[dependabot]

Bumps fallow from 3.33.1 to 3.34.1.

Release notes

Sourced from fallow's releases.

v3.34.1: Oxlint config names, coverage maps, Vue templates and workspace globs

Bug fixes

• The Oxlint plugin reads .oxlintrc.jsonc and oxlint.config.mts. Oxlint finds these config files on its own, but fallow did not read them. Packages in their jsPlugins lists, at the top level and in overrides, showed as unused dependencies, and oxlint.config.mts showed as an unused file. Fallow now reads every config file name that Oxlint finds. Comments and trailing commas in .oxlintrc.jsonc parse correctly. Thanks @​gwynnnplaine for the report and the analysis. (#3525)
• A coverage map with a negative hit count loads. Vitest coverage-v8 can write a negative branch count, for example [5, -1], for the implicit else of an if. Fallow rejected the whole map. When --coverage or FALLOW_COVERAGE named the map, fallow health and fallow audit stopped with exit 2. Fallow now reads a negative count in s, f, b or b_T as 0, which is a miss. An auto-detected map that fails to load now gives a note that says fallow ignored it. Before, the note said that fallow used it. Thanks @​norvalbv for the report and the reproduction. (#3564)
• A < inside a nested Vue <template> keeps the references of the template. In \<template v-if="W">{{ 1 < 2 }}</template>, fallow read the < as the start of a tag and lost each name that the template used. Fallow then reported a named import that only the template used as an unused export. Fallow now skips {{ }} interpolations when it looks for the closing </template>. When no letter, /, ! or ? follows a <, fallow reads it as text, as in HTML. The cache versions change, so a warm cache does not keep the old result. Thanks @​BrocksiNet for the report and the minimal reproduction. (#3543)
• fallow health --type-aware --type-coupling passes --type-aware-require complete on large projects. The command failed --type-aware-require complete on projects with more than 40 coupling edges. The coupling report is one report for the whole project, and it now holds up to 10,000 evidence items. Fallow now reports a complete analysis as complete. Symbol, impact, and API-surface results keep the limit of 40 items. Above 10,000 items, the report stays partial with the evidence-limit reason. Thanks @​samaluk for the report and the experiment. (#3563)

Security

• Workspace globs no longer read directories outside the project root. An absolute entry, or an entry such as ../*, in package.json workspaces, pnpm-workspace.yaml packages, deno.json workspace, or the workspaces.patterns config listed directories outside the root. Fallow added no package from them. But a directory without a package.json got a glob-matched-no-package-json diagnostic with its outside path. Fallow now skips such an entry before it reads the disk. A new workspace-glob-outside-root diagnostic names the entry and the file that declares it. The run does not exit with an error, because npm, pnpm, and yarn accept a ../ workspace entry. A .. that stays inside the root, as in packages/../libs/*, still works. The findings do not change. (#3574)

Full Changelog: fallow-rs/fallow@v3.34.0...v3.34.1

v3.34.0: fallow mutation, segment-safe config globs, audit sub-analysis selection

Changed

• A single * in a config path glob now stays within one path segment. Only ** crosses directories. Before, src/plugins/*/index.js in entry also matched src/plugins/alpha/components/button/index.js. Each nested match became an entry point, so fallow did not report it as an unused file. The rule first applied to entry and dynamicallyLoaded (#3513, closes #3490). It now applies to every config path glob (#3541):

  • ignorePatterns, ignoreFindings, overrides[].files, ignoreExports[].file and ignoreCatalogReferences[].consumer,
  • duplicates.ignore, similarCode.ignore, health.ignore and health.thresholdOverrides[].files,
  • the boundaries zone and coverage globs, and the rule-pack file globs,
  • the framework[] fields usedExports[].pattern, manifestEntries[].manifests and detection.pattern.

  To keep the old match, change the single * to **. For example, change src/generated/* to src/generated/**, and *.test.ts to **/*.test.ts. For each pattern that now matches fewer files, fallow prints a warning on stderr. The warning names the config field, the pattern, the count of files that only the old rule matched, and the rewrite. --quiet hides the warning, and the JSON output does not change. A narrower glob can show new findings. Fallow matches a glob against each file path, not against each directory. Thus a line that you copy from .gitignore can match fewer files in ignorePatterns. Globs that match package names or import specifiers, such as ignoreDependencies and ignoreUnresolvedImports, do not change. Thanks @​jleifeld for the report.

