.d.ts

@@ -0,0 +1,6 @@
+export = globalObject;
+/**
+ * A reference to the global object
+ * @type {object} globalObject
+ */
+declare var globalObject: object;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/index.d.ts

@@ -0,0 +1,17 @@
+export const global: any;
+export const calledInOrder: typeof import("./called-in-order");
+export const className: typeof import("./class-name");
+export const deprecated: typeof import("./deprecated");
+export const every: (obj: any, fn: Function) => boolean;
+export const functionName: (func: Function) => string;
+export const orderByFirstCall: typeof import("./order-by-first-call");
+export const prototypes: {
+    array: any;
+    function: any;
+    map: any;
+    object: any;
+    set: any;
+    string: any;
+};
+export const typeOf: (value: any) => string;
+export const valueToString: typeof import("./value-to-string");

github/codeql-action-v2/node_modules/@sinonjs/commons/types/order-by-first-call.d.ts

@@ -0,0 +1,24 @@
+export = orderByFirstCall;
+/**
+ * A Sinon proxy object (fake, spy, stub)
+ * @typedef {object} SinonProxy
+ * @property {Function} getCall - A method that can return the first call
+ */
+/**
+ * Sorts an array of SinonProxy instances (fake, spy, stub) by their first call
+ * @param  {SinonProxy[] | SinonProxy} spies
+ * @returns {SinonProxy[]}
+ */
+declare function orderByFirstCall(spies: SinonProxy[] | SinonProxy): SinonProxy[];
+declare namespace orderByFirstCall {
+    export { SinonProxy };
+}
+/**
+ * A Sinon proxy object (fake, spy, stub)
+ */
+type SinonProxy = {
+    /**
+     * - A method that can return the first call
+     */
+    getCall: Function;
+};

github/codeql-action-v2/node_modules/@sinonjs/commons/types/prototypes/array.d.ts

@@ -0,0 +1,2 @@
+declare const _exports: any;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/prototypes/copy-prototype-methods.d.ts

@@ -0,0 +1,2 @@
+declare function _exports(prototype: any): any;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/prototypes/function.d.ts

@@ -0,0 +1,2 @@
+declare const _exports: any;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/prototypes/index.d.ts

@@ -0,0 +1,7 @@
+export declare const array: any;
+declare const _function: any;
+export { _function as function };
+export declare const map: any;
+export declare const object: any;
+export declare const set: any;
+export declare const string: any;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/prototypes/map.d.ts

@@ -0,0 +1,2 @@
+declare const _exports: any;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/prototypes/object.d.ts

@@ -0,0 +1,2 @@
+declare const _exports: any;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/prototypes/set.d.ts

@@ -0,0 +1,2 @@
+declare const _exports: any;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/prototypes/string.d.ts

@@ -0,0 +1,2 @@
+declare const _exports: any;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/prototypes/throws-on-proto.d.ts

@@ -0,0 +1,10 @@
+export = throwsOnProto;
+/**
+ * Is true when the environment causes an error to be thrown for accessing the
+ * __proto__ property.
+ * This is necessary in order to support `node --disable-proto=throw`.
+ *
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/proto
+ * @type {boolean}
+ */
+declare let throwsOnProto: boolean;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/type-of.d.ts

@@ -0,0 +1,2 @@
+declare function _exports(value: any): string;
+export = _exports;

github/codeql-action-v2/node_modules/@sinonjs/commons/types/value-to-string.d.ts

@@ -0,0 +1,7 @@
+export = valueToString;
+/**
+ * Returns a string representation of the value
+ * @param  {*} value
+ * @returns {string}
+ */
+declare function valueToString(value: any): string;

github/codeql-action-v2/node_modules/@sinonjs/fake-timers/LICENSE

@@ -0,0 +1,11 @@
+Copyright (c) 2010-2014, Christian Johansen, christian@cjohansen.no. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 

github/codeql-action-v2/node_modules/@sinonjs/fake-timers/README.md

@@ -0,0 +1,394 @@
+# `@sinonjs/fake-timers`
+
+[![codecov](https://codecov.io/gh/sinonjs/fake-timers/branch/main/graph/badge.svg)](https://codecov.io/gh/sinonjs/fake-timers)
+<a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-v2.0%20adopted-ff69b4.svg" alt="Contributor Covenant" /></a>
+
+JavaScript implementation of the timer
+APIs; `setTimeout`, `clearTimeout`, `setImmediate`, `clearImmediate`, `setInterval`, `clearInterval`, `requestAnimationFrame`, `cancelAnimationFrame`, `requestIdleCallback`,
+and `cancelIdleCallback`, along with a clock instance that controls the flow of time. FakeTimers also provides a `Date`
+implementation that gets its time from the clock.
+
+In addition in browser environment `@sinonjs/fake-timers` provides a `performance` implementation that gets its time
+from the clock. In Node environments FakeTimers provides a `nextTick` implementation that is synchronized with the
+clock - and a `process.hrtime` shim that works with the clock.
+
+`@sinonjs/fake-timers` can be used to simulate passing time in automated tests and other
+situations where you want the scheduling semantics, but don't want to actually
+wait.
+
+`@sinonjs/fake-timers` is extracted from [Sinon.JS](https://github.com/sinonjs/sinon.js) and targets
+the [same runtimes](https://sinonjs.org/releases/latest/#supported-runtimes).
+
+## Autocomplete, IntelliSense and TypeScript definitions
+
+Version 7 introduced JSDoc to the codebase. This should provide autocomplete and type suggestions in supporting IDEs. If
+you need more elaborate type support, TypeScript definitions for the Sinon projects are independently maintained by the
+Definitely Types community:
+
+```
+npm install -D @types/sinonjs__fake-timers
+```
+
+## Installation
+
+`@sinonjs/fake-timers` can be used in both Node and browser environments. Installation is as easy as
+
+```sh
+npm install @sinonjs/fake-timers
+```
+
+If you want to use `@sinonjs/fake-timers` in a browser you can either build your own bundle or
+use [Skypack](https://www.skypack.dev).
+
+## Usage
+
+To use `@sinonjs/fake-timers`, create a new clock, schedule events on it using the timer
+functions and pass time using the `tick` method.
+
+```js
+// In the browser distribution, a global `FakeTimers` is already available
+var FakeTimers = require("@sinonjs/fake-timers");
+var clock = FakeTimers.createClock();
+
+clock.setTimeout(function () {
+    console.log(
+        "The poblano is a mild chili pepper originating in the state of Puebla, Mexico.",
+    );
+}, 15);
+
+// ...
+
+clock.tick(15);
+```
+
+Upon executing the last line, an interesting fact about the
+[Poblano](https://en.wikipedia.org/wiki/Poblano) will be printed synchronously to
+the screen. If you want to simulate asynchronous behavior, please see the `async` function variants (
+eg `clock.tick(time)` vs `await clock.tickAsync(time)`).
+
+The `next`, `runAll`, `runToFrame`, and `runToLast` methods are available to advance the clock. See the
+API Reference for more details.
+
+### Faking the native timers
+
+When using `@sinonjs/fake-timers` to test timers, you will most likely want to replace the native
+timers such that calling `setTimeout` actually schedules a callback with your
+clock instance, not the browser's internals.
+
+Calling `install` with no arguments achieves this. You can call `uninstall`
+later to restore things as they were again.
+Note that in NodeJS the [timers](https://nodejs.org/api/timers.html)
+and [timers/promises](https://nodejs.org/api/timers.html#timers-promises-api) modules will also receive fake timers when
+using global scope.
+
+```js
+// In the browser distribution, a global `FakeTimers` is already available
+var FakeTimers = require("@sinonjs/fake-timers");
+
+var clock = FakeTimers.install();
+// Equivalent to
+// var clock = FakeTimers.install(typeof global !== "undefined" ? global : window);
+
+setTimeout(fn, 15); // Schedules with clock.setTimeout
+
+clock.uninstall();
+// setTimeout is restored to the native implementation
+```
+
+To hijack timers in another context pass it to the `install` method.
+
+```js
+var FakeTimers = require("@sinonjs/fake-timers");
+var context = {
+    setTimeout: setTimeout, // By default context.setTimeout uses the global setTimeout
+};
+var clock = FakeTimers.withGlobal(context).install();
+
+context.setTimeout(fn, 15); // Schedules with clock.setTimeout
+
+clock.uninstall();
+// context.setTimeout is restored to the original implementation
+```
+
+Usually you want to install the timers onto the global object, so call `install`
+without arguments.
+
+#### Automatically incrementing mocked time
+
+FakeTimers supports the possibility to attach the faked timers to any change
+in the real system time. This means that there is no need to `tick()` the
+clock in a situation where you won't know **when** to call `tick()`.
+
+Please note that this is achieved using the original setImmediate() API at a certain
+configurable interval `config.advanceTimeDelta` (default: 20ms). Meaning time would
+be incremented every 20ms, not in real time.
+
+An example would be:
+
+```js
+var FakeTimers = require("@sinonjs/fake-timers");
+var clock = FakeTimers.install({
+    shouldAdvanceTime: true,
+    advanceTimeDelta: 40,
+});
+
+setTimeout(() => {
+    console.log("this just timed out"); //executed after 40ms
+}, 30);
+
+setImmediate(() => {
+    console.log("not so immediate"); //executed after 40ms
+});
+
+setTimeout(() => {
+    console.log("this timed out after"); //executed after 80ms
+    clock.uninstall();
+}, 50);
+```
+
+## API Reference
+
+### `var clock = FakeTimers.createClock([now[, loopLimit]])`
+
+Creates a clock. The default
+[epoch](https://en.wikipedia.org/wiki/Epoch_%28reference_date%29) is `0`.
+
+The `now` argument may be a number (in milliseconds) or a Date object.
+
+The `loopLimit` argument sets the maximum number of timers that will be run when calling `runAll()` before assuming that
+we have an infinite loop and throwing an error. The default is `1000`.
+
+### `var clock = FakeTimers.install([config])`
+
+Installs FakeTimers using the specified config (otherwise with epoch `0` on the global scope).
+Note that in NodeJS the [timers](https://nodejs.org/api/timers.html)
+and [timers/promises](https://nodejs.org/api/timers.html#timers-promises-api) modules will also receive fake timers when
+using global scope.
+The following configuration options are available
+
+| Parameter                        | Type        | Default                                                                                                                                                                                                                        | Description                                                                                                                                                                                                                                                            |
+| -------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `config.now`                     | Number/Date | 0                                                                                                                                                                                                                              | installs FakeTimers with the specified unix epoch                                                                                                                                                                                                                      |
+| `config.toFake`                  | String[]    | ["setTimeout", "clearTimeout", "setImmediate", "clearImmediate","setInterval", "clearInterval", "Date", "requestAnimationFrame", "cancelAnimationFrame", "requestIdleCallback", "cancelIdleCallback", "hrtime", "performance"] | an array with explicit function names (or objects, in the case of "performance") to hijack. \_When not set, FakeTimers will automatically fake all methods e.g., `FakeTimers.install({ toFake: ["setTimeout","nextTick"]})` will fake only `setTimeout` and `nextTick` |
+| `config.loopLimit`               | Number      | 1000                                                                                                                                                                                                                           | the maximum number of timers that will be run when calling runAll()                                                                                                                                                                                                    |
+| `config.shouldAdvanceTime`       | Boolean     | false                                                                                                                                                                                                                          | tells FakeTimers to increment mocked time automatically based on the real system time shift (e.g. the mocked time will be incremented by 20ms for every 20ms change in the real system time)                                                                           |
+| `config.advanceTimeDelta`        | Number      | 20                                                                                                                                                                                                                             | relevant only when using with `shouldAdvanceTime: true`. increment mocked time by `advanceTimeDelta` ms every `advanceTimeDelta` ms change in the real system time.                                                                                                    |
+| `config.shouldClearNativeTimers` | Boolean     | false                                                                                                                                                                                                                          | tells FakeTimers to clear 'native' (i.e. not fake) timers by delegating to their respective handlers. These are not cleared by default, leading to potentially unexpected behavior if timers existed prior to installing FakeTimers.                                   |
+| `config.ignoreMissingTimers`     | Boolean     | false                                                                                                                                                                                                                          | tells FakeTimers to ignore missing timers that might not exist in the given environment                                                                                                                                                                                |
+
+### `var id = clock.setTimeout(callback, timeout)`
+
+Schedules the callback to be fired once `timeout` milliseconds have ticked by.
+
+In Node.js `setTimeout` returns a timer object. FakeTimers will do the same, however
+its `ref()` and `unref()` methods have no effect.
+
+In browsers a timer ID is returned.
+
+### `clock.clearTimeout(id)`
+
+Clears the timer given the ID or timer object, as long as it was created using
+`setTimeout`.
+
+### `var id = clock.setInterval(callback, timeout)`
+
+Schedules the callback to be fired every time `timeout` milliseconds have ticked
+by.
+
+In Node.js `setInterval` returns a timer object. FakeTimers will do the same, however
+its `ref()` and `unref()` methods have no effect.
+
+In browsers a timer ID is returned.
+
+### `clock.clearInterval(id)`
+
+Clears the timer given the ID or timer object, as long as it was created using
+`setInterval`.
+
+### `var id = clock.setImmediate(callback)`
+
+Schedules the callback to be fired once `0` milliseconds have ticked by. Note
+that you'll still have to call `clock.tick()` for the callback to fire. If
+called during a tick the callback won't fire until `1` millisecond has ticked
+by.
+
+In Node.js `setImmediate` returns a timer object. FakeTimers will do the same,
+however its `ref()` and `unref()` methods have no effect.
+
+In browsers a timer ID is returned.
+
+### `clock.clearImmediate(id)`
+
+Clears the timer given the ID or timer object, as long as it was created using
+`setImmediate`.
+
+### `clock.requestAnimationFrame(callback)`
+
+Schedules the callback to be fired on the next animation frame, which runs every
+16 ticks. Returns an `id` which can be used to cancel the callback. This is
+available in both browser & node environments.
+
+### `clock.cancelAnimationFrame(id)`
+
+Cancels the callback scheduled by the provided id.
+
+### `clock.requestIdleCallback(callback[, timeout])`
+
+Queued the callback to be fired during idle periods to perform background and low priority work on the main event loop.
+Callbacks which have a timeout option will be fired no later than time in milliseconds. Returns an `id` which can be
+used to cancel the callback.
+
+### `clock.cancelIdleCallback(id)`
+
+Cancels the callback scheduled by the provided id.
+
+### `clock.countTimers()`
+
+Returns the number of waiting timers. This can be used to assert that a test
+finishes without leaking any timers.
+
+### `clock.hrtime(prevTime?)`
+
+Only available in Node.js, mimicks process.hrtime().
+
+### `clock.nextTick(callback)`
+
+Only available in Node.js, mimics `process.nextTick` to enable completely synchronous testing flows.
+
+### `clock.performance.now()`
+
+Only available in browser environments, mimicks performance.now().
+
+### `clock.tick(time)` / `await clock.tickAsync(time)`
+
+Advance the clock, firing callbacks if necessary. `time` may be the number of
+milliseconds to advance the clock by or a human-readable string. Valid string
+formats are `"08"` for eight seconds, `"01:00"` for one minute and `"02:34:10"`
+for two hours, 34 minutes and ten seconds.
+
+The `tickAsync()` will also break the event loop, allowing any scheduled promise
+callbacks to execute _before_ running the timers.
+
+### `clock.next()` / `await clock.nextAsync()`
+
+Advances the clock to the the moment of the first scheduled timer, firing it.
+
+The `nextAsync()` will also break the event loop, allowing any scheduled promise
+callbacks to execute _before_ running the timers.
+
+### `clock.jump(time)`
+
+Advance the clock by jumping forward in time, firing callbacks at most once.
+`time` takes the same formats as [`clock.tick`](#clockticktime--await-clocktickasynctime).
+
+This can be used to simulate the JS engine (such as a browser) being put to sleep and resumed later, skipping
+intermediary timers.
+
+### `clock.reset()`
+
+Removes all timers and ticks without firing them, and sets `now` to `config.now`
+that was provided to `FakeTimers.install` or to `0` if `config.now` was not provided.
+Useful to reset the state of the clock without having to `uninstall` and `install` it.
+
+### `clock.runAll()` / `await clock.runAllAsync()`
+
+This runs all pending timers until there are none remaining. If new timers are added while it is executing they will be
+run as well.
+
+This makes it easier to run asynchronous tests to completion without worrying about the number of timers they use, or
+the delays in those timers.
+
+It runs a maximum of `loopLimit` times after which it assumes there is an infinite loop of timers and throws an error.
+
+The `runAllAsync()` will also break the event loop, allowing any scheduled promise
+callbacks to execute _before_ running the timers.
+
+### `clock.runMicrotasks()`
+
+This runs all pending microtasks scheduled with `nextTick` but none of the timers and is mostly useful for libraries
+using FakeTimers underneath and for running `nextTick` items without any timers.
+
+### `clock.runToFrame()`
+
+Advances the clock to the next frame, firing all scheduled animation frame callbacks,
+if any, for that frame as well as any other timers scheduled along the way.
+
+### `clock.runToLast()` / `await clock.runToLastAsync()`
+
+This takes note of the last scheduled timer when it is run, and advances the
+clock to that time firing callbacks as necessary.
+
+If new timers are added while it is executing they will be run only if they
+would occur before this time.
+
+This is useful when you want to run a test to completion, but the test recursively
+sets timers that would cause `runAll` to trigger an infinite loop warning.
+
+The `runToLastAsync()` will also break the event loop, allowing any scheduled promise
+callbacks to execute _before_ running the timers.
+
+### `clock.setSystemTime([now])`
+
+This simulates a user changing the system clock while your program is running.
+It affects the current time but it does not in itself cause e.g. timers to fire;
+they will fire exactly as they would have done without the call to
+setSystemTime().
+
+### `clock.uninstall()`
+
+Restores the original methods of the native timers or the methods on the object
+that was passed to `FakeTimers.withGlobal`
+
+### `Date`
+
+Implements the `Date` object but using the clock to provide the correct time.
+
+### `Performance`
+
+Implements the `now` method of the [`Performance`](https://developer.mozilla.org/en-US/docs/Web/API/Performance/now)
+object but using the clock to provide the correct time. Only available in environments that support the Performance
+object (browsers mostly).
+
+### `FakeTimers.withGlobal`
+
+In order to support creating clocks based on separate or sandboxed environments (such as JSDOM), FakeTimers exports a
+factory method which takes single argument `global`, which it inspects to figure out what to mock and what features to
+support. When invoking this function with a global, you will get back an object with `timers`, `createClock`
+and `install` - same as the regular FakeTimers exports only based on the passed in global instead of the global
+environment.
+
+## Promises and fake time
+
+If you use a Promise library like Bluebird, note that you should either call `clock.runMicrotasks()` or make sure to
+_not_ mock `nextTick`.
+
+## Running tests
+
+FakeTimers has a comprehensive test suite. If you're thinking of contributing bug
+fixes or suggesting new features, you need to make sure you have not broken any
+tests. You are also expected to add tests for any new behavior.
+
+### On node:
+
+```sh
+npm test
+```
+
+Or, if you prefer more verbose output:
+
+```
+$(npm bin)/mocha ./test/fake-timers-test.js
+```
+
+### In the browser
+
+[Mochify](https://github.com/mochify-js) is used to run the tests in headless
+Chrome.
+
+```sh
+npm test-headless
+```
+
+## License
+
+BSD 3-clause "New" or "Revised" License (see LICENSE file)

