[dependabot]

Bumps the js-tooling group with 3 updates: fallow, oxfmt and oxlint.

Updates fallow from 3.34.1 to 3.36.0

Release notes

Sourced from fallow's releases.

v3.36.0: redundant config entries, literal-membership complexity, dotenv plugin

Features

• Fallow reports config entries that match something but change nothing in the dead-code run. Three new workspace_diagnostics[].kind values name the config entry in pattern. entry-pattern-redundant marks an entry pattern whose matched files are all entry points from another source, such as package.json, a plugin or dynamicallyLoaded. ignore-dependencies-entry-redundant marks an ignoreDependencies entry that hid no finding. ignore-patterns-entry-redundant marks an ignorePatterns glob whose files a built-in ignore, .gitignore or the file type filter already skips. The entries show up in JSON, SARIF, the human and CI formats, the PR comments and the LSP. A --production run reports none of them. The exit codes and schema_version do not change. Thanks @​Smrtnyk for the request. (#3824)

• health.cyclomaticPolicy: "literal-membership" counts a literal membership chain as one predicate. With this policy, kind === "a" || kind === "b" || kind === "c" adds no cyclomatic increments for its || operators. Only strict equality checks of one identifier against string, number, bigint, boolean or null literals qualify. The policy applies to the maxCyclomatic gate and to every CRAP score. Findings report the policy value as cyclomatic and the standard value as standard_cyclomatic. The summary names the policy, and --complexity-breakdown marks the chain operators with literal_membership. The default stays standard, and the health score, complexity density and hotspots keep the standard count. Thanks @​lebedev-nikita for the request. (#3781)

• Fallow has a built-in dotenv plugin. Scripts that call dotenvx credit @dotenvx/dotenvx, and dotenvx run -- <command> credits the wrapped command. fallow migrate maps the dotenv plugin key. Thanks @​VariableVince for the patch in #3771. (#3762)

• Type-aware analysis has an experimental tsrs backend. Set FALLOW_TYPE_AWARE_BACKEND=tsrs to run the semantic pass on tsrs, the Rust port of the TypeScript 7 checker. Install the pinned tsrs version next to fallow-type-aware. fallow type-aware status and _meta.type_aware report the backend that ran. TypeScript-Go stays the default.

Changed

• A file that nests too deep to parse has its own workspace diagnostic. Fallow reported such a file as source-parse-degraded, with a message about parser errors, although the file can be valid code. It is now source-nesting-too-deep, with the cap in limit. The file still counts for the parse-error gate, and its item in gate_outcomes["parse-error"].files has reason: "nesting-too-deep". A script or tool that filters on source-parse-degraded must also match source-nesting-too-deep to keep seeing these files.

• The agent gate prints a short block message. When the gate blocks a git commit or git push, stderr now holds one line for each finding that caused the block, the verdict, and the path of the full JSON report. Under the default gate = "new-only", the list holds only the introduced findings. The full report goes to .fallow/gate-report.json in the audited tree. Set FALLOW_GATE_REPORT to write it to another path, or FALLOW_GATE_OUTPUT=json to print the full report on stderr as before. The exit codes do not change. Run fallow agent install again to update an installed gate. Thanks @​ankoor7 for the report. (#3725)

• Every platform npm package now ships a LICENSE file and a full README. The README names the platform, the package to install instead, and how to verify the binary.

• A short TypeScript input no longer uses seconds of parse time. Such an input now stops at its syntax error at once, without gigabytes of memory. Analysis output for real projects does not change. The extraction, graph and duplication caches get a new version, so the first run after the upgrade is cold. The minimum Rust version of the Fallow crates goes from 1.96 to 1.97.

Bug fixes

• unused-class-members credits parameter, nested, loop and instance destructures. These forms now credit Service.m without --type-aware:

  • a parameter destructure or a destructuring assignment, such as ({ m }: Service) => m() and ({ m } = service);
  • a nested destructure, such as ({ k: { m } } = holder).