• An existing prop-drilling: "error" setting now enforces CI. To report chains without an error, change the rule to warn. Archived JSON reports with effective_severity: "error" also render as errors. A config change does not rewrite those reports.

• Storybook, Vitest, Rstest, Jasmine and Playwright globs now accept every extglob group. One shared rewrite reads @(..), ?(..), +(..), *(..) and !(..) for these plugins and for import.meta.glob.

  • Storybook: before, only @(..) matched. Now ../src/**/!(*.dev).stories.@(js|ts) matches, and !(*.dev) excludes the files that match *.dev.
  • Playwright: before, a testMatch glob with a group made every script below testDir an entry point. Now only the matched files are entry points.
  • Vitest: before, a test.include glob with any group made no file an entry point. So fallow reported every test file as unused. A plain (a|b) group still matches one alternative.
  • Vitest, Rstest and Jasmine: !(..) and *(..) now match.
  • A +(..) group in an include glob now matches one or more repetitions. Before, Vitest, Rstest and Jasmine matched the group once only. The rewrite can also make a few more files entry points, for example a.test.jsx and a.test.tsx for *.test.+(ts|js). An exclude glob still matches the group once only.

• Complexity findings name more callback bodies. A function that got <anonymous> or <arrow> now takes a name from the code around it. Effect.fn("Users.create")(function* ...) gives Users.create, and it("renders", () => ...) gives it("renders"). A generator that a named function returns gives that name, for example load for const load = () => Effect.gen(function* ...). Scores and existing names do not change. A renamed finding gets a new CodeClimate fingerprint one time. An identity baseline gives the allowance of an <anonymous> or <arrow> bucket to the new names in the same file. A file move no longer moves an <arrow> bucket.

• Runs are faster in five places.

  • Plugin detection no longer walks node_modules for a Vitest, Jest or Rstest project glob. Since 3.33.1, a test.projects glob such as apps/**/vitest.config.ts read the full dependency store of a pnpm monorepo once per workspace. Plugin detection then took minutes. The walk now skips node_modules, .git, gitignored paths and symlinks that point out of the project root. Thanks @​wouterkroes for the report (closes #3532).
  • Import resolution is fast again in monorepos whose packages extend a root tsconfig that references them. Since 3.20.0, each source file checked about 760 configs in place of about 30. On a monorepo with 28 references and 4,200 modules, resolve imports takes 0.5 s in place of 10.1 s, with the same findings. Thanks @​thymikee for the report and for the patch in #3504 (closes #3503).
  • A run with a restored CI cache no longer rewrites every cache entry. An entry whose content did not change gets only its new timestamps. On a large monorepo, such a run is about a fifth faster. The dead-code run also frees its parsed modules on a helper thread.
  • An import through a barrel that does export * of many packages is now checked only against the packages that export its name. Findings do not change.
  • Each glob compile is about three times cheaper. A dead-code run takes about 5 to 7 percent fewer instructions on a mid-size project, and the binary is smaller.

• The build uses one oxc version. oxc_coverage_instrument moves to 0.14, which uses oxc 0.152 like the rest of fallow. cargo deny now fails when two versions of the core oxc crates enter the dependency graph.

• The MCP audit tool has a fallow://tools/audit guide. The guide names the five diff-risk rules and holds the styling, coverage, baseline, grouping, runtime-coverage and FALLOW_DIFF_FILE detail. The tool description is now a short summary that points to the guide (#3369).

• The guidance for workspace dependency declarations is clearer. Root imports of npm workspace packages need a dependency declaration, although npm links resolve them. The guidance covers private and tooling ancestor exceptions, self-references and explicit opt-outs. The policy does not change. Thanks @​VariableVince for the question (closes #3325).

Features

• fallow mutation measures how well the tests detect code changes. The command makes small changes (mutants) in the changed code and runs the project tests against each one. A mutant that no test fails on survives. The report gives the mutation score over the tested mutants and the survivors by file with their covering tests. It also gives the share of mutants that a test reaches.
  • The default scope is the changed code against the base ref, as for audit. --all and file paths widen or narrow it.
  • --plan selects and ranks the mutants and runs no code. fallow mutation inspect <mutant_id> shows one mutant against the current file. It reads the report of the last run, or the file that --report names. A changed file gives a stale status.
  • The runner is Vitest (>=4.1.0 <6.0.0), node:test of Node.js 22.18 or later, or bun test (>=1.4.0 <2.0.0). The default mutation.runner: auto detects it. An unsupported version exits with code 2 and FALLOW_MUTATION_RUNNER_UNSUPPORTED (#3407).
  • The node:test runner takes the module loading flags of the node --test command in the project scripts, such as --experimental-transform-types and --import (#3487). A borp script is a node:test run, and its globs give the test entry points (#3482).
  • Vue, Svelte and Astro components get mutants in their script blocks. Code that the framework compiler moves out of its block gives no mutant, for example the arguments of defineProps. An expression that holds a Svelte rune call gets no mutant, but the arguments of a rune still get mutants. With node:test and bun test, the plan leaves component files out with the skip reason runner-cannot-load (#3470).