github/codeql-action-v2/node_modules/@sinonjs/fake-timers/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@sinonjs/fake-timers",
+  "description": "Fake JavaScript timers",
+  "version": "13.0.2",
+  "homepage": "https://github.com/sinonjs/fake-timers",
+  "author": "Christian Johansen",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sinonjs/fake-timers.git"
+  },
+  "bugs": {
+    "mail": "christian@cjohansen.no",
+    "url": "https://github.com/sinonjs/fake-timers/issues"
+  },
+  "license": "BSD-3-Clause",
+  "scripts": {
+    "lint": "eslint .",
+    "test-node": "mocha --timeout 200 test/ integration-test/ -R dot --check-leaks",
+    "test-headless": "mochify --driver puppeteer",
+    "test-check-coverage": "npm run test-coverage && nyc check-coverage",
+    "test-cloud": "npm run test-edge && npm run test-firefox && npm run test-safari",
+    "test-edge": "BROWSER_NAME=MicrosoftEdge mochify --config mochify.webdriver.js",
+    "test-firefox": "BROWSER_NAME=firefox mochify --config mochify.webdriver.js",
+    "test-safari": "BROWSER_NAME=safari mochify --config mochify.webdriver.js",
+    "test-coverage": "nyc -x mochify.webdriver.js -x coverage --all --reporter text --reporter html --reporter lcovonly npm run test-node",
+    "test": "npm run test-node && npm run test-headless",
+    "prettier:check": "prettier --check '**/*.{js,css,md}'",
+    "prettier:write": "prettier --write '**/*.{js,css,md}'",
+    "preversion": "./scripts/preversion.sh",
+    "version": "./scripts/version.sh",
+    "postversion": "./scripts/postversion.sh",
+    "prepare": "husky"
+  },
+  "lint-staged": {
+    "*.{js,css,md}": "prettier --check",
+    "*.js": "eslint"
+  },
+  "mochify": {
+    "reporter": "dot",
+    "timeout": 10000,
+    "bundle": "esbuild --bundle --sourcemap=inline --define:process.env.NODE_DEBUG=\"\"",
+    "bundle_stdin": "require",
+    "spec": "test/**/*-test.js"
+  },
+  "files": [
+    "src/"
+  ],
+  "devDependencies": {
+    "@mochify/cli": "^0.4.1",
+    "@mochify/driver-puppeteer": "^0.4.0",
+    "@mochify/driver-webdriver": "^0.2.1",
+    "@sinonjs/eslint-config": "^5.0.3",
+    "@sinonjs/referee-sinon": "12.0.0",
+    "esbuild": "^0.23.1",
+    "husky": "^9.1.5",
+    "jsdom": "24.1.1",
+    "lint-staged": "15.2.9",
+    "mocha": "10.7.3",
+    "nyc": "17.0.0",
+    "prettier": "3.3.3"
+  },
+  "main": "./src/fake-timers-src.js",
+  "dependencies": {
+    "@sinonjs/commons": "^3.0.1"
+  },
+  "nyc": {
+    "branches": 85,
+    "lines": 92,
+    "functions": 92,
+    "statements": 92,
+    "exclude": [
+      "**/*-test.js",
+      "coverage/**",
+      "types/**",
+      "fake-timers.js"
+    ]
+  }
+}

github/codeql-action-v2/node_modules/@sinonjs/samsam/LICENSE

@@ -0,0 +1,27 @@
+(The BSD License)
+
+Copyright (c) 2010-2012, Christian Johansen, christian@cjohansen.no and
+August Lilleaas, august.lilleaas@gmail.com. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright notice,
+      this list of conditions and the following disclaimer in the documentation
+      and/or other materials provided with the distribution.
+    * Neither the name of Christian Johansen nor the names of his contributors
+      may be used to endorse or promote products derived from this software
+      without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

github/codeql-action-v2/node_modules/@sinonjs/samsam/README.md

@@ -0,0 +1,83 @@
+# samsam
+
+[![CircleCI](https://circleci.com/gh/sinonjs/samsam.svg?style=svg)](https://circleci.com/gh/sinonjs/samsam)
+[![Coverage status](https://codecov.io/gh/sinonjs/samsam/branch/main/graph/badge.svg)](https://codecov.io/gh/sinonjs/samsam)
+<a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-v2.0%20adopted-ff69b4.svg" alt="Contributor Covenant" /></a>
+
+Value identification and comparison functions
+
+Documentation: http://sinonjs.github.io/samsam/
+
+## Backers
+
+Support us with a monthly donation and help us continue our activities. [[Become a backer](https://opencollective.com/sinon#backer)]
+
+<a href="https://opencollective.com/sinon/backer/0/website" target="_blank"><img src="https://opencollective.com/sinon/backer/0/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/1/website" target="_blank"><img src="https://opencollective.com/sinon/backer/1/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/2/website" target="_blank"><img src="https://opencollective.com/sinon/backer/2/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/3/website" target="_blank"><img src="https://opencollective.com/sinon/backer/3/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/4/website" target="_blank"><img src="https://opencollective.com/sinon/backer/4/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/5/website" target="_blank"><img src="https://opencollective.com/sinon/backer/5/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/6/website" target="_blank"><img src="https://opencollective.com/sinon/backer/6/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/7/website" target="_blank"><img src="https://opencollective.com/sinon/backer/7/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/8/website" target="_blank"><img src="https://opencollective.com/sinon/backer/8/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/9/website" target="_blank"><img src="https://opencollective.com/sinon/backer/9/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/10/website" target="_blank"><img src="https://opencollective.com/sinon/backer/10/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/11/website" target="_blank"><img src="https://opencollective.com/sinon/backer/11/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/12/website" target="_blank"><img src="https://opencollective.com/sinon/backer/12/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/13/website" target="_blank"><img src="https://opencollective.com/sinon/backer/13/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/14/website" target="_blank"><img src="https://opencollective.com/sinon/backer/14/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/15/website" target="_blank"><img src="https://opencollective.com/sinon/backer/15/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/16/website" target="_blank"><img src="https://opencollective.com/sinon/backer/16/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/17/website" target="_blank"><img src="https://opencollective.com/sinon/backer/17/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/18/website" target="_blank"><img src="https://opencollective.com/sinon/backer/18/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/19/website" target="_blank"><img src="https://opencollective.com/sinon/backer/19/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/20/website" target="_blank"><img src="https://opencollective.com/sinon/backer/20/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/21/website" target="_blank"><img src="https://opencollective.com/sinon/backer/21/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/22/website" target="_blank"><img src="https://opencollective.com/sinon/backer/22/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/23/website" target="_blank"><img src="https://opencollective.com/sinon/backer/23/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/24/website" target="_blank"><img src="https://opencollective.com/sinon/backer/24/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/25/website" target="_blank"><img src="https://opencollective.com/sinon/backer/25/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/26/website" target="_blank"><img src="https://opencollective.com/sinon/backer/26/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/27/website" target="_blank"><img src="https://opencollective.com/sinon/backer/27/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/28/website" target="_blank"><img src="https://opencollective.com/sinon/backer/28/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/backer/29/website" target="_blank"><img src="https://opencollective.com/sinon/backer/29/avatar.svg"></a>
+
+## Sponsors
+
+Become a sponsor and get your logo on our README on GitHub with a link to your site. [[Become a sponsor](https://opencollective.com/sinon#sponsor)]
+
+<a href="https://opencollective.com/sinon/sponsor/0/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/0/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/1/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/1/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/2/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/2/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/3/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/3/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/4/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/4/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/5/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/5/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/6/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/6/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/7/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/7/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/8/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/8/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/9/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/9/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/10/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/10/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/11/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/11/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/12/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/12/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/13/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/13/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/14/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/14/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/15/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/15/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/16/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/16/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/17/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/17/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/18/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/18/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/19/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/19/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/20/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/20/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/21/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/21/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/22/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/22/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/23/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/23/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/24/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/24/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/25/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/25/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/26/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/26/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/27/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/27/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/28/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/28/avatar.svg"></a>
+<a href="https://opencollective.com/sinon/sponsor/29/website" target="_blank"><img src="https://opencollective.com/sinon/sponsor/29/avatar.svg"></a>
+
+## Licence
+
+samsam was released under [BSD-3](LICENSE)

github/codeql-action-v2/node_modules/@sinonjs/samsam/docs/index.md

@@ -0,0 +1,390 @@
+# samsam
+
+> Same same, but different
+
+`samsam` is a collection of predicate and comparison functions useful for
+identifiying the type of values and to compare values with varying degrees of
+strictness.
+
+`samsam` is a general-purpose library. It works in browsers and Node. It will
+define itself as an AMD module if you want it to (i.e. if there's a `define`
+function available).
+
+## Predicate functions
+
+### `isArguments(value)`
+
+Returns `true` if `value` is an `arguments` object, `false` otherwise.
+
+### `isNegZero(value)`
+
+Returns `true` if `value` is `-0`.
+
+### `isElement(value)`
+
+Returns `true` if `value` is a DOM element node. Unlike
+Underscore.js/lodash, this function will return `false` if `value` is an
+_element-like_ object, i.e. a regular object with a `nodeType` property that
+holds the value `1`.
+
+### `isSet(value)`
+
+Returns `true` if `value` is a [Set](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Set).
+
+## Comparison functions
+
+### `identical(x, y)`
+
+Strict equality check according to EcmaScript Harmony's `egal`.
+
+**From the Harmony wiki:**
+
+> An egal function simply makes available the internal `SameValue` function
+> from section 9.12 of the ES5 spec. If two values are egal, then they are not
+> observably distinguishable.
+
+`identical` returns `true` when `===` is `true`, except for `-0` and
+`+0`, where it returns `false`. Additionally, it returns `true` when
+`NaN` is compared to itself.
+
+### `deepEqual(actual, expectation)`
+
+Deep equal comparison. Two values are "deep equal" if:
+
+-   They are identical
+-   They are both date objects representing the same time
+-   They are both arrays containing elements that are all deepEqual
+-   They are objects with the same set of properties, and each property
+    in `actual` is deepEqual to the corresponding property in `expectation`
+
+    -   `actual` can have [symbolic properties](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol) that are missing from `expectation`
+
+### Matcher
+
+Match values and objects by type or or other fuzzy criteria. `samsam` ships
+with these built in matchers:
+
+#### `sinon.match.any`
+
+Matches anything.
+
+#### `sinon.match.defined`
+
+Requires the value to be defined.
+
+#### `sinon.match.truthy`
+
+Requires the value to be truthy.
+
+#### `sinon.match.falsy`
+
+Requires the value to be falsy.
+
+#### `sinon.match.bool`
+
+Requires the value to be a `Boolean`
+
+#### `sinon.match.number`
+
+Requires the value to be a `Number`.
+
+#### `sinon.match.string`
+
+Requires the value to be a `String`.
+
+#### `sinon.match.object`
+
+Requires the value to be an `Object`.
+
+#### `sinon.match.func`
+
+Requires the value to be a `Function`.
+
+#### `sinon.match.array`
+
+Requires the value to be an `Array`.
+
+#### `sinon.match.array.deepEquals(arr)`
+
+Requires an `Array` to be deep equal another one.
+
+#### `sinon.match.array.startsWith(arr)`
+
+Requires an `Array` to start with the same values as another one.
+
+#### `sinon.match.array.endsWith(arr)`
+
+Requires an `Array` to end with the same values as another one.
+
+#### `sinon.match.array.contains(arr)`
+
+Requires an `Array` to contain each one of the values the given array has.
+
+#### `sinon.match.map`
+
+Requires the value to be a `Map`.
+
+#### `sinon.match.map.deepEquals(map)`
+
+Requires a `Map` to be deep equal another one.
+
+#### `sinon.match.map.contains(map)`
+
+Requires a `Map` to contain each one of the items the given map has.
+
+#### `sinon.match.set`
+
+Requires the value to be a `Set`.
+
+#### `sinon.match.set.deepEquals(set)`
+
+Requires a `Set` to be deep equal another one.
+
+#### `sinon.match.set.contains(set)`
+
+Requires a `Set` to contain each one of the items the given set has.
+
+#### `sinon.match.regexp`
+
+Requires the value to be a regular expression.
+
+#### `sinon.match.date`
+
+Requires the value to be a `Date` object.
+
+#### `sinon.match.symbol`
+
+Requires the value to be a `Symbol`.
+
+#### `sinon.match.in(array)`
+
+Requires the value to be in the `array`.
+
+#### `sinon.match.same(ref)`
+
+Requires the value to strictly equal `ref`.
+
+#### `sinon.match.typeOf(type)`
+
+Requires the value to be of the given type, where `type` can be one of
+`"undefined"`,
+`"null"`,
+`"boolean"`,
+`"number"`,
+`"string"`,
+`"object"`,
+`"function"`,
+`"array"`,
+`"regexp"`,
+`"date"` or
+`"symbol"`.
+
+#### `sinon.match.instanceOf(type)`
+
+Requires the value to be an instance of the given `type`.
+
+#### `sinon.match.has(property[, expectation])`
+
+Requires the value to define the given `property`.
+
+The property might be inherited via the prototype chain. If the optional expectation is given, the value of the property is deeply compared with the expectation. The expectation can be another matcher.
+
+#### `sinon.match.hasOwn(property[, expectation])`
+
+Same as `sinon.match.has` but the property must be defined by the value itself. Inherited properties are ignored.
+
+#### `sinon.match.hasNested(propertyPath[, expectation])`
+
+Requires the value to define the given `propertyPath`. Dot (`prop.prop`) and bracket (`prop[0]`) notations are supported as in [Lodash.get](https://lodash.com/docs/4.4.2#get).
+
+The propertyPath might be inherited via the prototype chain. If the optional expectation is given, the value at the propertyPath is deeply compared with the expectation. The expectation can be another matcher.
+
+```javascript
+sinon.match.hasNested("a[0].b.c");
+
+// Where actual is something like
+var actual = { a: [{ b: { c: 3 } }] };
+
+sinon.match.hasNested("a.b.c");
+
+// Where actual is something like
+var actual = { a: { b: { c: 3 } } };
+```
+
+#### `sinon.match.every(matcher)`
+
+Requires **every** element of an `Array`, `Set` or `Map`, or alternatively **every** value of an `Object` to match the given `matcher`.
+
+#### `sinon.match.some(matcher)`
+
+Requires **any** element of an `Array`, `Set` or `Map`, or alternatively **any** value of an `Object` to match the given `matcher`.
+
+## Combining matchers
+
+All matchers implement `and` and `or`. This allows to logically combine mutliple matchers. The result is a new matchers that requires both (and) or one of the matchers (or) to return `true`.
+
+```javascript
+var stringOrNumber = sinon.match.string.or(sinon.match.number);
+var bookWithPages = sinon.match.instanceOf(Book).and(sinon.match.has("pages"));
+```
+
+### `match(object, matcher)`
+
+Creates a custom matcher to perform partial equality check. Compares `object`
+with matcher according a wide set of rules:
+
+#### String matcher
+
+In its simplest form, `match` performs a case insensitive substring match.
+When the matcher is a string, `object` is converted to a string, and the
+function returns `true` if the matcher is a case-insensitive substring of
+`object` as a string.
+
+```javascript
+samsam.match("Give me something", "Give"); //true
+samsam.match("Give me something", "sumptn"); // false
+samsam.match(
+    {
+        toString: function () {
+            return "yeah";
+        },
+    },
+    "Yeah!",
+); // true
+```
+
+The last example is not symmetric. When the matcher is a string, the `object`
+is coerced to a string - in this case using `toString`. Changing the order of
+the arguments would cause the matcher to be an object, in which case different
+rules apply (see below).
+
+#### Boolean matcher
+
+Performs a strict (i.e. `===`) match with the object. So, only `true`
+matches `true`, and only `false` matches `false`.
+
+#### Regular expression matcher
+
+When the matcher is a regular expression, the function will pass if
+`object.test(matcher)` is `true`. `match` is written in a generic way, so
+any object with a `test` method will be used as a matcher this way.
+
+```javascript
+samsam.match("Give me something", /^[a-z\s]$/i); // true
+samsam.match("Give me something", /[0-9]/); // false
+samsam.match(
+    {
+        toString: function () {
+            return "yeah!";
+        },
+    },
+    /yeah/,
+); // true
+samsam.match(234, /[a-z]/); // false
+```
+
+#### Number matcher
+
+When the matcher is a number, the assertion will pass if `object == matcher`.
+
+```javascript
+samsam.match("123", 123); // true
+samsam.match("Give me something", 425); // false
+samsam.match(
+    {
+        toString: function () {
+            return "42";
+        },
+    },
+    42,
+); // true
+samsam.match(234, 1234); // false
+```
+
+#### Function matcher
+
+When the matcher is a function, it is called with `object` as its only
+argument. `match` returns `true` if the function returns `true`. A strict
+match is performed against the return value, so a boolean `true` is required,
+truthy is not enough.
+
+```javascript
+// true
+samsam.match("123", function (exp) {
+    return exp == "123";
+});
+
+// false
+samsam.match("Give me something", function () {
+    return "ok";
+});
+
+// true
+samsam.match(
+    {
+        toString: function () {
+            return "42";
+        },
+    },
+    function () {
+        return true;
+    },
+);
+
+// false
+samsam.match(234, function () {});
+```
+
+#### Object matcher
+
+As mentioned above, if an object matcher defines a `test` method, `match`
+will return `true` if `matcher.test(object)` returns truthy.
+
+If the matcher does not have a test method, a recursive match is performed. If
+all properties of `matcher` matches corresponding properties in `object`,
+`match` returns `true`. Note that the object matcher does not care if the
+number of properties in the two objects are the same - only if all properties in
+the matcher recursively matches ones in `object`. If supported, this object matchers
+include [symbolic properties](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol)
+in the comparison.
+
+```javascript
+// true
+samsam.match("123", {
+    test: function (arg) {
+        return arg == 123;
+    },
+});
+
+// false
+samsam.match({}, { prop: 42 });
+
+// true
+samsam.match(
+    {
+        name: "Chris",
+        profession: "Programmer",
+    },
+    {
+        name: "Chris",
+    },
+);
+
+// false
+samsam.match(234, { name: "Chris" });
+```
+
+#### DOM elements
+
+`match` can be very helpful when comparing DOM elements, because it allows
+you to compare several properties with one call:
+
+```javascript
+var el = document.getElementById("myEl");
+
+samsam.match(el, {
+    tagName: "h2",
+    className: "item",
+    innerHTML: "Howdy",
+});
+```

