withArgs stops matching Buffers by content in 21.0.2 (samsam major bump in patch release)

[marie-bisault]

Describe the bug

stub.withArgs() no longer matches Buffer arguments by content when called with a different reference holding the same bytes. This regression was introduced in 21.0.2.

To Reproduce

const sinon = require('sinon')

const buf1 = Buffer.from([255, 216, 255, 224])
const buf2 = Buffer.from([255, 216, 255, 224]) // same content, different reference

const stub = sinon.stub()
stub.withArgs({ buffer: buf1 }).returns('ok')

console.log(stub({ buffer: buf2 }))
// sinon@21.0.1 → 'ok'
// sinon@21.0.2 → undefined

Expected behavior
withArgs should match Buffer instances with equal content, as it did in 21.0.1.

Screenshots
N/A

Context:

• Sinon version: 21.0.2 (broken), verified working on 21.0.1
• Runtime: Node 22.14.0
• Output of npx envinfo --browsers --binaries:

  Binaries:
    Node: 22.14.0 - /usr/local/.nvm/versions/node/v22.14.0/bin/node
    Yarn: 4.9.2 - /usr/local/.nvm/versions/node/v22.14.0/bin/yarn
    npm: 10.9.2 - /usr/local/.nvm/versions/node/v22.14.0/bin/npm
    bun: 1.2.23 - /usr/local/.bun/bin/bun
  Browsers:
    Chrome: 145.0.7632.159
    Firefox: 148.0
    Firefox Developer Edition: 148.0

• Other relevant environmental info: the root cause is a dependency bump in sinon's own package.json between 21.0.1 and 21.0.2:
  21.0.1 → "@sinonjs/samsam": "^8.0.3"
  21.0.2 → "@sinonjs/samsam": "^9.0.2"
• A major samsam version was introduced in a patch sinon release, which violates semver and silently breaks any project using "sinon": "^21.0.0" on the next install.
• Other libraries you are using: none required to reproduce
• Example URL: N/A

Additional context:
Suggested fix: revert the samsam bump in a 21.0.3 patch, or re-release with a minor/major version bump to properly signal the breaking change.

Workaround in the meantime: pin sinon to 21.0.1.

[mattbaileyuk]

We're having the same problem with .calledWith() where the contents has a Buffer, so it does look like there's a matching issue with samsam@9; if we override @sinonjs/samsam in package.json back to 8.0.3 then our failing test cases work again.

Agree it feels like it should be rolled back for a 21.0.3, and then breaking changes handled in a new major version of sinon.

[mattbaileyuk]

I've raised sinonjs/samsam#289 as I was able to put together a simple recreate in samsam

[fatso83]

Fix coming up shortly. Ref #2681 (comment)

[fatso83]

Fix from sinonjs/samsam#291 released . Running rm -r node_modules/@sinonjs/*; npm install should fix it, as will bump the patch version of the package.

[fatso83]

Not releasing new major version as this was an unintended breakage. Hopefully the new tests put in place into samsam should catch future regressions.