[dependabot]

Bumps fallow from 3.30.0 to 3.33.1.

Release notes

Sourced from fallow's releases.

v3.33.1: health and duplication baselines in CI, Vitest fixes

Bug fixes

• The GitHub Action and the GitLab template can baseline health and duplication on the default run. A project with existing complexity can now gate the default fallow run with a baseline. Set the health-baseline and dupes-baseline inputs of the action, or FALLOW_HEALTH_BASELINE and FALLOW_DUPES_BASELINE in the GitLab template. Create the files with fallow health --save-baseline and fallow dupes --save-baseline. Other commands ignore these inputs. Both integrations report a stale health or duplication baseline, or one that another command saved. fail-on-stale-baseline (FALLOW_FAIL_ON_STALE_BASELINE) judges these baselines too. It also judges a --health-baseline or --dupes-baseline flag that you pass through args (FALLOW_ARGS). (#3316)
• The action and the GitLab template no longer count health findings that a baseline accepts. With a health baseline, the CLI passed, but the action and the GitLab template failed the job with fail-on-issues. A fallow health run also failed the job. The count now uses the findings that remain after the baseline. (#3316)
• The job summary counts health findings after the baseline. With a loaded health baseline, fallow report --format github-summary shows the new findings and gives the accepted ones as context, for example "2 new functions exceed thresholds (74 in the baseline)". Without a baseline, the summary does not change. (#3316)
• fallow --help names the baseline flags of the bare run. On bare fallow, --baseline and --save-baseline hold the dead-code baseline only. When a bare run gets a fallow health or fallow dupes baseline through --baseline, fallow now prints a note that tells you to use --health-baseline or --dupes-baseline. (#3316)
• The Vitest JSX import source follows the Vitest project model. On Vitest 5, an inline test.projects entry inherits the JSX import source of its config unless it sets extends: false. On Vitest 4, it inherits only with extends: true. Fallow reads the Vitest version from node_modules/vitest, else from the declared range. Project and base include globs add up. Fallow also reads a config that extends names. It reads project configs with a custom name, such as vitest.e2e.config.ts, also when a glob entry names them. Fallow no longer reports these files as unused. (#3318)
• Fallow reads test.exclude for the Vitest JSX import source. When test.exclude or a negated test.include entry removes a test file, Fallow no longer applies the JSX runtime of its project to that file. Without test.exclude, the Vitest default exclude applies. The globs are relative to test.dir, test.root or the Vite root when the config sets one. (#3318)
• react is no longer an unused dependency when Vitest test files use JSX with the default runtime. When a Vitest config sets no JSX import source, Vite imports the react JSX runtime. Fallow now credits react when a test file of that config has JSX and no @jsxImportSource pragma. A TypeScript test file gives no credit when its tsconfig sets jsxImportSource, or a jsx mode without the automatic runtime. The credit applies only to the workspace of the test file. A vite.config.* next to a vitest.config.* gives no credit, because Vitest does not load it. (#3318)
• The source-map warning of fallow coverage upload-source-maps tries the same paths as Fallow Cloud. The CLI dropped the first segments of a source such as webpack:///@scope/app/./src/x.ts, and the cloud did not. The warning could then check a path that the cloud never uses. A shared fixture of path cases now keeps the two implementations equal. (#3320)

