Merge pull request #19854 from Napalys/js/sinon

JS: Explicitly Mark `Sinon` Package as Non RegExp

javascript/ql/lib/change-notes/2025-06-20-sinon.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `sinon.match()` are no longer incorrectly identified as regular expression operations.

javascript/ql/lib/semmle/javascript/Regexp.qll

@@ -998,6 +998,8 @@ private predicate isUsedAsNonMatchObject(DataFlow::MethodCallNode call) {
     or
     // Result is obviously unused
     call.asExpr() = any(ExprStmt stmt).getExpr()
+    or
+    call = API::moduleImport("sinon").getMember("match").getACall()
   )
 }