Issues

• dead-code: credit a .d.mts type read through a namespace import

  bug
  fallow-rs/fallow#4551 · Filter by author BartWaardenburg opened on Nov 12, 2026

• security: report a tainted argument array of spawn with shell: true

  bug
  fallow-rs/fallow#4550 · Filter by author BartWaardenburg opened on Nov 12, 2026

• security: report execFile with shell: true and a tainted argument

  bug
  fallow-rs/fallow#4549 · Filter by author BartWaardenburg opened on Nov 12, 2026

• unused-class-member: credit Durable Object stubs from env, helpers and class fields

  bug
  fallow-rs/fallow#4548 · Filter by author BartWaardenburg opened on Nov 12, 2026

• import.meta.glob with a raw or url query credits every export of its matches

  fallow-rs/fallow#4532 · Filter by author stanlrt opened on Nov 11, 2026

• Inline package.json config of a workspace package is not read

  fallow-rs/fallow#4530 · Filter by author stanlrt opened on Nov 11, 2026

• Production mode drops production files in a directory named test

  fallow-rs/fallow#4498 · Filter by author BartWaardenburg opened on Nov 11, 2026

• Parse error for a small .js file with JSX and for a top-level return in CommonJS

  fallow-rs/fallow#4497 · Filter by author BartWaardenburg opened on Nov 11, 2026

• Validate the mutation step of the Action and the GitLab template on real PRs and MRs

  area:actionarea:ciarea:mutationtype:test-coverage
  fallow-rs/fallow#4383 · Filter by author BartWaardenburg opened on Nov 9, 2026

• Flaky test: sidecar api-surface test gets "context canceled" on stderr

  testtype:hardening
  fallow-rs/fallow#4325 · Filter by author BartWaardenburg opened on Nov 6, 2026
  1

• Detect state that one module writes and another module reads without an import

  area:extractarea:graphenhancement
  fallow-rs/fallow#4281 · Filter by author BartWaardenburg opened on Nov 6, 2026

• Review the remaining trust-boundary surfaces (CI workflow, Action scripts, credentials, MCP dispatch)

  area:securitytype:hardeningtype:tracking
  fallow-rs/fallow#4259 · Filter by author BartWaardenburg opened on Nov 5, 2026

• Split --unused-deps into unused and misplaced dependency selectors in v4

  area:clistatus:major-versiontype:ux
  fallow-rs/fallow#4114 · Filter by author BartWaardenburg opened on Nov 3, 2026

• Update cssparser-color after non-finite hue normalization

  area:extractbugdependenciespriority:mediumstatus:blockedtype:correctness
  fallow-rs/fallow#3915 · Filter by author BartWaardenburg opened on Oct 26, 2026

• Adopt the upstream nested light-dark() fix

  area:extractbugdependenciespriority:mediumstatus:blockedtype:hardening
  fallow-rs/fallow#3914 · Filter by author BartWaardenburg opened on Oct 26, 2026

• Next major: bare machine formats exit 1 on findings, as dead-code does

  area:ciarea:clienhancementpriority:mediumstatus:major-versiontype:correctness
  fallow-rs/fallow#3874 · Filter by author BartWaardenburg opened on Oct 25, 2026

• Next major: remove the architecture findings from fallow dead-code

  area:boundariesarea:clienhancementpriority:lowstatus:major-version
  fallow-rs/fallow#3293 · Filter by author BartWaardenburg opened on Oct 8, 2026