... (truncated)

Commits

• 6605f96 chore: release v3.34.1
• d21bf47 fix(workspace): skip workspace globs that can leave the project root (#3574)
• 18d548e chore: resolve the first CodeQL alerts (#3573)
• 86582fc chore: tighten the release process after v3.34.0 (#3572)
• 4c3565e chore: add CodeQL and resolve dependency advisories (#3571)
• cdb8d8b fix(type-aware): carry project-wide evidence in type-coupling reports (#3570)
• 4426826 fix(extract): keep Vue template references when a nested template has a < (#3...
• 38697f8 fix(health): accept a coverage map with a negative hit count (#3568)
• 5ada5d2 fix(oxlint): read .oxlintrc.jsonc and oxlint.config.mts (#3567)
• a25c3c8 feat(scripts): rebase a stacked branch with ship-rebase --upstream (#3559)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	fallow@​3.33.1 ⏵ 3.34.1	+1	+2

View full report

[github-actions]

The repair workflow made a commit that changes code, so it did not push it. Review the full patch, then apply it in a checkout of the pull request branch. The command checks that the patch is the one listed here:

gh run download 40449758203 --repo fallow-rs/fallow-verdict --name dependabot-repair --dir /tmp/dependabot-repair
echo "8149393c01c401cbc5907a395894104f7c5a87a29d97a767fdc67cabfcd988e8  /tmp/dependabot-repair/repair.patch" | sha256sum -c -
git am /tmp/dependabot-repair/repair.patch && git push

Changed files:

 src/fallow/health.ts | 2 +-
 test/review.test.ts  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Patch:

From e329b9f62b6a7113b0ee1290352923d7dd01daad Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:28:05 +0000
Subject: [PATCH] fix(deps): accept fallow health schema_version 12

fallow 3.34.1 emits health schema_version 12, so the supported-version check rejected every scan and 12 review tests failed. Accept 12 instead of 11 and update the test fixture to match.
---
 src/fallow/health.ts | 2 +-
 test/review.test.ts  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/fallow/health.ts b/src/fallow/health.ts
index 238684e..83fab4f 100644
--- a/src/fallow/health.ts
+++ b/src/fallow/health.ts
@@ -14,7 +14,7 @@ import {
 } from "./run.ts";
 
 /** `fallow health` schema versions this release was verified against. */
-export const SUPPORTED_HEALTH_SCHEMA_VERSIONS: readonly string[] = ["11"];
+export const SUPPORTED_HEALTH_SCHEMA_VERSIONS: readonly string[] = ["12"];
 
 /** `fallow health` exits 1 when it reports a finding; the JSON is complete in both cases. */
 const EXIT_CODES_WITH_OUTPUT: ReadonlySet<number> = new Set([0, 1]);
diff --git a/test/review.test.ts b/test/review.test.ts
index 3c5f532..79a21a9 100644
--- a/test/review.test.ts
+++ b/test/review.test.ts
@@ -267,7 +267,7 @@ describe("review unit selection", () => {
     const log = path.join(root, "calls.log");
     const fake = path.join(root, "fake-fallow.mjs");
     const output = {
-      schema_version: 11,
+      schema_version: 12,
       version: "3.30.0",
       findings: [healthEntry("add", "crap"), healthEntry("read", "cyclomatic")],
     };
-- 
2.55.0

Summary from the repair run:

**Result:** committed
**Cause:** fallow 3.34.1 emits health schema_version 12, but the parser only accepted 11, so every review scan failed.
**Change:** set SUPPORTED_HEALTH_SCHEMA_VERSIONS to ["12"] in src/fallow/health.ts and the test fixture's schema_version to 12 in test/review.test.ts.
**Check:** not run locally. `npm ci --ignore-scripts` failed with EBUSY on node_modules/.bin in this environment, so vitest could not start. The change targets the exact error in the CI log, but v12 payload compatibility beyond the version number is unverified.

Repair run

[dependabot]

Superseded by #49.