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/array-types.js

@@ -0,0 +1,16 @@
+"use strict";
+
+var ARRAY_TYPES = [
+    Array,
+    Int8Array,
+    Uint8Array,
+    Uint8ClampedArray,
+    Int16Array,
+    Uint16Array,
+    Int32Array,
+    Uint32Array,
+    Float32Array,
+    Float64Array,
+];
+
+module.exports = ARRAY_TYPES;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-matcher.js

@@ -0,0 +1,413 @@
+"use strict";
+
+var arrayProto = require("@sinonjs/commons").prototypes.array;
+var deepEqual = require("./deep-equal").use(createMatcher); // eslint-disable-line no-use-before-define
+var every = require("@sinonjs/commons").every;
+var functionName = require("@sinonjs/commons").functionName;
+var get = require("lodash.get");
+var iterableToString = require("./iterable-to-string");
+var objectProto = require("@sinonjs/commons").prototypes.object;
+var typeOf = require("@sinonjs/commons").typeOf;
+var valueToString = require("@sinonjs/commons").valueToString;
+
+var assertMatcher = require("./create-matcher/assert-matcher");
+var assertMethodExists = require("./create-matcher/assert-method-exists");
+var assertType = require("./create-matcher/assert-type");
+var isIterable = require("./create-matcher/is-iterable");
+var isMatcher = require("./create-matcher/is-matcher");
+
+var matcherPrototype = require("./create-matcher/matcher-prototype");
+
+var arrayIndexOf = arrayProto.indexOf;
+var some = arrayProto.some;
+
+var hasOwnProperty = objectProto.hasOwnProperty;
+var objectToString = objectProto.toString;
+
+var TYPE_MAP = require("./create-matcher/type-map")(createMatcher); // eslint-disable-line no-use-before-define
+
+/**
+ * Creates a matcher object for the passed expectation
+ *
+ * @alias module:samsam.createMatcher
+ * @param {*} expectation An expecttation
+ * @param {string} message A message for the expectation
+ * @returns {object} A matcher object
+ */
+function createMatcher(expectation, message) {
+    var m = Object.create(matcherPrototype);
+    var type = typeOf(expectation);
+
+    if (message !== undefined && typeof message !== "string") {
+        throw new TypeError("Message should be a string");
+    }
+
+    if (arguments.length > 2) {
+        throw new TypeError(
+            `Expected 1 or 2 arguments, received ${arguments.length}`,
+        );
+    }
+
+    if (type in TYPE_MAP) {
+        TYPE_MAP[type](m, expectation, message);
+    } else {
+        m.test = function (actual) {
+            return deepEqual(actual, expectation);
+        };
+    }
+
+    if (!m.message) {
+        m.message = `match(${valueToString(expectation)})`;
+    }
+
+    // ensure that nothing mutates the exported message value, ref https://github.com/sinonjs/sinon/issues/2502
+    Object.defineProperty(m, "message", {
+        configurable: false,
+        writable: false,
+        value: m.message,
+    });
+
+    return m;
+}
+
+createMatcher.isMatcher = isMatcher;
+
+createMatcher.any = createMatcher(function () {
+    return true;
+}, "any");
+
+createMatcher.defined = createMatcher(function (actual) {
+    return actual !== null && actual !== undefined;
+}, "defined");
+
+createMatcher.truthy = createMatcher(function (actual) {
+    return Boolean(actual);
+}, "truthy");
+
+createMatcher.falsy = createMatcher(function (actual) {
+    return !actual;
+}, "falsy");
+
+createMatcher.same = function (expectation) {
+    return createMatcher(
+        function (actual) {
+            return expectation === actual;
+        },
+        `same(${valueToString(expectation)})`,
+    );
+};
+
+createMatcher.in = function (arrayOfExpectations) {
+    if (typeOf(arrayOfExpectations) !== "array") {
+        throw new TypeError("array expected");
+    }
+
+    return createMatcher(
+        function (actual) {
+            return some(arrayOfExpectations, function (expectation) {
+                return expectation === actual;
+            });
+        },
+        `in(${valueToString(arrayOfExpectations)})`,
+    );
+};
+
+createMatcher.typeOf = function (type) {
+    assertType(type, "string", "type");
+    return createMatcher(function (actual) {
+        return typeOf(actual) === type;
+    }, `typeOf("${type}")`);
+};
+
+createMatcher.instanceOf = function (type) {
+    /* istanbul ignore if */
+    if (
+        typeof Symbol === "undefined" ||
+        typeof Symbol.hasInstance === "undefined"
+    ) {
+        assertType(type, "function", "type");
+    } else {
+        assertMethodExists(
+            type,
+            Symbol.hasInstance,
+            "type",
+            "[Symbol.hasInstance]",
+        );
+    }
+    return createMatcher(
+        function (actual) {
+            return actual instanceof type;
+        },
+        `instanceOf(${functionName(type) || objectToString(type)})`,
+    );
+};
+
+/**
+ * Creates a property matcher
+ *
+ * @private
+ * @param {Function} propertyTest A function to test the property against a value
+ * @param {string} messagePrefix A prefix to use for messages generated by the matcher
+ * @returns {object} A matcher
+ */
+function createPropertyMatcher(propertyTest, messagePrefix) {
+    return function (property, value) {
+        assertType(property, "string", "property");
+        var onlyProperty = arguments.length === 1;
+        var message = `${messagePrefix}("${property}"`;
+        if (!onlyProperty) {
+            message += `, ${valueToString(value)}`;
+        }
+        message += ")";
+        return createMatcher(function (actual) {
+            if (
+                actual === undefined ||
+                actual === null ||
+                !propertyTest(actual, property)
+            ) {
+                return false;
+            }
+            return onlyProperty || deepEqual(actual[property], value);
+        }, message);
+    };
+}
+
+createMatcher.has = createPropertyMatcher(function (actual, property) {
+    if (typeof actual === "object") {
+        return property in actual;
+    }
+    return actual[property] !== undefined;
+}, "has");
+
+createMatcher.hasOwn = createPropertyMatcher(function (actual, property) {
+    return hasOwnProperty(actual, property);
+}, "hasOwn");
+
+createMatcher.hasNested = function (property, value) {
+    assertType(property, "string", "property");
+    var onlyProperty = arguments.length === 1;
+    var message = `hasNested("${property}"`;
+    if (!onlyProperty) {
+        message += `, ${valueToString(value)}`;
+    }
+    message += ")";
+    return createMatcher(function (actual) {
+        if (
+            actual === undefined ||
+            actual === null ||
+            get(actual, property) === undefined
+        ) {
+            return false;
+        }
+        return onlyProperty || deepEqual(get(actual, property), value);
+    }, message);
+};
+
+var jsonParseResultTypes = {
+    null: true,
+    boolean: true,
+    number: true,
+    string: true,
+    object: true,
+    array: true,
+};
+createMatcher.json = function (value) {
+    if (!jsonParseResultTypes[typeOf(value)]) {
+        throw new TypeError("Value cannot be the result of JSON.parse");
+    }
+    var message = `json(${JSON.stringify(value, null, "  ")})`;
+    return createMatcher(function (actual) {
+        var parsed;
+        try {
+            parsed = JSON.parse(actual);
+        } catch (e) {
+            return false;
+        }
+        return deepEqual(parsed, value);
+    }, message);
+};
+
+createMatcher.every = function (predicate) {
+    assertMatcher(predicate);
+
+    return createMatcher(function (actual) {
+        if (typeOf(actual) === "object") {
+            return every(Object.keys(actual), function (key) {
+                return predicate.test(actual[key]);
+            });
+        }
+
+        return (
+            isIterable(actual) &&
+            every(actual, function (element) {
+                return predicate.test(element);
+            })
+        );
+    }, `every(${predicate.message})`);
+};
+
+createMatcher.some = function (predicate) {
+    assertMatcher(predicate);
+
+    return createMatcher(function (actual) {
+        if (typeOf(actual) === "object") {
+            return !every(Object.keys(actual), function (key) {
+                return !predicate.test(actual[key]);
+            });
+        }
+
+        return (
+            isIterable(actual) &&
+            !every(actual, function (element) {
+                return !predicate.test(element);
+            })
+        );
+    }, `some(${predicate.message})`);
+};
+
+createMatcher.array = createMatcher.typeOf("array");
+
+createMatcher.array.deepEquals = function (expectation) {
+    return createMatcher(
+        function (actual) {
+            // Comparing lengths is the fastest way to spot a difference before iterating through every item
+            var sameLength = actual.length === expectation.length;
+            return (
+                typeOf(actual) === "array" &&
+                sameLength &&
+                every(actual, function (element, index) {
+                    var expected = expectation[index];
+                    return typeOf(expected) === "array" &&
+                        typeOf(element) === "array"
+                        ? createMatcher.array.deepEquals(expected).test(element)
+                        : deepEqual(expected, element);
+                })
+            );
+        },
+        `deepEquals([${iterableToString(expectation)}])`,
+    );
+};
+
+createMatcher.array.startsWith = function (expectation) {
+    return createMatcher(
+        function (actual) {
+            return (
+                typeOf(actual) === "array" &&
+                every(expectation, function (expectedElement, index) {
+                    return actual[index] === expectedElement;
+                })
+            );
+        },
+        `startsWith([${iterableToString(expectation)}])`,
+    );
+};
+
+createMatcher.array.endsWith = function (expectation) {
+    return createMatcher(
+        function (actual) {
+            // This indicates the index in which we should start matching
+            var offset = actual.length - expectation.length;
+
+            return (
+                typeOf(actual) === "array" &&
+                every(expectation, function (expectedElement, index) {
+                    return actual[offset + index] === expectedElement;
+                })
+            );
+        },
+        `endsWith([${iterableToString(expectation)}])`,
+    );
+};
+
+createMatcher.array.contains = function (expectation) {
+    return createMatcher(
+        function (actual) {
+            return (
+                typeOf(actual) === "array" &&
+                every(expectation, function (expectedElement) {
+                    return arrayIndexOf(actual, expectedElement) !== -1;
+                })
+            );
+        },
+        `contains([${iterableToString(expectation)}])`,
+    );
+};
+
+createMatcher.map = createMatcher.typeOf("map");
+
+createMatcher.map.deepEquals = function mapDeepEquals(expectation) {
+    return createMatcher(
+        function (actual) {
+            // Comparing lengths is the fastest way to spot a difference before iterating through every item
+            var sameLength = actual.size === expectation.size;
+            return (
+                typeOf(actual) === "map" &&
+                sameLength &&
+                every(actual, function (element, key) {
+                    return (
+                        expectation.has(key) && expectation.get(key) === element
+                    );
+                })
+            );
+        },
+        `deepEquals(Map[${iterableToString(expectation)}])`,
+    );
+};
+
+createMatcher.map.contains = function mapContains(expectation) {
+    return createMatcher(
+        function (actual) {
+            return (
+                typeOf(actual) === "map" &&
+                every(expectation, function (element, key) {
+                    return actual.has(key) && actual.get(key) === element;
+                })
+            );
+        },
+        `contains(Map[${iterableToString(expectation)}])`,
+    );
+};
+
+createMatcher.set = createMatcher.typeOf("set");
+
+createMatcher.set.deepEquals = function setDeepEquals(expectation) {
+    return createMatcher(
+        function (actual) {
+            // Comparing lengths is the fastest way to spot a difference before iterating through every item
+            var sameLength = actual.size === expectation.size;
+            return (
+                typeOf(actual) === "set" &&
+                sameLength &&
+                every(actual, function (element) {
+                    return expectation.has(element);
+                })
+            );
+        },
+        `deepEquals(Set[${iterableToString(expectation)}])`,
+    );
+};
+
+createMatcher.set.contains = function setContains(expectation) {
+    return createMatcher(
+        function (actual) {
+            return (
+                typeOf(actual) === "set" &&
+                every(expectation, function (element) {
+                    return actual.has(element);
+                })
+            );
+        },
+        `contains(Set[${iterableToString(expectation)}])`,
+    );
+};
+
+createMatcher.bool = createMatcher.typeOf("boolean");
+createMatcher.number = createMatcher.typeOf("number");
+createMatcher.string = createMatcher.typeOf("string");
+createMatcher.object = createMatcher.typeOf("object");
+createMatcher.func = createMatcher.typeOf("function");
+createMatcher.regexp = createMatcher.typeOf("regexp");
+createMatcher.date = createMatcher.typeOf("date");
+createMatcher.symbol = createMatcher.typeOf("symbol");
+
+module.exports = createMatcher;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-matcher/assert-matcher.js

@@ -0,0 +1,17 @@
+"use strict";
+
+var isMatcher = require("./is-matcher");
+
+/**
+ * Throws a TypeError when `value` is not a matcher
+ *
+ * @private
+ * @param {*} value The value to examine
+ */
+function assertMatcher(value) {
+    if (!isMatcher(value)) {
+        throw new TypeError("Matcher expected");
+    }
+}
+
+module.exports = assertMatcher;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-matcher/assert-method-exists.js

@@ -0,0 +1,19 @@
+"use strict";
+
+/**
+ * Throws a TypeError when expected method doesn't exist
+ *
+ * @private
+ * @param {*} value A value to examine
+ * @param {string} method The name of the method to look for
+ * @param {name} name A name to use for the error message
+ * @param {string} methodPath The name of the method to use for error messages
+ * @throws {TypeError} When the method doesn't exist
+ */
+function assertMethodExists(value, method, name, methodPath) {
+    if (value[method] === null || value[method] === undefined) {
+        throw new TypeError(`Expected ${name} to have method ${methodPath}`);
+    }
+}
+
+module.exports = assertMethodExists;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-matcher/assert-type.js

