[Fix] robustly unbox boxed primitives, using unbox-primitive

index.js

@@ -6,7 +6,7 @@ var flags = require('regexp.prototype.flags');
 var isArray = require('isarray');
 var isDate = require('is-date-object');
 var isBoxedPrimitive = require('is-boxed-primitive');
-var toPrimitive = require('es-to-primitive/es2015'); // TODO: replace this with ES2020 once updated
+var unboxPrimitive = require('unbox-primitive');
 
 var getTime = Date.prototype.getTime;
 var gPO = Object.getPrototypeOf;
@@ -23,7 +23,11 @@ function deepEqual(actual, expected, options) {
   var actualBoxed = isBoxedPrimitive(actual);
   var expectedBoxed = isBoxedPrimitive(expected);
   if (actualBoxed || expectedBoxed) {
-    return deepEqual(toPrimitive(actual), toPrimitive(expected), opts);
+    return deepEqual(
+      actualBoxed ? unboxPrimitive(actual) : actual,
+      expectedBoxed ? unboxPrimitive(expected) : expected,
+      opts
+    );
   }
 
   // 7.3. Other pairs that do not both pass typeof value == 'object', equivalence is determined by ==.

package.json

@@ -15,15 +15,15 @@
     "test": "npm run tests-only"
   },
   "dependencies": {
-    "es-to-primitive": "^1.2.0",
     "is-arguments": "^1.0.4",
     "is-boxed-primitive": "^1.0.0",
     "is-date-object": "^1.0.1",
     "is-regex": "^1.0.4",
     "isarray": "^2.0.5",
     "object-is": "^1.0.1",
     "object-keys": "^1.1.1",
-    "regexp.prototype.flags": "^1.2.0"
+    "regexp.prototype.flags": "^1.2.0",
+    "unbox-primitive": "^1.0.0"
   },
   "devDependencies": {
     "@ljharb/eslint-config": "^13.1.1",

test/cmp.js

@@ -449,6 +449,17 @@ test('boxed primitives', function (t) {
     st.end();
   });
 
+  t.test('`valueOf` is not called for boxed primitives', function (st) {
+    var a = Object(5);
+    a.valueOf = function () { throw new Error('failed'); };
+    var b = Object(5);
+    b.valueOf = function () { throw new Error('failed'); };
+
+    st.deepEqualTest(a, b, 'two boxed numbers with a thrower valueOf', true, true);
+
+    st.end();
+  });
+
   t.end();
 });