Full Changelog: fallow-rs/fallow@v3.33.0...v3.33.1

v3.33.0: fallow architecture, baseline pruning, faster musl binaries

Features

• fallow architecture reports import cycles, boundary violations and rule-pack policy violations in one command. Use --cycles, --boundaries or --policy to select one kind. The command takes the same scope and output flags as fallow dead-code. Run fallow guard <files> before an edit and fallow architecture after it. Bare fallow shows these findings in an "Architecture" category after the other dead-code categories. It also shows the category with --quiet, --group-by and --summary. With --group-by, fallow architecture shows one "Architecture" heading per group.
• fallow architecture --format json writes kind: "architecture" with its own schema_version (1). With --group-by, the kind is architecture-grouped. The arrays, finding ids, actions, exit codes, gate outcomes and severities are the same as on fallow dead-code. next_steps names fallow architecture. With --explain, _meta.docs points to the architecture page, and _meta.rules lists only the architecture rules. --save-baseline writes a dead-code baseline (kind: "dead-code"), so the two commands read each other's baselines. The JSON schema and the generated TypeScript types have the ArchitectureOutput and ArchitectureGroupedOutput types.
• fallow report, MCP, the Node bindings and CI accept the architecture report.
  • fallow report --from renders a saved architecture or architecture-grouped file in every format, the same as the direct run. PR comments and reviews of fallow architecture have the title "Fallow architecture report".
  • The MCP server has a check_architecture tool, and Code Mode exposes it as checkArchitecture. The Node bindings have detectArchitecture, and fallow_api has run_architecture. Each returns the architecture output. detectCircularDependencies, detectBoundaryViolations and the MCP analyze tool keep the dead-code output.
  • Bare fallow accepts architecture in --only and --skip. --only architecture runs the dead-code analysis and reports only the architecture findings, and its Failed: line names architecture. --skip architecture removes these findings from the dead-code section. The health score and the --save-baseline file do not change.
  • The GitHub Action accepts command: architecture, and the GitLab template accepts FALLOW_COMMAND: architecture. For this command, issue-types and FALLOW_ISSUE_TYPES take cycles, boundaries and policy. Another value stops the job with exit code 2 and an error that names the valid values.
  • Telemetry records fallow architecture runs as the architecture workflow.
• fallow baselines prune removes the baseline entries of fixed findings. The command reads the files that audit.deadCodeBaseline, audit.healthBaseline and audit.dupesBaseline name. It runs one whole-project analysis and removes each entry that --baseline no longer matches. It never adds an entry, so a new finding stays visible to the gates. After a prune, --fail-on-stale-baseline passes, and the baseline hides the same findings as before. --check writes nothing and exits 1 when an entry can be pruned. --dead-code-baseline, --health-baseline and --dupes-baseline override the config paths. --coverage gives the coverage input for CRAP scores. The command skips a file with an older key form or with fields from a newer version. It prints the command that saves that file again. The stale-baseline warning and the gate message now name the prune command. Thanks @​BenMcGit for the request (#3281).
• fallow hooks install --target git --prune-baselines prunes the baselines in the pre-commit hook. The hook runs fallow baselines prune before the audit and stages the baseline files that the prune wrote. The prune reads the working tree, but the commit uses the index. So the hook skips the prune when the working tree has unstaged or untracked changes. It also skips the prune for a commit with paths (git commit <path>). A failed prune never blocks the commit. The hints for Lefthook and for an existing hook include the same step.
• fallow trace --dependency <package> reports how the code uses each imported name of a package. The report gives file and call counts, and sites with line and column. It follows one hop through project wrappers such as useSelector.withTypes(), and it counts each use that it cannot resolve. --sites, --specifier, --limit and --cursor page the sites. --callers --depth N adds the files that import the users. The MCP tool trace_dependency accepts the same options.
• A JSX import source in a Vitest config now adds a module graph edge. With the automatic JSX runtime, oxc.jsx.importSource (or the older esbuild.jsxImportSource) makes each test file with JSX import <source>/jsx-dev-runtime. Fallow now adds this edge when the source is a path and the test file has JSX and no @jsxImportSource pragma. A package source only marks the package as used. A local JSX runtime no longer shows as unused, and --impact-closure on a runtime file now includes these test files.
  • The edge applies to the files that test.include matches. Fallow uses the root config when it has no test.projects, else each inline project config.
  • A project inherits the root source only with extends: true. The classic runtime adds no edge.
  • A relative source resolves from the test file first, then from the config directory. A source that does not resolve adds no edge and no unresolved import.