@@ -0,0 +1,24 @@
+"use strict";
+
+var typeOf = require("@sinonjs/commons").typeOf;
+
+/**
+ * Ensures that value is of type
+ *
+ * @private
+ * @param {*} value A value to examine
+ * @param {string} type A basic JavaScript type to compare to, e.g. "object", "string"
+ * @param {string} name A string to use for the error message
+ * @throws {TypeError} If value is not of the expected type
+ * @returns {undefined}
+ */
+function assertType(value, type, name) {
+    var actual = typeOf(value);
+    if (actual !== type) {
+        throw new TypeError(
+            `Expected type of ${name} to be ${type}, but was ${actual}`,
+        );
+    }
+}
+
+module.exports = assertType;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-matcher/is-iterable.js

@@ -0,0 +1,16 @@
+"use strict";
+
+var typeOf = require("@sinonjs/commons").typeOf;
+
+/**
+ * Returns `true` for iterables
+ *
+ * @private
+ * @param {*} value A value to examine
+ * @returns {boolean} Returns `true` when `value` looks like an iterable
+ */
+function isIterable(value) {
+    return Boolean(value) && typeOf(value.forEach) === "function";
+}
+
+module.exports = isIterable;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-matcher/is-matcher.js

@@ -0,0 +1,18 @@
+"use strict";
+
+var isPrototypeOf = require("@sinonjs/commons").prototypes.object.isPrototypeOf;
+
+var matcherPrototype = require("./matcher-prototype");
+
+/**
+ * Returns `true` when `object` is a matcher
+ *
+ * @private
+ * @param {*} object A value to examine
+ * @returns {boolean} Returns `true` when `object` is a matcher
+ */
+function isMatcher(object) {
+    return isPrototypeOf(matcherPrototype, object);
+}
+
+module.exports = isMatcher;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-matcher/match-object.js

@@ -0,0 +1,59 @@
+"use strict";
+
+var every = require("@sinonjs/commons").prototypes.array.every;
+var concat = require("@sinonjs/commons").prototypes.array.concat;
+var typeOf = require("@sinonjs/commons").typeOf;
+
+var deepEqualFactory = require("../deep-equal").use;
+
+var identical = require("../identical");
+var isMatcher = require("./is-matcher");
+
+var keys = Object.keys;
+var getOwnPropertySymbols = Object.getOwnPropertySymbols;
+
+/**
+ * Matches `actual` with `expectation`
+ *
+ * @private
+ * @param {*} actual A value to examine
+ * @param {object} expectation An object with properties to match on
+ * @param {object} matcher A matcher to use for comparison
+ * @returns {boolean} Returns true when `actual` matches all properties in `expectation`
+ */
+function matchObject(actual, expectation, matcher) {
+    var deepEqual = deepEqualFactory(matcher);
+    if (actual === null || actual === undefined) {
+        return false;
+    }
+
+    var expectedKeys = keys(expectation);
+    /* istanbul ignore else: cannot collect coverage for engine that doesn't support Symbol */
+    if (typeOf(getOwnPropertySymbols) === "function") {
+        expectedKeys = concat(expectedKeys, getOwnPropertySymbols(expectation));
+    }
+
+    return every(expectedKeys, function (key) {
+        var exp = expectation[key];
+        var act = actual[key];
+
+        if (isMatcher(exp)) {
+            if (!exp.test(act)) {
+                return false;
+            }
+        } else if (typeOf(exp) === "object") {
+            if (identical(exp, act)) {
+                return true;
+            }
+            if (!matchObject(act, exp, matcher)) {
+                return false;
+            }
+        } else if (!deepEqual(act, exp)) {
+            return false;
+        }
+
+        return true;
+    });
+}
+
+module.exports = matchObject;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-matcher/matcher-prototype.js

@@ -0,0 +1,49 @@
+"use strict";
+
+var matcherPrototype = {
+    toString: function () {
+        return this.message;
+    },
+};
+
+matcherPrototype.or = function (valueOrMatcher) {
+    var createMatcher = require("../create-matcher");
+    var isMatcher = createMatcher.isMatcher;
+
+    if (!arguments.length) {
+        throw new TypeError("Matcher expected");
+    }
+
+    var m2 = isMatcher(valueOrMatcher)
+        ? valueOrMatcher
+        : createMatcher(valueOrMatcher);
+    var m1 = this;
+    var or = Object.create(matcherPrototype);
+    or.test = function (actual) {
+        return m1.test(actual) || m2.test(actual);
+    };
+    or.message = `${m1.message}.or(${m2.message})`;
+    return or;
+};
+
+matcherPrototype.and = function (valueOrMatcher) {
+    var createMatcher = require("../create-matcher");
+    var isMatcher = createMatcher.isMatcher;
+
+    if (!arguments.length) {
+        throw new TypeError("Matcher expected");
+    }
+
+    var m2 = isMatcher(valueOrMatcher)
+        ? valueOrMatcher
+        : createMatcher(valueOrMatcher);
+    var m1 = this;
+    var and = Object.create(matcherPrototype);
+    and.test = function (actual) {
+        return m1.test(actual) && m2.test(actual);
+    };
+    and.message = `${m1.message}.and(${m2.message})`;
+    return and;
+};
+
+module.exports = matcherPrototype;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-matcher/type-map.js

@@ -0,0 +1,62 @@
+"use strict";
+
+var functionName = require("@sinonjs/commons").functionName;
+var join = require("@sinonjs/commons").prototypes.array.join;
+var map = require("@sinonjs/commons").prototypes.array.map;
+var stringIndexOf = require("@sinonjs/commons").prototypes.string.indexOf;
+var valueToString = require("@sinonjs/commons").valueToString;
+
+var matchObject = require("./match-object");
+
+var createTypeMap = function (match) {
+    return {
+        function: function (m, expectation, message) {
+            m.test = expectation;
+            m.message = message || `match(${functionName(expectation)})`;
+        },
+        number: function (m, expectation) {
+            m.test = function (actual) {
+                // we need type coercion here
+                return expectation == actual; // eslint-disable-line eqeqeq
+            };
+        },
+        object: function (m, expectation) {
+            var array = [];
+
+            if (typeof expectation.test === "function") {
+                m.test = function (actual) {
+                    return expectation.test(actual) === true;
+                };
+                m.message = `match(${functionName(expectation.test)})`;
+                return m;
+            }
+
+            array = map(Object.keys(expectation), function (key) {
+                return `${key}: ${valueToString(expectation[key])}`;
+            });
+
+            m.test = function (actual) {
+                return matchObject(actual, expectation, match);
+            };
+            m.message = `match(${join(array, ", ")})`;
+
+            return m;
+        },
+        regexp: function (m, expectation) {
+            m.test = function (actual) {
+                return typeof actual === "string" && expectation.test(actual);
+            };
+        },
+        string: function (m, expectation) {
+            m.test = function (actual) {
+                return (
+                    typeof actual === "string" &&
+                    stringIndexOf(actual, expectation) !== -1
+                );
+            };
+            m.message = `match("${expectation}")`;
+        },
+    };
+};
+
+module.exports = createTypeMap;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/create-set.js

@@ -0,0 +1,34 @@
+"use strict";
+
+var typeOf = require("@sinonjs/commons").typeOf;
+var forEach = require("@sinonjs/commons").prototypes.array.forEach;
+
+/**
+ * This helper makes it convenient to create Set instances from a
+ * collection, an overcomes the shortcoming that IE11 doesn't support
+ * collection arguments
+ *
+ * @private
+ * @param  {Array} array An array to create a set from
+ * @returns {Set} A set (unique) containing the members from array
+ *
+ * @see https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Set
+ */
+function createSet(array) {
+    if (arguments.length > 0 && !Array.isArray(array)) {
+        throw new TypeError(
+            "createSet can be called with either no arguments or an Array",
+        );
+    }
+
+    var items = typeOf(array) === "array" ? array : [];
+    var set = new Set();
+
+    forEach(items, function (item) {
+        set.add(item);
+    });
+
+    return set;
+}
+
+module.exports = createSet;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/deep-equal-benchmark.js

@@ -0,0 +1,74 @@
+"use strict";
+
+var Benchmark = require("benchmark");
+var deepEqual = require("./deep-equal");
+
+var suite = new Benchmark.Suite();
+var complex1 = {
+    "1e116061-59bf-433a-8ab0-017b67a51d26":
+        "a7fd22ab-e809-414f-ad55-9c97598395d8",
+    "3824e8b7-22f5-489c-9919-43b432e3af6b":
+        "548baefd-f43c-4dc9-9df5-f7c9c96223b0",
+    "123e5750-eb66-45e5-a770-310879203b33":
+        "89ff817d-65a2-4598-b190-21c128096e6a",
+    "1d66be95-8aaa-4167-9a47-e7ee19bb0735":
+        "64349492-56e8-4100-9552-a89fb4a9aef4",
+    "f5538565-dc92-4ee4-a762-1ba5fe0528f6": {
+        "53631f78-2f2a-448f-89c7-ed3585e8e6f0":
+            "2cce00ee-f5ee-43ef-878f-958597b23225",
+        "73e8298b-72fd-4969-afc1-d891b61e744f":
+            "4e57aa30-af51-4d78-887c-019755e5d117",
+        "85439907-5b0e-4a08-8cfa-902a68dc3cc0":
+            "9639add9-6897-4cf0-b3d3-2ebf9c214f01",
+        "d4ae9d87-bd6c-47e0-95a1-6f4eb4211549":
+            "41fd3dd2-43ce-47f2-b92e-462474d07a6f",
+        "f70345a2-0ea3-45a6-bafa-8c7a72379277": {
+            "1bce714b-cd0a-417d-9a0c-bf4b7d35c0c4":
+                "3b8b0dde-e2ed-4b34-ac8d-729ba3c9667e",
+            "13e05c60-97d1-43f0-a6ef-d5247f4dd11f":
+                "60f685a4-6558-4ade-9d4b-28281c3989db",
+            "925b2609-e7b7-42f5-82cf-2d995697cec5":
+                "79115261-8161-4a6c-9487-47847276a717",
+            "52d644ac-7b33-4b79-b5b3-5afe7fd4ec2c": [
+                "3c2ae716-92f1-4a3d-b98f-50ea49f51c45",
+                "de76b822-71b3-4b5a-a041-4140378b70e2",
+                "0302a405-1d58-44fa-a0c6-dd07bb0ca26e",
+                new Date(),
+                new Error(),
+                new RegExp(),
+                // eslint-disable-next-line no-undef
+                new Map(),
+                new Set(),
+                // eslint-disable-next-line no-undef
+                new WeakMap(),
+                // eslint-disable-next-line no-undef
+                new WeakSet(),
+            ],
+        },
+    },
+};
+var complex2 = Object.create(complex1);
+
+var cyclic1 = {
+    "4a092cd1-225e-4739-8331-d6564aafb702":
+        "d0cebbe0-23fb-4cc4-8fa0-ef11ceedf12e",
+};
+cyclic1.cyclicRef = cyclic1;
+
+var cyclic2 = Object.create(cyclic1);
+
+// add tests
+suite
+    .add("complex objects", function () {
+        return deepEqual(complex1, complex2);
+    })
+    .add("cyclic references", function () {
+        return deepEqual(cyclic1, cyclic2);
+    })
+    // add listeners
+    .on("cycle", function (event) {
+        // eslint-disable-next-line no-console
+        console.log(String(event.target));
+    })
+    // run async
+    .run({ async: true });

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/deep-equal.js

@@ -0,0 +1,304 @@
+"use strict";
+
+var valueToString = require("@sinonjs/commons").valueToString;
+var className = require("@sinonjs/commons").className;
+var typeOf = require("@sinonjs/commons").typeOf;
+var arrayProto = require("@sinonjs/commons").prototypes.array;
+var objectProto = require("@sinonjs/commons").prototypes.object;
+var mapForEach = require("@sinonjs/commons").prototypes.map.forEach;
+
+var getClass = require("./get-class");
+var identical = require("./identical");
+var isArguments = require("./is-arguments");
+var isArrayType = require("./is-array-type");
+var isDate = require("./is-date");
+var isElement = require("./is-element");
+var isIterable = require("./is-iterable");
+var isMap = require("./is-map");
+var isNaN = require("./is-nan");
+var isObject = require("./is-object");
+var isSet = require("./is-set");
+var isSubset = require("./is-subset");
+
+var concat = arrayProto.concat;
+var every = arrayProto.every;
+var push = arrayProto.push;
+
+var getTime = Date.prototype.getTime;
+var hasOwnProperty = objectProto.hasOwnProperty;
+var indexOf = arrayProto.indexOf;
+var keys = Object.keys;
+var getOwnPropertySymbols = Object.getOwnPropertySymbols;
+
+/**
+ * Deep equal comparison. Two values are "deep equal" when:
+ *
+ *   - They are equal, according to samsam.identical
+ *   - They are both date objects representing the same time
+ *   - They are both arrays containing elements that are all deepEqual
+ *   - They are objects with the same set of properties, and each property
+ *     in ``actual`` is deepEqual to the corresponding property in ``expectation``
+ *
+ * Supports cyclic objects.
+ *
+ * @alias module:samsam.deepEqual
+ * @param {*} actual The object to examine
+ * @param {*} expectation The object actual is expected to be equal to
+ * @param {object} match A value to match on
+ * @returns {boolean} Returns true when actual and expectation are considered equal
+ */
+function deepEqualCyclic(actual, expectation, match) {
+    // used for cyclic comparison
+    // contain already visited objects
+    var actualObjects = [];
+    var expectationObjects = [];
+    // contain pathes (position in the object structure)
+    // of the already visited objects
+    // indexes same as in objects arrays
+    var actualPaths = [];
+    var expectationPaths = [];
+    // contains combinations of already compared objects
+    // in the manner: { "$1['ref']$2['ref']": true }
+    var compared = {};
+
+    // does the recursion for the deep equal check
+    // eslint-disable-next-line complexity
+    return (function deepEqual(
+        actualObj,
+        expectationObj,
+        actualPath,
+        expectationPath,
+    ) {
+        // If both are matchers they must be the same instance in order to be
+        // considered equal If we didn't do that we would end up running one
+        // matcher against the other
+        if (match && match.isMatcher(expectationObj)) {
+            if (match.isMatcher(actualObj)) {
+                return actualObj === expectationObj;
+            }
+            return expectationObj.test(actualObj);
+        }
+
+        var actualType = typeof actualObj;
+        var expectationType = typeof expectationObj;
+
+        if (
+            actualObj === expectationObj ||
+            isNaN(actualObj) ||
+            isNaN(expectationObj) ||
+            actualObj === null ||
+            expectationObj === null ||
+            actualObj === undefined ||
+            expectationObj === undefined ||
+            actualType !== "object" ||
+            expectationType !== "object"
+        ) {
+            return identical(actualObj, expectationObj);
+        }
+
+        // Elements are only equal if identical(expected, actual)
+        if (isElement(actualObj) || isElement(expectationObj)) {
+            return false;
+        }
+
+        var isActualDate = isDate(actualObj);
+        var isExpectationDate = isDate(expectationObj);
+        if (isActualDate || isExpectationDate) {
+            if (
+                !isActualDate ||
+                !isExpectationDate ||
+                getTime.call(actualObj) !== getTime.call(expectationObj)
+            ) {
+                return false;
+            }
+        }
+
+        if (actualObj instanceof RegExp && expectationObj instanceof RegExp) {
+            if (valueToString(actualObj) !== valueToString(expectationObj)) {
+                return false;
+            }
+        }
+
+        if (actualObj instanceof Promise && expectationObj instanceof Promise) {
+            return actualObj === expectationObj;
+        }
+
+        if (actualObj instanceof Error && expectationObj instanceof Error) {
+            return actualObj === expectationObj;
+        }
+
+        var actualClass = getClass(actualObj);
+        var expectationClass = getClass(expectationObj);
+        var actualKeys = keys(actualObj);
+        var expectationKeys = keys(expectationObj);
+        var actualName = className(actualObj);
+        var expectationName = className(expectationObj);
+        var expectationSymbols =
+            typeOf(getOwnPropertySymbols) === "function"
+                ? getOwnPropertySymbols(expectationObj)
+                : /* istanbul ignore next: cannot collect coverage for engine that doesn't support Symbol */
+                  [];
+        var expectationKeysAndSymbols = concat(
+            expectationKeys,
+            expectationSymbols,
+        );
+
+        if (isArguments(actualObj) || isArguments(expectationObj)) {
+            if (actualObj.length !== expectationObj.length) {
+                return false;
+            }
+        } else {
+            if (
+                actualType !== expectationType ||
+                actualClass !== expectationClass ||
+                actualKeys.length !== expectationKeys.length ||
+                (actualName &&
+                    expectationName &&
+                    actualName !== expectationName)
+            ) {
+                return false;
+            }
+        }
+
+        if (isSet(actualObj) || isSet(expectationObj)) {
+            if (
+                !isSet(actualObj) ||
+                !isSet(expectationObj) ||
+                actualObj.size !== expectationObj.size
+            ) {
+                return false;
+            }
+
+            return isSubset(actualObj, expectationObj, deepEqual);
+        }
+
+        if (isMap(actualObj) || isMap(expectationObj)) {
+            if (
+                !isMap(actualObj) ||
+                !isMap(expectationObj) ||
+                actualObj.size !== expectationObj.size
+            ) {
+                return false;
+            }
+
+            var mapsDeeplyEqual = true;
+            mapForEach(actualObj, function (value, key) {
+                mapsDeeplyEqual =
+                    mapsDeeplyEqual &&
+                    deepEqualCyclic(value, expectationObj.get(key));
+            });
+
+            return mapsDeeplyEqual;
+        }
+
+        // jQuery objects have iteration protocols
+        // see: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols
+        // But, they don't work well with the implementation concerning iterables below,
+        // so we will detect them and use jQuery's own equality function
+        /* istanbul ignore next -- this can only be tested in the `test-headless` script */
+        if (
+            actualObj.constructor &&
+            actualObj.constructor.name === "jQuery" &&
+            typeof actualObj.is === "function"
+        ) {
+            return actualObj.is(expectationObj);
+        }
+
+        var isActualNonArrayIterable =
+            isIterable(actualObj) &&
+            !isArrayType(actualObj) &&
+            !isArguments(actualObj);
+        var isExpectationNonArrayIterable =
+            isIterable(expectationObj) &&
+            !isArrayType(expectationObj) &&
+            !isArguments(expectationObj);
+        if (isActualNonArrayIterable || isExpectationNonArrayIterable) {
+            var actualArray = Array.from(actualObj);
+            var expectationArray = Array.from(expectationObj);
+            if (actualArray.length !== expectationArray.length) {
+                return false;
+            }
+
+            var arrayDeeplyEquals = true;
+            every(actualArray, function (key) {
+                arrayDeeplyEquals =
+                    arrayDeeplyEquals &&
+                    deepEqualCyclic(actualArray[key], expectationArray[key]);
+            });
+
+            return arrayDeeplyEquals;
+        }
+
+        return every(expectationKeysAndSymbols, function (key) {
+            if (!hasOwnProperty(actualObj, key)) {
+                return false;
+            }
+
+            var actualValue = actualObj[key];
+            var expectationValue = expectationObj[key];
+            var actualObject = isObject(actualValue);
+            var expectationObject = isObject(expectationValue);
+            // determines, if the objects were already visited
+            // (it's faster to check for isObject first, than to
+            // get -1 from getIndex for non objects)
+            var actualIndex = actualObject
+                ? indexOf(actualObjects, actualValue)
+                : -1;
+            var expectationIndex = expectationObject
+                ? indexOf(expectationObjects, expectationValue)
+                : -1;
+            // determines the new paths of the objects
+            // - for non cyclic objects the current path will be extended
+            //   by current property name
+            // - for cyclic objects the stored path is taken
+            var newActualPath =
+                actualIndex !== -1
+                    ? actualPaths[actualIndex]
+                    : `${actualPath}[${JSON.stringify(key)}]`;
+            var newExpectationPath =
+                expectationIndex !== -1
+                    ? expectationPaths[expectationIndex]
+                    : `${expectationPath}[${JSON.stringify(key)}]`;
+            var combinedPath = newActualPath + newExpectationPath;
+
+            // stop recursion if current objects are already compared
+            if (compared[combinedPath]) {
+                return true;
+            }
+
+            // remember the current objects and their paths
+            if (actualIndex === -1 && actualObject) {
+                push(actualObjects, actualValue);
+                push(actualPaths, newActualPath);
+            }
+            if (expectationIndex === -1 && expectationObject) {
+                push(expectationObjects, expectationValue);
+                push(expectationPaths, newExpectationPath);
+            }
+
+            // remember that the current objects are already compared
+            if (actualObject && expectationObject) {
+                compared[combinedPath] = true;
+            }
+
+            // End of cyclic logic
+
+            // neither actualValue nor expectationValue is a cycle
+            // continue with next level
+            return deepEqual(
+                actualValue,
+                expectationValue,
+                newActualPath,
+                newExpectationPath,
+            );
+        });
+    })(actual, expectation, "$1", "$2");
+}
+
+deepEqualCyclic.use = function (match) {
+    return function deepEqual(a, b) {
+        return deepEqualCyclic(a, b, match);
+    };
+};
+
+module.exports = deepEqualCyclic;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/get-class.js