  These forms now credit Service.m with and without --type-aware:

  • a for...of destructure, a parameter destructure with a default value, and a parameter annotated with typeof;
  • a destructure of an imported instance or of a class field, such as const { m } = this.service.

  A local that provably holds no class instance no longer gives credit through a shadowed module instance. (#3798)

• fallow dead-code --type-aware no longer confirms a used member or export as unused when a shorthand name or a namespace object reads it. The check now finds shorthand destructures, shorthand object properties, and static reads of a namespace object. When the check cannot prove which exports a namespace use reads, for example console.log(ns) or ns[key], it abstains with dynamic-behavior for every export of that module. This includes the exports that a barrel re-exports. For a computed destructure key of a class instance, the check abstains with dynamic-member-access.

• unused-exports marks every export of a namespace import as used when a destructure with a computed key reads the namespace. A computed key, such as const { [name]: value } = ns, can read any export, so all exports of ns are now used.

• Deep nesting no longer aborts a run. A file with thousands of nested brackets, or deep generics, JSX, ternaries and long chains, could overflow the stack and stop the process. Fallow now measures the bracket depth before it parses, and it parses each file on a stack sized from its length. A file past the limit shows as a file that failed to parse, and the analysis of the other files continues. The language server and the MCP decision_surface tool now use the same large analysis stack as the CLI. The thread count of decision_surface now follows the threads option. Deeply nested stylesheets get the same protection in the CSS parser.

• Vite projects no longer report Sass files that Vite loads without an import as unused. An @use in css.preprocessorOptions.scss.additionalData now follows the Sass partial and index rules. A Sass @use resolves through a Vite resolve.alias entry. The file that vite-plugin-vuetify reads from styles.configFile is an entry point. Thanks @​Smrtnyk for the three reports. (#3819, #3820, #3821)

• SCSS Modules no longer report Sass module members or view transition classes as unused. A namespaced call such as math.div(100px, 10), a namespaced mixin such as @include utils.baz, and the argument of ::view-transition-new(.demo) are no longer exported classes. Thanks @​rothsandro for the reports. (#3839, #3840)

• fallow health --production no longer marks tested functions as untested. The CRAP estimate, coverage gaps and runtime coverage evidence now read test reachability from a graph of the full project. Findings still come only from production files. A production health run builds this second graph, so it takes more time. Thanks @​Smrtnyk for the report and the reproduction. (#3822)

• A private class method now takes coverage from its own record. fallow health --coverage used to report a private method (#name() {}) as estimated. The V8 converter now writes a record for each private method, and Fallow uses a record with the same #name near the method. The istanbul-lib-instrument package writes no record for a private method, so its reports do not change. Thanks @​Jerc92 for the report. (#3816)

• fallow audit --gate new-only no longer reports an unchanged anonymous function as introduced when only its CRAP score changes. Audit now also matches on the cyclomatic and cognitive values before it uses line order. Thanks @​Jerc92 for the report and the reproduction. (#3815)

• Bare fallow now applies the coverage-gaps rule, as fallow health does. A rule at error now makes the human run exit 1, and gate_outcomes gets a health-coverage-gaps entry. The machine formats exit 1 on it only with --fail-on-issues or --ci. Thanks @​Smrtnyk for the report. (#3823)

... (truncated)

Commits

• 3c6e45b chore: release v3.36.0
• 8b6af94 chore: release v3.36.0
• 0c702d1 fix(codeowners): keep an escaped space in a CODEOWNERS pattern (#3860)
• 503f7c4 fix(codeowners): bound the wildcards in a CODEOWNERS file (#3859)
• c030eb1 fix(hooks): audit only the pushed worktree when a push cannot send the sessio...
• 5b40869 fix(ship): wait for a passed check and print a complete wait command (#3858)
• 342c692 chore(changelog): check changelog fragments before commit (#3856)
• 769e015 feat(config): report config entries that have no effect (#3850)
• a1ac875 feat(hooks): print a compact block message from the agent gate (#3849)
• 9e31a6e fix(extract): skip Sass module members and view transition arguments in SCSS ...
• Additional commits viewable in compare view