Changed

• The Linux musl binaries are about 4 times faster. The malloc of musl is slow when many threads allocate, and fallow analyzes files in parallel. The musl binaries now use mimalloc. This applies to the linux-x64-musl and linux-arm64-musl npm packages and the musl release assets. On a 10-core aarch64 Alpine container, check, dupes and health took 77% less time over 15 fixture cases, with identical output. Peak memory is about a third higher. The Node addon keeps the default allocator. Glibc, macOS and Windows builds do not change.
• Fallow hides the findings in an unused file by default. Fallow no longer lists an unused export, type, class member or enum member in a file that it reports as unused. Deleting the file removes these findings too. The JSON output has the count in cascade_hidden, and SARIF and markdown (grouped or not) show the count too. To list the findings, pass --show-cascade, set showCascade in the config, or use the show_cascade parameter of the MCP tools. The health vital signs still count them. When an issue-type filter leaves out unused-files, nothing is hidden.
• fallow viz shows where to start and says what is wrong.
  • The Overview panel opens with the health grade and one card per lens. Each card shows the number of files, the number of high findings, and the worst file with its reason. The Overview map colors files that have findings in any lens. Folder labels show how many of their files have findings.
  • Each lens list opens with a short summary and a severity split. The list groups rows into high, medium and low. The full file name comes first, then a plain reason. For example, "File path built from input" replaces path-traversal, and "High complexity, no test coverage" replaces a CRAP score. Security lists each file once with all of its candidates.
  • Folders with no imports to or from other folders now show when the active lens has findings in them, for example unused files. Health colors only files above the review threshold, so high-risk files stand out. Folders without findings fade.
  • The Overview tab of the file panel opens with a list of the lenses that have findings in the file, each with its reason. The Health tab shows maintainability, change risk and importers. Then it lists each function to fix with its branches, lines, test coverage and next step. The treemap rings and names the selected file.
  • Folder and import-group labels have two lines (the name, then the size and findings). The labels stay over their cluster and keep clear of the controls and the legend. Import groups that span folders read as site/src + 5 more instead of (mixed). The status line shows the grouping or the path of the file in focus. The map hides disabled controls.
  • A click on a line between two folders lists the target files in use. Then it lists every import, with forbidden and cyclic imports first.
  • Hover tooltips use the same plain reasons as the panel. During a search, the legend explains the match and importer rings.
  • Below 700 px, the panel docks under the map as a sheet, so the map stays visible at full width. The legend becomes one line, crowded labels drop, and the file focus view fits both columns.
  • The map now follows the design of fallow.tools and fallow.cloud: paper and ink, Barlow type, hairline rules, square panels and flat controls. Day paper is the default. The night theme follows the system or the stored choice. The report embeds the fonts, so it looks the same offline.
  • On the graph, folders are octagons, the imports between them run at 0, 45 and 90 degrees, and flagged files have a ring. When you hover over an import line, the map picks the line under the pointer, gives it a pale blue halo and fades the others. Lines that are hidden at the current zoom no longer react. A hover over a file draws its imports the same way, in ink.
  • With a file open, the panel shows its place in the active lens ("3 of 61 in Security") with previous and next buttons. The j and k keys do the same.
  • High findings, sparse medium findings, and the copies of an open duplicated block get a halo on the graph.

... (truncated)

Commits

• fccff88 chore: release v3.33.1
• 9909983 fix(coverage): match the cloud source-map path candidates (#3320)
• c3c4c57 fix(vitest): use forward slashes in the project glob prefix on Windows (#3319)
• 503b8cd chore(release): set RELEASED_TAG to v3.33.0
• 29df8f5 chore(docker): pin FALLOW_VERSION 3.33.0 with refreshed checksums
• 576dc2b chore(napi): sync package.json / package-lock / index.js to v3.33.0
• 1cc5402 fix(vitest): follow the Vitest project model for the JSX import source (#3318)
• f4121c2 fix(action): baseline health and duplication on the default run (#3316)
• 278dbc6 chore: release v3.33.0
• 7615ef9 feat(vitest): add a graph edge for the Vitest JSX import source (#3315)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	fallow@​3.30.0 ⏵ 3.33.1	+1

View full report