@@ -0,0 +1,18 @@
+"use strict";
+
+var toString = require("@sinonjs/commons").prototypes.object.toString;
+
+/**
+ * Returns the internal `Class` by calling `Object.prototype.toString`
+ * with the provided value as `this`. Return value is a `String`, naming the
+ * internal class, e.g. "Array"
+ *
+ * @private
+ * @param  {*} value - Any value
+ * @returns {string} - A string representation of the `Class` of `value`
+ */
+function getClass(value) {
+    return toString(value).split(/[ \]]/)[1];
+}
+
+module.exports = getClass;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/identical.js

@@ -0,0 +1,31 @@
+"use strict";
+
+var isNaN = require("./is-nan");
+var isNegZero = require("./is-neg-zero");
+
+/**
+ * Strict equality check according to EcmaScript Harmony's `egal`.
+ *
+ * **From the Harmony wiki:**
+ * > An `egal` function simply makes available the internal `SameValue` function
+ * > from section 9.12 of the ES5 spec. If two values are egal, then they are not
+ * > observably distinguishable.
+ *
+ * `identical` returns `true` when `===` is `true`, except for `-0` and
+ * `+0`, where it returns `false`. Additionally, it returns `true` when
+ * `NaN` is compared to itself.
+ *
+ * @alias module:samsam.identical
+ * @param {*} obj1 The first value to compare
+ * @param {*} obj2 The second value to compare
+ * @returns {boolean} Returns `true` when the objects are *egal*, `false` otherwise
+ */
+function identical(obj1, obj2) {
+    if (obj1 === obj2 || (isNaN(obj1) && isNaN(obj2))) {
+        return obj1 !== 0 || isNegZero(obj1) === isNegZero(obj2);
+    }
+
+    return false;
+}
+
+module.exports = identical;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-arguments.js

@@ -0,0 +1,16 @@
+"use strict";
+
+var getClass = require("./get-class");
+
+/**
+ * Returns `true` when `object` is an `arguments` object, `false` otherwise
+ *
+ * @alias module:samsam.isArguments
+ * @param  {*}  object - The object to examine
+ * @returns {boolean} `true` when `object` is an `arguments` object
+ */
+function isArguments(object) {
+    return getClass(object) === "Arguments";
+}
+
+module.exports = isArguments;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-array-type.js

@@ -0,0 +1,20 @@
+"use strict";
+
+var functionName = require("@sinonjs/commons").functionName;
+var indexOf = require("@sinonjs/commons").prototypes.array.indexOf;
+var map = require("@sinonjs/commons").prototypes.array.map;
+var ARRAY_TYPES = require("./array-types");
+var type = require("type-detect");
+
+/**
+ * Returns `true` when `object` is an array type, `false` otherwise
+ *
+ * @param  {*}  object - The object to examine
+ * @returns {boolean} `true` when `object` is an array type
+ * @private
+ */
+function isArrayType(object) {
+    return indexOf(map(ARRAY_TYPES, functionName), type(object)) !== -1;
+}
+
+module.exports = isArrayType;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-date.js

@@ -0,0 +1,14 @@
+"use strict";
+
+/**
+ * Returns `true` when `value` is an instance of Date
+ *
+ * @private
+ * @param  {Date}  value The value to examine
+ * @returns {boolean}     `true` when `value` is an instance of Date
+ */
+function isDate(value) {
+    return value instanceof Date;
+}
+
+module.exports = isDate;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-element.js

@@ -0,0 +1,29 @@
+"use strict";
+
+var div = typeof document !== "undefined" && document.createElement("div");
+
+/**
+ * Returns `true` when `object` is a DOM element node.
+ *
+ * Unlike Underscore.js/lodash, this function will return `false` if `object`
+ * is an *element-like* object, i.e. a regular object with a `nodeType`
+ * property that holds the value `1`.
+ *
+ * @alias module:samsam.isElement
+ * @param {object} object The object to examine
+ * @returns {boolean} Returns `true` for DOM element nodes
+ */
+function isElement(object) {
+    if (!object || object.nodeType !== 1 || !div) {
+        return false;
+    }
+    try {
+        object.appendChild(div);
+        object.removeChild(div);
+    } catch (e) {
+        return false;
+    }
+    return true;
+}
+
+module.exports = isElement;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-iterable.js

@@ -0,0 +1,18 @@
+"use strict";
+
+/**
+ * Returns `true` when the argument is an iterable, `false` otherwise
+ *
+ * @alias module:samsam.isIterable
+ * @param  {*}  val - A value to examine
+ * @returns {boolean} Returns `true` when the argument is an iterable, `false` otherwise
+ */
+function isIterable(val) {
+    // checks for null and undefined
+    if (typeof val !== "object") {
+        return false;
+    }
+    return typeof val[Symbol.iterator] === "function";
+}
+
+module.exports = isIterable;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-map.js

@@ -0,0 +1,14 @@
+"use strict";
+
+/**
+ * Returns `true` when `value` is a Map
+ *
+ * @param {*} value A value to examine
+ * @returns {boolean} `true` when `value` is an instance of `Map`, `false` otherwise
+ * @private
+ */
+function isMap(value) {
+    return typeof Map !== "undefined" && value instanceof Map;
+}
+
+module.exports = isMap;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-nan.js

@@ -0,0 +1,19 @@
+"use strict";
+
+/**
+ * Compares a `value` to `NaN`
+ *
+ * @private
+ * @param {*} value A value to examine
+ * @returns {boolean} Returns `true` when `value` is `NaN`
+ */
+function isNaN(value) {
+    // Unlike global `isNaN`, this function avoids type coercion
+    // `typeof` check avoids IE host object issues, hat tip to
+    // lodash
+
+    // eslint-disable-next-line no-self-compare
+    return typeof value === "number" && value !== value;
+}
+
+module.exports = isNaN;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-neg-zero.js

@@ -0,0 +1,14 @@
+"use strict";
+
+/**
+ * Returns `true` when `value` is `-0`
+ *
+ * @alias module:samsam.isNegZero
+ * @param {*} value A value to examine
+ * @returns {boolean} Returns `true` when `value` is `-0`
+ */
+function isNegZero(value) {
+    return value === 0 && 1 / value === -Infinity;
+}
+
+module.exports = isNegZero;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-object.js

@@ -0,0 +1,31 @@
+"use strict";
+
+/**
+ * Returns `true` when the value is a regular Object and not a specialized Object
+ *
+ * This helps speed up deepEqual cyclic checks
+ *
+ * The premise is that only Objects are stored in the visited array.
+ * So if this function returns false, we don't have to do the
+ * expensive operation of searching for the value in the the array of already
+ * visited objects
+ *
+ * @private
+ * @param  {object}   value The object to examine
+ * @returns {boolean}       `true` when the object is a non-specialised object
+ */
+function isObject(value) {
+    return (
+        typeof value === "object" &&
+        value !== null &&
+        // none of these are collection objects, so we can return false
+        !(value instanceof Boolean) &&
+        !(value instanceof Date) &&
+        !(value instanceof Error) &&
+        !(value instanceof Number) &&
+        !(value instanceof RegExp) &&
+        !(value instanceof String)
+    );
+}
+
+module.exports = isObject;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-set.js

@@ -0,0 +1,14 @@
+"use strict";
+
+/**
+ * Returns `true` when the argument is an instance of Set, `false` otherwise
+ *
+ * @alias module:samsam.isSet
+ * @param  {*}  val - A value to examine
+ * @returns {boolean} Returns `true` when the argument is an instance of Set, `false` otherwise
+ */
+function isSet(val) {
+    return (typeof Set !== "undefined" && val instanceof Set) || false;
+}
+
+module.exports = isSet;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/is-subset.js

@@ -0,0 +1,30 @@
+"use strict";
+
+var forEach = require("@sinonjs/commons").prototypes.set.forEach;
+
+/**
+ * Returns `true` when `s1` is a subset of `s2`, `false` otherwise
+ *
+ * @private
+ * @param  {Array|Set}  s1      The target value
+ * @param  {Array|Set}  s2      The containing value
+ * @param  {Function}  compare A comparison function, should return `true` when
+ *                             values are considered equal
+ * @returns {boolean} Returns `true` when `s1` is a subset of `s2`, `false`` otherwise
+ */
+function isSubset(s1, s2, compare) {
+    var allContained = true;
+    forEach(s1, function (v1) {
+        var includes = false;
+        forEach(s2, function (v2) {
+            if (compare(v2, v1)) {
+                includes = true;
+            }
+        });
+        allContained = allContained && includes;
+    });
+
+    return allContained;
+}
+
+module.exports = isSubset;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/iterable-to-string.js

@@ -0,0 +1,71 @@
+"use strict";
+
+var slice = require("@sinonjs/commons").prototypes.string.slice;
+var typeOf = require("@sinonjs/commons").typeOf;
+var valueToString = require("@sinonjs/commons").valueToString;
+
+/**
+ * Creates a string represenation of an iterable object
+ *
+ * @private
+ * @param   {object} obj The iterable object to stringify
+ * @returns {string}     A string representation
+ */
+function iterableToString(obj) {
+    if (typeOf(obj) === "map") {
+        return mapToString(obj);
+    }
+
+    return genericIterableToString(obj);
+}
+
+/**
+ * Creates a string representation of a Map
+ *
+ * @private
+ * @param   {Map} map    The map to stringify
+ * @returns {string}     A string representation
+ */
+function mapToString(map) {
+    var representation = "";
+
+    // eslint-disable-next-line @sinonjs/no-prototype-methods/no-prototype-methods
+    map.forEach(function (value, key) {
+        representation += `[${stringify(key)},${stringify(value)}],`;
+    });
+
+    representation = slice(representation, 0, -1);
+    return representation;
+}
+
+/**
+ * Create a string represenation for an iterable
+ *
+ * @private
+ * @param   {object} iterable The iterable to stringify
+ * @returns {string}          A string representation
+ */
+function genericIterableToString(iterable) {
+    var representation = "";
+
+    // eslint-disable-next-line @sinonjs/no-prototype-methods/no-prototype-methods
+    iterable.forEach(function (value) {
+        representation += `${stringify(value)},`;
+    });
+
+    representation = slice(representation, 0, -1);
+    return representation;
+}
+
+/**
+ * Creates a string representation of the passed `item`
+ *
+ * @private
+ * @param  {object} item The item to stringify
+ * @returns {string}      A string representation of `item`
+ */
+function stringify(item) {
+    return typeof item === "string" ? `'${item}'` : valueToString(item);
+}
+
+module.exports = iterableToString;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/match.js

@@ -0,0 +1,174 @@
+"use strict";
+
+var valueToString = require("@sinonjs/commons").valueToString;
+var indexOf = require("@sinonjs/commons").prototypes.string.indexOf;
+var forEach = require("@sinonjs/commons").prototypes.array.forEach;
+var type = require("type-detect");
+
+var engineCanCompareMaps = typeof Array.from === "function";
+var deepEqual = require("./deep-equal").use(match); // eslint-disable-line no-use-before-define
+var isArrayType = require("./is-array-type");
+var isSubset = require("./is-subset");
+var createMatcher = require("./create-matcher");
+
+/**
+ * Returns true when `array` contains all of `subset` as defined by the `compare`
+ * argument
+ *
+ * @param  {Array} array   An array to search for a subset
+ * @param  {Array} subset  The subset to find in the array
+ * @param  {Function} compare A comparison function
+ * @returns {boolean}         [description]
+ * @private
+ */
+function arrayContains(array, subset, compare) {
+    if (subset.length === 0) {
+        return true;
+    }
+    var i, l, j, k;
+    for (i = 0, l = array.length; i < l; ++i) {
+        if (compare(array[i], subset[0])) {
+            for (j = 0, k = subset.length; j < k; ++j) {
+                if (i + j >= l) {
+                    return false;
+                }
+                if (!compare(array[i + j], subset[j])) {
+                    return false;
+                }
+            }
+            return true;
+        }
+    }
+    return false;
+}
+
+/* eslint-disable complexity */
+/**
+ * Matches an object with a matcher (or value)
+ *
+ * @alias module:samsam.match
+ * @param {object} object The object candidate to match
+ * @param {object} matcherOrValue A matcher or value to match against
+ * @returns {boolean} true when `object` matches `matcherOrValue`
+ */
+function match(object, matcherOrValue) {
+    if (matcherOrValue && typeof matcherOrValue.test === "function") {
+        return matcherOrValue.test(object);
+    }
+
+    switch (type(matcherOrValue)) {
+        case "bigint":
+        case "boolean":
+        case "number":
+        case "symbol":
+            return matcherOrValue === object;
+        case "function":
+            return matcherOrValue(object) === true;
+        case "string":
+            var notNull = typeof object === "string" || Boolean(object);
+            return (
+                notNull &&
+                indexOf(
+                    valueToString(object).toLowerCase(),
+                    matcherOrValue.toLowerCase(),
+                ) >= 0
+            );
+        case "null":
+            return object === null;
+        case "undefined":
+            return typeof object === "undefined";
+        case "Date":
+            /* istanbul ignore else */
+            if (type(object) === "Date") {
+                return object.getTime() === matcherOrValue.getTime();
+            }
+            /* istanbul ignore next: this is basically the rest of the function, which is covered */
+            break;
+        case "Array":
+        case "Int8Array":
+        case "Uint8Array":
+        case "Uint8ClampedArray":
+        case "Int16Array":
+        case "Uint16Array":
+        case "Int32Array":
+        case "Uint32Array":
+        case "Float32Array":
+        case "Float64Array":
+            return (
+                isArrayType(matcherOrValue) &&
+                arrayContains(object, matcherOrValue, match)
+            );
+        case "Map":
+            /* istanbul ignore next: this is covered by a test, that is only run in IE, but we collect coverage information in node*/
+            if (!engineCanCompareMaps) {
+                throw new Error(
+                    "The JavaScript engine does not support Array.from and cannot reliably do value comparison of Map instances",
+                );
+            }
+
+            return (
+                type(object) === "Map" &&
+                arrayContains(
+                    Array.from(object),
+                    Array.from(matcherOrValue),
+                    match,
+                )
+            );
+        default:
+            break;
+    }
+
+    switch (type(object)) {
+        case "null":
+            return false;
+        case "Set":
+            return isSubset(matcherOrValue, object, match);
+        default:
+            break;
+    }
+
+    /* istanbul ignore else */
+    if (matcherOrValue && typeof matcherOrValue === "object") {
+        if (matcherOrValue === object) {
+            return true;
+        }
+        if (typeof object !== "object") {
+            return false;
+        }
+        var prop;
+        // eslint-disable-next-line guard-for-in
+        for (prop in matcherOrValue) {
+            var value = object[prop];
+            if (
+                typeof value === "undefined" &&
+                typeof object.getAttribute === "function"
+            ) {
+                value = object.getAttribute(prop);
+            }
+            if (
+                matcherOrValue[prop] === null ||
+                typeof matcherOrValue[prop] === "undefined"
+            ) {
+                if (value !== matcherOrValue[prop]) {
+                    return false;
+                }
+            } else if (
+                typeof value === "undefined" ||
+                !deepEqual(value, matcherOrValue[prop])
+            ) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /* istanbul ignore next */
+    throw new Error("Matcher was an unknown or unsupported type");
+}
+/* eslint-enable complexity */
+
+forEach(Object.keys(createMatcher), function (key) {
+    match[key] = createMatcher[key];
+});
+
+module.exports = match;

