[`__proto__`] is a special property to access an object's prototype.  It
has many pitfalls:

- Setting it to an object value changes an object's prototype, which is
  generally discouraged and may be unexpected by the `iterator` callback.
- Setting it to a non-object value does nothing (meaning `seen[k] =
  true` has no effect).
- When Node.js is run with the [`--disable-proto=throw`] option, getting
  or setting `__proto__` causes an exception with code
  `ERR_PROTO_ACCESS` to be thrown.

Additionally, since this property (and all properties of
`Object.prototype`) are currently unused in this project by consumers of
`walk()`, it is both safe and preferable to exclude.

[`__proto__`]: https://tc39.es/ecma262/multipage/fundamental-objects.html#sec-object.prototype.__proto__
[`--disable-proto=throw`]: https://nodejs.org/api/cli.html#disable-protomode

Fixes: #2695

Signed-off-by: Kevin Locke <kevin@kevinlocke.name>

The ESM port of `createApi` (#2683, shipped in 21.1.0) replaced  `createSandbox: createSandbox` with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:

    createSandbox: function createSandbox(config) {
        const s = createConfiguredSandbox(config);
        sandbox.getFakes().push(s);
        return s;
    }

`Sandbox#restore` then walks that collection and calls `.restore()` on each entry. Because a sub-sandbox is itself an entry, every top-level `sinon.restore()` cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits `resetHistory` and
`verifyAndRestore`. This is the regression reported in #2701.

Restore the pre-21.1 behaviour: hand the root API a direct reference to `createConfiguredSandbox`. Sub-sandboxes are now isolated; only `subSandbox.restore()` (or `verifyAndRestore`) clears their fakes.

Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
end.

Closes #2701

fixes #2702

* fix(workflows): fetch-depth is for actions/checkout

* chore(workflows): update

- pin all actions to precise commits
- avoid credential leakage from actions/checkout
- group action updates going forward
- add zimor config to ignore "secrets outside env"
- add job to keep validating workflows

…processes (#2691)

* refactor: global mutable call id can grow unbounded across l

`callId` is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.

Affected files: proxy-invoke.js

Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

* Wrap around for all values that are too high

---------

Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>
Co-authored-by: Carl-Erik Kopseng <carlerik@gmail.com>

… fake-timers