github/codeql-action-v2/node_modules/@sinonjs/samsam/lib/samsam.js

@@ -0,0 +1,26 @@
+"use strict";
+
+/**
+ * @module samsam
+ */
+var identical = require("./identical");
+var isArguments = require("./is-arguments");
+var isElement = require("./is-element");
+var isNegZero = require("./is-neg-zero");
+var isSet = require("./is-set");
+var isMap = require("./is-map");
+var match = require("./match");
+var deepEqualCyclic = require("./deep-equal").use(match);
+var createMatcher = require("./create-matcher");
+
+module.exports = {
+    createMatcher: createMatcher,
+    deepEqual: deepEqualCyclic,
+    identical: identical,
+    isArguments: isArguments,
+    isElement: isElement,
+    isMap: isMap,
+    isNegZero: isNegZero,
+    isSet: isSet,
+    match: match,
+};

github/codeql-action-v2/node_modules/@sinonjs/samsam/node_modules/type-detect/LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2013 Jake Luer <jake@alogicalparadox.com> (http://alogicalparadox.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

github/codeql-action-v2/node_modules/@sinonjs/samsam/node_modules/type-detect/README.md

@@ -0,0 +1,235 @@
+<h1 align=center>
+  <a href="http://chaijs.com" title="Chai Documentation">
+    <img alt="type-detect" src="https://raw.githubusercontent.com/chaijs/type-detect/master/type-detect-logo.svg"/>
+  </a>
+</h1>
+<br>
+<p align=center>
+  Improved typeof detection for <a href="https://nodejs.org">node</a>, <a href="https://deno.land/">Deno</a>, and the browser.
+</p>
+
+<p align=center>
+  <a href="./LICENSE">
+    <img
+      alt="license:mit"
+      src="https://img.shields.io/badge/license-mit-green.svg?style=flat-square"
+    />
+  </a>
+  <a href="https://www.npmjs.com/packages/type-detect">
+    <img
+      alt="npm:?"
+      src="https://img.shields.io/npm/v/type-detect.svg?style=flat-square"
+    />
+  </a>
+  <a href="https://github.com/chaijs/type-detect">
+    <img
+      alt="build:?"
+      src="https://github.com/chaijs/type-detect/workflows/Build/badge.svg"
+    />
+  </a>
+  <a href="https://coveralls.io/r/chaijs/type-detect">
+    <img
+      alt="coverage:?"
+      src="https://img.shields.io/coveralls/chaijs/type-detect/master.svg?style=flat-square"
+    />
+  </a>
+  <a href="https://www.npmjs.com/packages/type-detect">
+    <img
+      alt="dependencies:?"
+      src="https://img.shields.io/npm/dm/type-detect.svg?style=flat-square"
+    />
+  </a>
+  <a href="">
+    <img
+      alt="devDependencies:?"
+      src="https://img.shields.io/david/chaijs/type-detect.svg?style=flat-square"
+    />
+  </a>
+  <br>
+  <a href="https://chai-slack.herokuapp.com/">
+    <img
+      alt="Join the Slack chat"
+      src="https://img.shields.io/badge/slack-join%20chat-E2206F.svg?style=flat-square"
+    />
+  </a>
+  <a href="https://gitter.im/chaijs/chai">
+    <img
+      alt="Join the Gitter chat"
+      src="https://img.shields.io/badge/gitter-join%20chat-D0104D.svg?style=flat-square"
+    />
+  </a>
+</p>
+<div align=center>
+  <table width="100%">
+  <tr><th colspan=6>Supported Browsers</th></tr> <tr>
+  <th align=center><img src="https://camo.githubusercontent.com/ab586f11dfcb49bf5f2c2fa9adadc5e857de122a/687474703a2f2f73766773686172652e636f6d2f692f3278532e737667" alt=""> Chrome</th>
+  <th align=center><img src="https://camo.githubusercontent.com/98cca3108c18dcfaa62667b42046540c6822cdac/687474703a2f2f73766773686172652e636f6d2f692f3279352e737667" alt=""> Edge</th>
+  <th align=center><img src="https://camo.githubusercontent.com/acdcb09840a9e1442cbaf1b684f95ab3c3f41cf4/687474703a2f2f73766773686172652e636f6d2f692f3279462e737667" alt=""> Firefox</th>
+  <th align=center><img src="https://camo.githubusercontent.com/728f8cb0bee9ed58ab85e39266f1152c53e0dffd/687474703a2f2f73766773686172652e636f6d2f692f3278342e737667" alt=""> Safari</th>
+  <th align=center><img src="https://camo.githubusercontent.com/96a2317034dee0040d0a762e7a30c3c650c45aac/687474703a2f2f73766773686172652e636f6d2f692f3279532e737667" alt=""> IE</th>
+  </tr><tr>
+  <td align=center>✅</td>
+  <td align=center>✅</td>
+  <td align=center>✅</td>
+  <td align=center>✅</td>
+  <td align=center>9, 10, 11</td>
+  </tr>
+  </table>
+</div>
+
+## What is Type-Detect?
+
+Type Detect is a module which you can use to detect the type of a given object. It returns a string representation of the object's type, either using [`typeof`](http://www.ecma-international.org/ecma-262/6.0/index.html#sec-typeof-operator) or [`@@toStringTag`](http://www.ecma-international.org/ecma-262/6.0/index.html#sec-symbol.tostringtag). It also normalizes some object names for consistency among browsers.
+
+## Why?
+
+The `typeof` operator will only specify primitive values; everything else is `"object"` (including `null`, arrays, regexps, etc). Many developers use `Object.prototype.toString()` - which is a fine alternative and returns many more types (null returns `[object Null]`, Arrays as `[object Array]`, regexps as `[object RegExp]` etc). 
+
+Sadly, `Object.prototype.toString` is slow, and buggy. By slow - we mean it is slower than `typeof`. By buggy - we mean that some values (like Promises, the global object, iterators, dataviews, a bunch of HTML elements) all report different things in different browsers.
+
+`type-detect` fixes all of the shortcomings with `Object.prototype.toString`. We have extra code to speed up checks of JS and DOM objects, as much as 20-30x faster for some values. `type-detect` also fixes any consistencies with these objects.
+
+## Installation
+
+### Node.js
+
+`type-detect` is available on [npm](http://npmjs.org). To install it, type:
+
+    $ npm install type-detect
+
+### Deno
+
+`type-detect` can be imported with the following line:
+
+```js
+import type from 'https://deno.land/x/type_detect@v4.1.0/index.ts'
+```
+
+### Browsers
+
+You can also use it within the browser; install via npm and use the `type-detect.js` file found within the download. For example:
+
+```html
+<script src="./node_modules/type-detect/type-detect.js"></script>
+```
+
+## Usage
+
+The primary export of `type-detect` is function that can serve as a replacement for `typeof`. The results of this function will be more specific than that of native `typeof`.
+
+```js
+var type = require('type-detect');
+```
+Or, in the browser use case, after the <script> tag,
+ ```js
+ var type = typeDetect;
+ ```
+
+#### array
+
+```js
+assert(type([]) === 'Array');
+assert(type(new Array()) === 'Array');
+```
+
+#### regexp
+
+```js
+assert(type(/a-z/gi) === 'RegExp');
+assert(type(new RegExp('a-z')) === 'RegExp');
+```
+
+#### function
+
+```js
+assert(type(function () {}) === 'function');
+```
+
+#### arguments
+
+```js
+(function () {
+  assert(type(arguments) === 'Arguments');
+})();
+```
+
+#### date
+
+```js
+assert(type(new Date) === 'Date');
+```
+
+#### number
+
+```js
+assert(type(1) === 'number');
+assert(type(1.234) === 'number');
+assert(type(-1) === 'number');
+assert(type(-1.234) === 'number');
+assert(type(Infinity) === 'number');
+assert(type(NaN) === 'number');
+assert(type(new Number(1)) === 'Number'); // note - the object version has a capital N
+```
+
+#### string
+
+```js
+assert(type('hello world') === 'string');
+assert(type(new String('hello')) === 'String'); // note - the object version has a capital S
+```
+
+#### null
+
+```js
+assert(type(null) === 'null');
+assert(type(undefined) !== 'null');
+```
+
+#### undefined
+
+```js
+assert(type(undefined) === 'undefined');
+assert(type(null) !== 'undefined');
+```
+
+#### object
+
+```js
+var Noop = function () {};
+assert(type({}) === 'Object');
+assert(type(Noop) !== 'Object');
+assert(type(new Noop) === 'Object');
+assert(type(new Object) === 'Object');
+```
+
+#### ECMA6 Types
+
+All new ECMAScript 2015 objects are also supported, such as Promises and Symbols:
+
+```js
+assert(type(new Map() === 'Map');
+assert(type(new WeakMap()) === 'WeakMap');
+assert(type(new Set()) === 'Set');
+assert(type(new WeakSet()) === 'WeakSet');
+assert(type(Symbol()) === 'symbol');
+assert(type(new Promise(callback) === 'Promise');
+assert(type(new Int8Array()) === 'Int8Array');
+assert(type(new Uint8Array()) === 'Uint8Array');
+assert(type(new UInt8ClampedArray()) === 'Uint8ClampedArray');
+assert(type(new Int16Array()) === 'Int16Array');
+assert(type(new Uint16Array()) === 'Uint16Array');
+assert(type(new Int32Array()) === 'Int32Array');
+assert(type(new UInt32Array()) === 'Uint32Array');
+assert(type(new Float32Array()) === 'Float32Array');
+assert(type(new Float64Array()) === 'Float64Array');
+assert(type(new ArrayBuffer()) === 'ArrayBuffer');
+assert(type(new DataView(arrayBuffer)) === 'DataView');
+```
+
+Also, if you use `Symbol.toStringTag` to change an Objects return value of the `toString()` Method, `type()` will return this value, e.g:
+
+```js
+var myObject = {};
+myObject[Symbol.toStringTag] = 'myCustomType';
+assert(type(myObject) === 'myCustomType');
+```

github/codeql-action-v2/node_modules/@sinonjs/samsam/node_modules/type-detect/index.d.ts

@@ -0,0 +1 @@
+export default function typeDetect(obj: unknown): string;

github/codeql-action-v2/node_modules/@sinonjs/samsam/node_modules/type-detect/index.js

@@ -0,0 +1,129 @@
+const promiseExists = typeof Promise === 'function';
+const globalObject = ((Obj) => {
+    if (typeof globalThis === 'object') {
+        return globalThis;
+    }
+    Object.defineProperty(Obj, 'typeDetectGlobalObject', {
+        get() {
+            return this;
+        },
+        configurable: true,
+    });
+    const global = typeDetectGlobalObject;
+    delete Obj.typeDetectGlobalObject;
+    return global;
+})(Object.prototype);
+const symbolExists = typeof Symbol !== 'undefined';
+const mapExists = typeof Map !== 'undefined';
+const setExists = typeof Set !== 'undefined';
+const weakMapExists = typeof WeakMap !== 'undefined';
+const weakSetExists = typeof WeakSet !== 'undefined';
+const dataViewExists = typeof DataView !== 'undefined';
+const symbolIteratorExists = symbolExists && typeof Symbol.iterator !== 'undefined';
+const symbolToStringTagExists = symbolExists && typeof Symbol.toStringTag !== 'undefined';
+const setEntriesExists = setExists && typeof Set.prototype.entries === 'function';
+const mapEntriesExists = mapExists && typeof Map.prototype.entries === 'function';
+const setIteratorPrototype = setEntriesExists && Object.getPrototypeOf(new Set().entries());
+const mapIteratorPrototype = mapEntriesExists && Object.getPrototypeOf(new Map().entries());
+const arrayIteratorExists = symbolIteratorExists && typeof Array.prototype[Symbol.iterator] === 'function';
+const arrayIteratorPrototype = arrayIteratorExists && Object.getPrototypeOf([][Symbol.iterator]());
+const stringIteratorExists = symbolIteratorExists && typeof String.prototype[Symbol.iterator] === 'function';
+const stringIteratorPrototype = stringIteratorExists && Object.getPrototypeOf(''[Symbol.iterator]());
+const toStringLeftSliceLength = 8;
+const toStringRightSliceLength = -1;
+export default function typeDetect(obj) {
+    const typeofObj = typeof obj;
+    if (typeofObj !== 'object') {
+        return typeofObj;
+    }
+    if (obj === null) {
+        return 'null';
+    }
+    if (obj === globalObject) {
+        return 'global';
+    }
+    if (Array.isArray(obj) &&
+        (symbolToStringTagExists === false || !(Symbol.toStringTag in obj))) {
+        return 'Array';
+    }
+    if (typeof window === 'object' && window !== null) {
+        if (typeof window.location === 'object' && obj === window.location) {
+            return 'Location';
+        }
+        if (typeof window.document === 'object' && obj === window.document) {
+            return 'Document';
+        }
+        if (typeof window.navigator === 'object') {
+            if (typeof window.navigator.mimeTypes === 'object' &&
+                obj === window.navigator.mimeTypes) {
+                return 'MimeTypeArray';
+            }
+            if (typeof window.navigator.plugins === 'object' &&
+                obj === window.navigator.plugins) {
+                return 'PluginArray';
+            }
+        }
+        if ((typeof window.HTMLElement === 'function' ||
+            typeof window.HTMLElement === 'object') &&
+            obj instanceof window.HTMLElement) {
+            if (obj.tagName === 'BLOCKQUOTE') {
+                return 'HTMLQuoteElement';
+            }
+            if (obj.tagName === 'TD') {
+                return 'HTMLTableDataCellElement';
+            }
+            if (obj.tagName === 'TH') {
+                return 'HTMLTableHeaderCellElement';
+            }
+        }
+    }
+    const stringTag = (symbolToStringTagExists && obj[Symbol.toStringTag]);
+    if (typeof stringTag === 'string') {
+        return stringTag;
+    }
+    const objPrototype = Object.getPrototypeOf(obj);
+    if (objPrototype === RegExp.prototype) {
+        return 'RegExp';
+    }
+    if (objPrototype === Date.prototype) {
+        return 'Date';
+    }
+    if (promiseExists && objPrototype === Promise.prototype) {
+        return 'Promise';
+    }
+    if (setExists && objPrototype === Set.prototype) {
+        return 'Set';
+    }
+    if (mapExists && objPrototype === Map.prototype) {
+        return 'Map';
+    }
+    if (weakSetExists && objPrototype === WeakSet.prototype) {
+        return 'WeakSet';
+    }
+    if (weakMapExists && objPrototype === WeakMap.prototype) {
+        return 'WeakMap';
+    }
+    if (dataViewExists && objPrototype === DataView.prototype) {
+        return 'DataView';
+    }
+    if (mapExists && objPrototype === mapIteratorPrototype) {
+        return 'Map Iterator';
+    }
+    if (setExists && objPrototype === setIteratorPrototype) {
+        return 'Set Iterator';
+    }
+    if (arrayIteratorExists && objPrototype === arrayIteratorPrototype) {
+        return 'Array Iterator';
+    }
+    if (stringIteratorExists && objPrototype === stringIteratorPrototype) {
+        return 'String Iterator';
+    }
+    if (objPrototype === null) {
+        return 'Object';
+    }
+    return Object
+        .prototype
+        .toString
+        .call(obj)
+        .slice(toStringLeftSliceLength, toStringRightSliceLength);
+}

github/codeql-action-v2/node_modules/@sinonjs/samsam/node_modules/type-detect/index.ts

@@ -0,0 +1,393 @@
+/* !
+ * type-detect
+ * Copyright(c) 2013 jake luer <jake@alogicalparadox.com>
+ * MIT Licensed
+ */
+const promiseExists = typeof Promise === 'function';
+
+const globalObject = ((Obj) => {
+  if (typeof globalThis === 'object') {
+    return globalThis; // eslint-disable-line
+  }
+  Object.defineProperty(Obj, 'typeDetectGlobalObject', {
+    get() {
+      return this;
+    },
+    configurable: true,
+  });
+  // @ts-ignore
+  const global = typeDetectGlobalObject; // eslint-disable-line
+  // @ts-ignore
+  delete Obj.typeDetectGlobalObject;
+  return global;
+})(Object.prototype);
+
+const symbolExists = typeof Symbol !== 'undefined';
+const mapExists = typeof Map !== 'undefined';
+const setExists = typeof Set !== 'undefined';
+const weakMapExists = typeof WeakMap !== 'undefined';
+const weakSetExists = typeof WeakSet !== 'undefined';
+const dataViewExists = typeof DataView !== 'undefined';
+const symbolIteratorExists = symbolExists && typeof Symbol.iterator !== 'undefined';
+const symbolToStringTagExists = symbolExists && typeof Symbol.toStringTag !== 'undefined';
+const setEntriesExists = setExists && typeof Set.prototype.entries === 'function';
+const mapEntriesExists = mapExists && typeof Map.prototype.entries === 'function';
+const setIteratorPrototype = setEntriesExists && Object.getPrototypeOf(new Set().entries());
+const mapIteratorPrototype = mapEntriesExists && Object.getPrototypeOf(new Map().entries());
+const arrayIteratorExists = symbolIteratorExists && typeof Array.prototype[Symbol.iterator] === 'function';
+const arrayIteratorPrototype = arrayIteratorExists && Object.getPrototypeOf([][Symbol.iterator]());
+const stringIteratorExists = symbolIteratorExists && typeof String.prototype[Symbol.iterator] === 'function';
+const stringIteratorPrototype = stringIteratorExists && Object.getPrototypeOf(''[Symbol.iterator]());
+const toStringLeftSliceLength = 8;
+const toStringRightSliceLength = -1;
+
+/**
+ * ### typeOf (obj)
+ *
+ * Uses `Object.prototype.toString` to determine the type of an object,
+ * normalising behaviour across engine versions & well optimised.
+ *
+ * @param {Mixed} object
+ * @return {String} object type
+ * @api public
+ */
+export default function typeDetect(obj: unknown): string {
+  /* ! Speed optimisation
+   * Pre:
+   *   string literal     x 3,039,035 ops/sec ±1.62% (78 runs sampled)
+   *   boolean literal    x 1,424,138 ops/sec ±4.54% (75 runs sampled)
+   *   number literal     x 1,653,153 ops/sec ±1.91% (82 runs sampled)
+   *   undefined          x 9,978,660 ops/sec ±1.92% (75 runs sampled)
+   *   function           x 2,556,769 ops/sec ±1.73% (77 runs sampled)
+   * Post:
+   *   string literal     x 38,564,796 ops/sec ±1.15% (79 runs sampled)
+   *   boolean literal    x 31,148,940 ops/sec ±1.10% (79 runs sampled)
+   *   number literal     x 32,679,330 ops/sec ±1.90% (78 runs sampled)
+   *   undefined          x 32,363,368 ops/sec ±1.07% (82 runs sampled)
+   *   function           x 31,296,870 ops/sec ±0.96% (83 runs sampled)
+   */
+  const typeofObj = typeof obj;
+  if (typeofObj !== 'object') {
+    return typeofObj;
+  }
+
+  /* ! Speed optimisation
+   * Pre:
+   *   null               x 28,645,765 ops/sec ±1.17% (82 runs sampled)
+   * Post:
+   *   null               x 36,428,962 ops/sec ±1.37% (84 runs sampled)
+   */
+  if (obj === null) {
+    return 'null';
+  }
+
+  /* ! Spec Conformance
+   * Test: `Object.prototype.toString.call(window)``
+   *  - Node === "[object global]"
+   *  - Chrome === "[object global]"
+   *  - Firefox === "[object Window]"
+   *  - PhantomJS === "[object Window]"
+   *  - Safari === "[object Window]"
+   *  - IE 11 === "[object Window]"
+   *  - IE Edge === "[object Window]"
+   * Test: `Object.prototype.toString.call(this)``
+   *  - Chrome Worker === "[object global]"
+   *  - Firefox Worker === "[object DedicatedWorkerGlobalScope]"
+   *  - Safari Worker === "[object DedicatedWorkerGlobalScope]"
+   *  - IE 11 Worker === "[object WorkerGlobalScope]"
+   *  - IE Edge Worker === "[object WorkerGlobalScope]"
+   */
+  if (obj === globalObject) {
+    return 'global';
+  }
+
+  /* ! Speed optimisation
+   * Pre:
+   *   array literal      x 2,888,352 ops/sec ±0.67% (82 runs sampled)
+   * Post:
+   *   array literal      x 22,479,650 ops/sec ±0.96% (81 runs sampled)
+   */
+  if (
+    Array.isArray(obj) &&
+    (symbolToStringTagExists === false || !(Symbol.toStringTag in obj))
+  ) {
+    return 'Array';
+  }
+
+  // Not caching existence of `window` and related properties due to potential
+  // for `window` to be unset before tests in quasi-browser environments.
+  if (typeof window === 'object' && window !== null) {
+    /* ! Spec Conformance
+     * (https://html.spec.whatwg.org/multipage/browsers.html#location)
+     * WhatWG HTML$7.7.3 - The `Location` interface
+     * Test: `Object.prototype.toString.call(window.location)``
+     *  - IE <=11 === "[object Object]"
+     *  - IE Edge <=13 === "[object Object]"
+     */
+    if (typeof (window as any).location === 'object' && obj === (window as any).location) {
+      return 'Location';
+    }
+
+    /* ! Spec Conformance
+     * (https://html.spec.whatwg.org/#document)
+     * WhatWG HTML$3.1.1 - The `Document` object
+     * Note: Most browsers currently adher to the W3C DOM Level 2 spec
+     *       (https://www.w3.org/TR/DOM-Level-2-HTML/html.html#ID-26809268)
+     *       which suggests that browsers should use HTMLTableCellElement for
+     *       both TD and TH elements. WhatWG separates these.
+     *       WhatWG HTML states:
+     *         > For historical reasons, Window objects must also have a
+     *         > writable, configurable, non-enumerable property named
+     *         > HTMLDocument whose value is the Document interface object.
+     * Test: `Object.prototype.toString.call(document)``
+     *  - Chrome === "[object HTMLDocument]"
+     *  - Firefox === "[object HTMLDocument]"
+     *  - Safari === "[object HTMLDocument]"
+     *  - IE <=10 === "[object Document]"
+     *  - IE 11 === "[object HTMLDocument]"
+     *  - IE Edge <=13 === "[object HTMLDocument]"
+     */
+    if (typeof (window as any).document === 'object' && obj === (window as any).document) {
+      return 'Document';
+    }
+
+    if (typeof (window as any).navigator === 'object') {
+      /* ! Spec Conformance
+       * (https://html.spec.whatwg.org/multipage/webappapis.html#mimetypearray)
+       * WhatWG HTML$8.6.1.5 - Plugins - Interface MimeTypeArray
+       * Test: `Object.prototype.toString.call(navigator.mimeTypes)``
+       *  - IE <=10 === "[object MSMimeTypesCollection]"
+       */
+      if (typeof (window as any).navigator.mimeTypes === 'object' &&
+          obj === (window as any).navigator.mimeTypes) {
+        return 'MimeTypeArray';
+      }
+
+      /* ! Spec Conformance
+       * (https://html.spec.whatwg.org/multipage/webappapis.html#pluginarray)
+       * WhatWG HTML$8.6.1.5 - Plugins - Interface PluginArray
+       * Test: `Object.prototype.toString.call(navigator.plugins)``
+       *  - IE <=10 === "[object MSPluginsCollection]"
+       */
+      if (typeof (window as any).navigator.plugins === 'object' &&
+          obj === (window as any).navigator.plugins) {
+        return 'PluginArray';
+      }
+    }
+
+    if ((typeof (window as any).HTMLElement === 'function' ||
+        typeof (window as any).HTMLElement === 'object') &&
+        obj instanceof (window as any).HTMLElement) {
+      /* ! Spec Conformance
+      * (https://html.spec.whatwg.org/multipage/webappapis.html#pluginarray)
+      * WhatWG HTML$4.4.4 - The `blockquote` element - Interface `HTMLQuoteElement`
+      * Test: `Object.prototype.toString.call(document.createElement('blockquote'))``
+      *  - IE <=10 === "[object HTMLBlockElement]"
+      */
+      if ((obj as any).tagName === 'BLOCKQUOTE') {
+        return 'HTMLQuoteElement';
+      }
+
+      /* ! Spec Conformance
+       * (https://html.spec.whatwg.org/#htmltabledatacellelement)
+       * WhatWG HTML$4.9.9 - The `td` element - Interface `HTMLTableDataCellElement`
+       * Note: Most browsers currently adher to the W3C DOM Level 2 spec
+       *       (https://www.w3.org/TR/DOM-Level-2-HTML/html.html#ID-82915075)
+       *       which suggests that browsers should use HTMLTableCellElement for
+       *       both TD and TH elements. WhatWG separates these.
+       * Test: Object.prototype.toString.call(document.createElement('td'))
+       *  - Chrome === "[object HTMLTableCellElement]"
+       *  - Firefox === "[object HTMLTableCellElement]"
+       *  - Safari === "[object HTMLTableCellElement]"
+       */
+      if ((obj as any).tagName === 'TD') {
+        return 'HTMLTableDataCellElement';
+      }
+
+      /* ! Spec Conformance
+       * (https://html.spec.whatwg.org/#htmltableheadercellelement)
+       * WhatWG HTML$4.9.9 - The `td` element - Interface `HTMLTableHeaderCellElement`
+       * Note: Most browsers currently adher to the W3C DOM Level 2 spec
+       *       (https://www.w3.org/TR/DOM-Level-2-HTML/html.html#ID-82915075)
+       *       which suggests that browsers should use HTMLTableCellElement for
+       *       both TD and TH elements. WhatWG separates these.
+       * Test: Object.prototype.toString.call(document.createElement('th'))
+       *  - Chrome === "[object HTMLTableCellElement]"
+       *  - Firefox === "[object HTMLTableCellElement]"
+       *  - Safari === "[object HTMLTableCellElement]"
+       */
+      if ((obj as any).tagName === 'TH') {
+        return 'HTMLTableHeaderCellElement';
+      }
+    }
+  }
+
+  /* ! Speed optimisation
+  * Pre:
+  *   Float64Array       x 625,644 ops/sec ±1.58% (80 runs sampled)
+  *   Float32Array       x 1,279,852 ops/sec ±2.91% (77 runs sampled)
+  *   Uint32Array        x 1,178,185 ops/sec ±1.95% (83 runs sampled)
+  *   Uint16Array        x 1,008,380 ops/sec ±2.25% (80 runs sampled)
+  *   Uint8Array         x 1,128,040 ops/sec ±2.11% (81 runs sampled)
+  *   Int32Array         x 1,170,119 ops/sec ±2.88% (80 runs sampled)
+  *   Int16Array         x 1,176,348 ops/sec ±5.79% (86 runs sampled)
+  *   Int8Array          x 1,058,707 ops/sec ±4.94% (77 runs sampled)
+  *   Uint8ClampedArray  x 1,110,633 ops/sec ±4.20% (80 runs sampled)
+  * Post:
+  *   Float64Array       x 7,105,671 ops/sec ±13.47% (64 runs sampled)
+  *   Float32Array       x 5,887,912 ops/sec ±1.46% (82 runs sampled)
+  *   Uint32Array        x 6,491,661 ops/sec ±1.76% (79 runs sampled)
+  *   Uint16Array        x 6,559,795 ops/sec ±1.67% (82 runs sampled)
+  *   Uint8Array         x 6,463,966 ops/sec ±1.43% (85 runs sampled)
+  *   Int32Array         x 5,641,841 ops/sec ±3.49% (81 runs sampled)
+  *   Int16Array         x 6,583,511 ops/sec ±1.98% (80 runs sampled)
+  *   Int8Array          x 6,606,078 ops/sec ±1.74% (81 runs sampled)
+  *   Uint8ClampedArray  x 6,602,224 ops/sec ±1.77% (83 runs sampled)
+  */
+  const stringTag = (symbolToStringTagExists && (obj as any)[Symbol.toStringTag]);
+  if (typeof stringTag === 'string') {
+    return stringTag;
+  }
+
+  const objPrototype = Object.getPrototypeOf(obj);
+  /* ! Speed optimisation
+  * Pre:
+  *   regex literal      x 1,772,385 ops/sec ±1.85% (77 runs sampled)
+  *   regex constructor  x 2,143,634 ops/sec ±2.46% (78 runs sampled)
+  * Post:
+  *   regex literal      x 3,928,009 ops/sec ±0.65% (78 runs sampled)
+  *   regex constructor  x 3,931,108 ops/sec ±0.58% (84 runs sampled)
+  */
+  if (objPrototype === RegExp.prototype) {
+    return 'RegExp';
+  }
+
+  /* ! Speed optimisation
+  * Pre:
+  *   date               x 2,130,074 ops/sec ±4.42% (68 runs sampled)
+  * Post:
+  *   date               x 3,953,779 ops/sec ±1.35% (77 runs sampled)
+  */
+  if (objPrototype === Date.prototype) {
+    return 'Date';
+  }
+
+  /* ! Spec Conformance
+   * (http://www.ecma-international.org/ecma-262/6.0/index.html#sec-promise.prototype-@@tostringtag)
+   * ES6$25.4.5.4 - Promise.prototype[@@toStringTag] should be "Promise":
+   * Test: `Object.prototype.toString.call(Promise.resolve())``
+   *  - Chrome <=47 === "[object Object]"
+   *  - Edge <=20 === "[object Object]"
+   *  - Firefox 29-Latest === "[object Promise]"
+   *  - Safari 7.1-Latest === "[object Promise]"
+   */
+  if (promiseExists && objPrototype === Promise.prototype) {
+    return 'Promise';
+  }
+
+  /* ! Speed optimisation
+  * Pre:
+  *   set                x 2,222,186 ops/sec ±1.31% (82 runs sampled)
+  * Post:
+  *   set                x 4,545,879 ops/sec ±1.13% (83 runs sampled)
+  */
+  if (setExists && objPrototype === Set.prototype) {
+    return 'Set';
+  }
+
+  /* ! Speed optimisation
+  * Pre:
+  *   map                x 2,396,842 ops/sec ±1.59% (81 runs sampled)
+  * Post:
+  *   map                x 4,183,945 ops/sec ±6.59% (82 runs sampled)
+  */
+  if (mapExists && objPrototype === Map.prototype) {
+    return 'Map';
+  }
+
+  /* ! Speed optimisation
+  * Pre:
+  *   weakset            x 1,323,220 ops/sec ±2.17% (76 runs sampled)
+  * Post:
+  *   weakset            x 4,237,510 ops/sec ±2.01% (77 runs sampled)
+  */
+  if (weakSetExists && objPrototype === WeakSet.prototype) {
+    return 'WeakSet';
+  }
+
+  /* ! Speed optimisation
+  * Pre:
+  *   weakmap            x 1,500,260 ops/sec ±2.02% (78 runs sampled)
+  * Post:
+  *   weakmap            x 3,881,384 ops/sec ±1.45% (82 runs sampled)
+  */
+  if (weakMapExists && objPrototype === WeakMap.prototype) {
+    return 'WeakMap';
+  }
+
+  /* ! Spec Conformance
+   * (http://www.ecma-international.org/ecma-262/6.0/index.html#sec-dataview.prototype-@@tostringtag)
+   * ES6$24.2.4.21 - DataView.prototype[@@toStringTag] should be "DataView":
+   * Test: `Object.prototype.toString.call(new DataView(new ArrayBuffer(1)))``
+   *  - Edge <=13 === "[object Object]"
+   */
+  if (dataViewExists && objPrototype === DataView.prototype) {
+    return 'DataView';
+  }
+
+  /* ! Spec Conformance
+   * (http://www.ecma-international.org/ecma-262/6.0/index.html#sec-%mapiteratorprototype%-@@tostringtag)
+   * ES6$23.1.5.2.2 - %MapIteratorPrototype%[@@toStringTag] should be "Map Iterator":
+   * Test: `Object.prototype.toString.call(new Map().entries())``
+   *  - Edge <=13 === "[object Object]"
+   */
+  if (mapExists && objPrototype === mapIteratorPrototype) {
+    return 'Map Iterator';
+  }
+
+  /* ! Spec Conformance
+   * (http://www.ecma-international.org/ecma-262/6.0/index.html#sec-%setiteratorprototype%-@@tostringtag)
+   * ES6$23.2.5.2.2 - %SetIteratorPrototype%[@@toStringTag] should be "Set Iterator":
+   * Test: `Object.prototype.toString.call(new Set().entries())``
+   *  - Edge <=13 === "[object Object]"
+   */
+  if (setExists && objPrototype === setIteratorPrototype) {
+    return 'Set Iterator';
+  }
+
+  /* ! Spec Conformance
+   * (http://www.ecma-international.org/ecma-262/6.0/index.html#sec-%arrayiteratorprototype%-@@tostringtag)
+   * ES6$22.1.5.2.2 - %ArrayIteratorPrototype%[@@toStringTag] should be "Array Iterator":
+   * Test: `Object.prototype.toString.call([][Symbol.iterator]())``
+   *  - Edge <=13 === "[object Object]"
+   */
+  if (arrayIteratorExists && objPrototype === arrayIteratorPrototype) {
+    return 'Array Iterator';
+  }
+
+  /* ! Spec Conformance
+   * (http://www.ecma-international.org/ecma-262/6.0/index.html#sec-%stringiteratorprototype%-@@tostringtag)
+   * ES6$21.1.5.2.2 - %StringIteratorPrototype%[@@toStringTag] should be "String Iterator":
+   * Test: `Object.prototype.toString.call(''[Symbol.iterator]())``
+   *  - Edge <=13 === "[object Object]"
+   */
+  if (stringIteratorExists && objPrototype === stringIteratorPrototype) {
+    return 'String Iterator';
+  }
+
+  /* ! Speed optimisation
+  * Pre:
+  *   object from null   x 2,424,320 ops/sec ±1.67% (76 runs sampled)
+  * Post:
+  *   object from null   x 5,838,000 ops/sec ±0.99% (84 runs sampled)
+  */
+  if (objPrototype === null) {
+    return 'Object';
+  }
+
+  return Object
+    .prototype
+    .toString
+    .call(obj)
+    .slice(toStringLeftSliceLength, toStringRightSliceLength);
+}

github/codeql-action-v2/node_modules/@sinonjs/samsam/node_modules/type-detect/package.json

@@ -0,0 +1,113 @@
+{
+  "name": "type-detect",
+  "version": "4.1.0",
+  "description": "Improved typeof detection for node.js and the browser.",
+  "keywords": [
+    "type",
+    "typeof",
+    "types"
+  ],
+  "license": "MIT",
+  "author": "Jake Luer <jake@alogicalparadox.com> (http://alogicalparadox.com)",
+  "contributors": [
+    "Keith Cirkel (https://github.com/keithamus)",
+    "David Losert (https://github.com/davelosert)",
+    "Aleksey Shvayka (https://github.com/shvaikalesh)",
+    "Lucas Fernandes da Costa (https://github.com/lucasfcosta)",
+    "Grant Snodgrass (https://github.com/meeber)",
+    "Jeremy Tice (https://github.com/jetpacmonkey)",
+    "Edward Betts (https://github.com/EdwardBetts)",
+    "dvlsg (https://github.com/dvlsg)",
+    "Amila Welihinda (https://github.com/amilajack)",
+    "Jake Champion (https://github.com/JakeChampion)",
+    "Miroslav Bajtoš (https://github.com/bajtos)"
+  ],
+  "files": [
+    "index.js",
+    "index.ts",
+    "index.d.ts",
+    "type-detect.js"
+  ],
+  "main": "./type-detect.js",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/chaijs/type-detect.git"
+  },
+  "scripts": {
+    "bench": "node bench",
+    "build": "tsc && rollup -c rollup.conf.js",
+    "commit-msg": "commitlint -x angular",
+    "lint": "eslint --ignore-path .gitignore . --ext .js,.ts",
+    "prepare": "cross-env NODE_ENV=production npm run build",
+    "semantic-release": "semantic-release pre && npm publish && semantic-release post",
+    "pretest:node": "cross-env NODE_ENV=test npm run build",
+    "pretest:browser": "cross-env NODE_ENV=test npm run build",
+    "test": "npm run test:node && npm run test:browser",
+    "test:browser": "karma start --singleRun=true",
+    "test:node": "nyc mocha type-detect.test.js",
+    "test:deno": "deno test test/deno-test.ts",
+    "posttest:node": "nyc report --report-dir \"coverage/node-$(node --version)\" --reporter=lcovonly && npm run upload-coverage",
+    "posttest:browser": "npm run upload-coverage",
+    "upload-coverage": "codecov"
+  },
+  "eslintConfig": {
+    "parser": "@typescript-eslint/parser",
+    "plugins": [
+      "@typescript-eslint"
+    ],
+    "env": {
+      "es6": true
+    },
+    "extends": [
+      "strict/es6"
+    ],
+    "globals": {
+      "HTMLElement": false,
+      "window": false
+    },
+    "rules": {
+      "complexity": 0,
+      "max-statements": 0,
+      "prefer-rest-params": 0
+    }
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^13.1.0",
+    "@rollup/plugin-buble": "^0.21.3",
+    "@rollup/plugin-commonjs": "^20.0.0",
+    "@rollup/plugin-node-resolve": "^13.0.5",
+    "@typescript-eslint/eslint-plugin": "^4.31.2",
+    "@typescript-eslint/parser": "^4.31.2",
+    "benchmark": "^2.1.4",
+    "buble": "^0.20.0",
+    "codecov": "^3.8.3",
+    "commitlint-config-angular": "^13.1.0",
+    "cross-env": "^7.0.3",
+    "eslint": "^7.32.0",
+    "eslint-config-strict": "^14.0.1",
+    "eslint-plugin-filenames": "^1.3.2",
+    "husky": "^7.0.2",
+    "karma": "^6.3.4",
+    "karma-chrome-launcher": "^3.1.0",
+    "karma-coverage": "^2.0.3",
+    "karma-detect-browsers": "^2.3.3",
+    "karma-edge-launcher": "^0.4.2",
+    "karma-firefox-launcher": "^2.1.1",
+    "karma-ie-launcher": "^1.0.0",
+    "karma-mocha": "^2.0.1",
+    "karma-opera-launcher": "^1.0.0",
+    "karma-safari-launcher": "^1.0.0",
+    "karma-safaritechpreview-launcher": "^2.0.2",
+    "karma-sauce-launcher": "^4.3.6",
+    "mocha": "^9.1.1",
+    "nyc": "^15.1.0",
+    "rollup": "^2.57.0",
+    "rollup-plugin-istanbul": "^3.0.0",
+    "semantic-release": "^18.0.0",
+    "simple-assert": "^1.0.0",
+    "typescript": "^4.4.3"
+  },
+  "engines": {
+    "node": ">=4"
+  }
+}

github/codeql-action-v2/node_modules/@sinonjs/samsam/node_modules/type-detect/type-detect.js

@@ -0,0 +1,139 @@
+(function (global, factory) {
+    typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
+    typeof define === 'function' && define.amd ? define(factory) :
+    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, global.typeDetect = factory());
+})(this, (function () { 'use strict';
+
+    var promiseExists = typeof Promise === 'function';
+    var globalObject = (function (Obj) {
+        if (typeof globalThis === 'object') {
+            return globalThis;
+        }
+        Object.defineProperty(Obj, 'typeDetectGlobalObject', {
+            get: function get() {
+                return this;
+            },
+            configurable: true,
+        });
+        var global = typeDetectGlobalObject;
+        delete Obj.typeDetectGlobalObject;
+        return global;
+    })(Object.prototype);
+    var symbolExists = typeof Symbol !== 'undefined';
+    var mapExists = typeof Map !== 'undefined';
+    var setExists = typeof Set !== 'undefined';
+    var weakMapExists = typeof WeakMap !== 'undefined';
+    var weakSetExists = typeof WeakSet !== 'undefined';
+    var dataViewExists = typeof DataView !== 'undefined';
+    var symbolIteratorExists = symbolExists && typeof Symbol.iterator !== 'undefined';
+    var symbolToStringTagExists = symbolExists && typeof Symbol.toStringTag !== 'undefined';
+    var setEntriesExists = setExists && typeof Set.prototype.entries === 'function';
+    var mapEntriesExists = mapExists && typeof Map.prototype.entries === 'function';
+    var setIteratorPrototype = setEntriesExists && Object.getPrototypeOf(new Set().entries());
+    var mapIteratorPrototype = mapEntriesExists && Object.getPrototypeOf(new Map().entries());
+    var arrayIteratorExists = symbolIteratorExists && typeof Array.prototype[Symbol.iterator] === 'function';
+    var arrayIteratorPrototype = arrayIteratorExists && Object.getPrototypeOf([][Symbol.iterator]());
+    var stringIteratorExists = symbolIteratorExists && typeof String.prototype[Symbol.iterator] === 'function';
+    var stringIteratorPrototype = stringIteratorExists && Object.getPrototypeOf(''[Symbol.iterator]());
+    var toStringLeftSliceLength = 8;
+    var toStringRightSliceLength = -1;
+    function typeDetect(obj) {
+        var typeofObj = typeof obj;
+        if (typeofObj !== 'object') {
+            return typeofObj;
+        }
+        if (obj === null) {
+            return 'null';
+        }
+        if (obj === globalObject) {
+            return 'global';
+        }
+        if (Array.isArray(obj) &&
+            (symbolToStringTagExists === false || !(Symbol.toStringTag in obj))) {
+            return 'Array';
+        }
+        if (typeof window === 'object' && window !== null) {
+            if (typeof window.location === 'object' && obj === window.location) {
+                return 'Location';
+            }
+            if (typeof window.document === 'object' && obj === window.document) {
+                return 'Document';
+            }
+            if (typeof window.navigator === 'object') {
+                if (typeof window.navigator.mimeTypes === 'object' &&
+                    obj === window.navigator.mimeTypes) {
+                    return 'MimeTypeArray';
+                }
+                if (typeof window.navigator.plugins === 'object' &&
+                    obj === window.navigator.plugins) {
+                    return 'PluginArray';
+                }
+            }
+            if ((typeof window.HTMLElement === 'function' ||
+                typeof window.HTMLElement === 'object') &&
+                obj instanceof window.HTMLElement) {
+                if (obj.tagName === 'BLOCKQUOTE') {
+                    return 'HTMLQuoteElement';
+                }
+                if (obj.tagName === 'TD') {
+                    return 'HTMLTableDataCellElement';
+                }
+                if (obj.tagName === 'TH') {
+                    return 'HTMLTableHeaderCellElement';
+                }
+            }
+        }
+        var stringTag = (symbolToStringTagExists && obj[Symbol.toStringTag]);
+        if (typeof stringTag === 'string') {
+            return stringTag;
+        }
+        var objPrototype = Object.getPrototypeOf(obj);
+        if (objPrototype === RegExp.prototype) {
+            return 'RegExp';
+        }
+        if (objPrototype === Date.prototype) {
+            return 'Date';
+        }
+        if (promiseExists && objPrototype === Promise.prototype) {
+            return 'Promise';
+        }
+        if (setExists && objPrototype === Set.prototype) {
+            return 'Set';
+        }
+        if (mapExists && objPrototype === Map.prototype) {
+            return 'Map';
+        }
+        if (weakSetExists && objPrototype === WeakSet.prototype) {
+            return 'WeakSet';
+        }
+        if (weakMapExists && objPrototype === WeakMap.prototype) {
+            return 'WeakMap';
+        }
+        if (dataViewExists && objPrototype === DataView.prototype) {
+            return 'DataView';
+        }
+        if (mapExists && objPrototype === mapIteratorPrototype) {
+            return 'Map Iterator';
+        }
+        if (setExists && objPrototype === setIteratorPrototype) {
+            return 'Set Iterator';
+        }
+        if (arrayIteratorExists && objPrototype === arrayIteratorPrototype) {
+            return 'Array Iterator';
+        }
+        if (stringIteratorExists && objPrototype === stringIteratorPrototype) {
+            return 'String Iterator';
+        }
+        if (objPrototype === null) {
+            return 'Object';
+        }
+        return Object
+            .prototype
+            .toString
+            .call(obj)
+            .slice(toStringLeftSliceLength, toStringRightSliceLength);
+    }
+
+    return typeDetect;
+
+}));

github/codeql-action-v2/node_modules/@sinonjs/samsam/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "@sinonjs/samsam",
+  "version": "8.0.2",
+  "description": "Value identification and comparison functions",
+  "homepage": "http://sinonjs.github.io/samsam/",
+  "author": "Christian Johansen",
+  "license": "BSD-3-Clause",
+  "main": "./lib/samsam",
+  "types": "./types/samsam.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/sinonjs/samsam.git"
+  },
+  "lint-staged": {
+    "*.{js,css,md}": "prettier --check",
+    "*.js": "eslint"
+  },
+  "scripts": {
+    "benchmark": "node lib/deep-equal-benchmark.js",
+    "build": "rm -rf types && tsc",
+    "jsdoc": "jsdoc -c jsdoc.conf.json",
+    "lint": "eslint .",
+    "prepublishOnly": "npm run build && mkdocs gh-deploy -r upstream || mkdocs gh-deploy -r origin",
+    "test": "mocha ./lib/*.test.js",
+    "test-cloud": "npm run test-headless -- --wd",
+    "test-check-coverage": "npm run test-coverage && nyc check-coverage --branches 100 --functions 100 --lines 100",
+    "test-coverage": "nyc --all --reporter text --reporter html --reporter lcovonly npm run test",
+    "test-headless": "mochify --no-detect-globals --recursive -R dot --plugin [ proxyquire-universal ] \"./lib/*.test.js\"",
+    "prettier:check": "prettier --check '**/*.{js,css,md}'",
+    "prettier:write": "prettier --write '**/*.{js,css,md}'",
+    "preversion": "./check-external-dependencies.sh && npm run test-check-coverage",
+    "version": "changes --commits --footer",
+    "postversion": "git push --follow-tags && npm publish --access public",
+    "prepare": "husky install"
+  },
+  "browser": {
+    "jsdom": false,
+    "jsdom-global": false
+  },
+  "files": [
+    "docs/",
+    "lib/",
+    "!lib/**/*.test.js",
+    "types/"
+  ],
+  "dependencies": {
+    "@sinonjs/commons": "^3.0.1",
+    "lodash.get": "^4.4.2",
+    "type-detect": "^4.1.0"
+  },
+  "devDependencies": {
+    "@sinonjs/eslint-config": "^5.0.3",
+    "@sinonjs/eslint-plugin-no-prototype-methods": "^0.1.1",
+    "@sinonjs/referee": "^11.0.1",
+    "@studio/changes": "^3.0.0",
+    "benchmark": "^2.1.4",
+    "husky": "^9.1.6",
+    "jquery": "^3.7.1",
+    "jsdoc": "^4.0.3",
+    "jsdom": "^25.0.0",
+    "jsdom-global": "^3.0.2",
+    "lint-staged": "^15.2.10",
+    "microtime": "^3.1.1",
+    "mocha": "^10.7.3",
+    "mochify": "^9.2.0",
+    "nyc": "^17.0.0",
+    "prettier": "^3.3.3",
+    "proxyquire": "^2.1.3",
+    "proxyquire-universal": "^3.0.1",
+    "proxyquireify": "^3.2.1",
+    "typescript": "^5.6.2"
+  },
+  "nyc": {
+    "exclude": [
+      "**/*.test.js",
+      "coverage/**",
+      "dist/**",
+      "out/**",
+      "site/**",
+      "eslint-local-rules.js",
+      "rollup.config.js",
+      "lib/deep-equal-benchmark.js"
+    ]
+  }
+}

github/codeql-action-v2/node_modules/@sinonjs/samsam/types/array-types.d.ts

@@ -0,0 +1,2 @@
+export = ARRAY_TYPES;
+declare var ARRAY_TYPES: (ArrayConstructor | Int8ArrayConstructor | Uint8ArrayConstructor | Uint8ClampedArrayConstructor | Int16ArrayConstructor | Uint16ArrayConstructor | Int32ArrayConstructor | Uint32ArrayConstructor | Float32ArrayConstructor | Float64ArrayConstructor)[];

github/codeql-action-v2/node_modules/@sinonjs/samsam/types/create-matcher.d.ts

@@ -0,0 +1,40 @@
+export = createMatcher;
+/**
+ * Creates a matcher object for the passed expectation
+ *
+ * @alias module:samsam.createMatcher
+ * @param {*} expectation An expecttation
+ * @param {string} message A message for the expectation
+ * @returns {object} A matcher object
+ */
+declare function createMatcher(expectation: any, message: string, ...args: any[]): object;
+declare namespace createMatcher {
+    export { isMatcher };
+    export let any: any;
+    export let defined: any;
+    export let truthy: any;
+    export let falsy: any;
+    export function same(expectation: any): any;
+    function _in(arrayOfExpectations: any): any;
+    export { _in as in };
+    export function typeOf(type: any): any;
+    export function instanceOf(type: any): any;
+    export let has: any;
+    export let hasOwn: any;
+    export function hasNested(property: any, value: any, ...args: any[]): any;
+    export function json(value: any): any;
+    export function every(predicate: any): any;
+    export function some(predicate: any): any;
+    export let array: any;
+    export let map: any;
+    export let set: any;
+    export let bool: any;
+    export let number: any;
+    export let string: any;
+    export let object: any;
+    export let func: any;
+    export let regexp: any;
+    export let date: any;
+    export let symbol: any;
+}
+import isMatcher = require("./create-matcher/is-matcher");