Updates oxfmt from 0.73.0 to 0.74.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.74.0

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with LF (#27821) (leaysgur)
• 2c1cc20 formatter: Keep comment only Vue bindings as-is (#27820) (leaysgur)
• 1bf236d formatter/sort_imports: Do not use comments as import source (#27819) (leaysgur)
• 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#27818) (leaysgur)
• 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#27814) (leaysgur)
• a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#27812) (leaysgur)
• de110ce formatter: Keep more parens around TSInstantiationExpression (#27811) (leaysgur)
• 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#27785) (leaysgur)
• 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#27780) (leaysgur)
• 5605362 oxfmt: Validate editorconfig as like oxfmtrc (#27778) (leaysgur)
• 5b2acb0 formatter_core: Report error position releative to CRLF source (#27777) (leaysgur)
• c78e80e formatter_core: Report parse error positions relative to the BOM-headed source (#27776) (leaysgur)
• 3a980c9 formatter_toml: Handle BOM like other languages (#27775) (leaysgur)
• 97c9fc4 oxfmt: Handle BOM in config JSON (#27774) (leaysgur)
• 28eb4a7 oxfmt: Print trailing newline for --list-different (#27773) (leaysgur)
• d2bea21 formatter: Glue comments to an opener in empty for-head slots and array holes (#27737) (leaysgur)
• 6a95ec1 formatter: Keep comment position on holey array (#27730) (leaysgur)
• 54769da formatter: Break after dangling line comment in holey array (#27729) (leaysgur)
• 99077ef formatter_json: Reject unary expressions other than signed numbers (#27728) (leaysgur)
• 22cd4cd formatter_json: Handle holey array and comments (#27727) (leaysgur)
• 644ca1c formatter: Do not indent logical chains whose right sides all inline (#27667) (leaysgur)
• a07a0fb formatter: Wrap comment-only JSX expression container in a group (#27666) (leaysgur)

⚡ Performance

• e220293 formatter: Check only the operator suppression mark in is_quiet (#27952) (leaysgur)
• e5fdc9c formatter_core: Write into one element stack through a concrete Formatter (#27559) (leaysgur)
• a342f7e formatter: Skip comment handling for nodes with no comment near them (#27557) (leaysgur)
• d8ce750 formatter: Write string literals with swapped quotes into the arena (#27558) (Yuji Sugiura)
• 1c393c0 formatter_core: Skip scanning texts with nothing to rewrite (#27561) (leaysgur)
• 1d3ef10 formatter_core: Keep the embedded IR when nothing in it is rewritten (#27673) (leaysgur)

📚 Documentation

• 1325225 oxfmt: Update useless comment prefix (#27956) (leaysgur)
• d0dd140 formatter: Note lossy cooked round-trip in template embeds (#27944) (leaysgur)
• 8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (#27824) (leaysgur)

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• See full diff in compare view

Updates oxlint from 1.88.0 to 1.89.0

Release notes

Sourced from oxlint's releases.

oxlint v1.89.0

💥 BREAKING CHANGES

• e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
• a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

• 770ada4 linter: Mark vue 3 rules as recommended (#27717) (Cam McHenry)
• ba38c1d linter: Mark react/react-hooks rules as recommended (#27701) (Cam McHenry)
• d85a3ba linter: Mark promise rules as recommended (#27693) (Cam McHenry)
• e71c88a linter: Mark node rule as recommended (#27692) (Cam McHenry)
• 7213f61 linter: Mark nextjs rules as recommended (#27691) (Cam McHenry)
• d7c6b26 linter: Mark jsx-a11y rules as recommended (#27690) (Cam McHenry)
• 199dfdc linter: Mark jsdoc rules as recommended (#27689) (Cam McHenry)
• 780bff3 linter: Mark jest/vitest rules as recommended (#27672) (Cam McHenry)
• 6ae6859 linter: Mark import rules as recommended (#27671) (Cam McHenry)
• b7a1df3 linter: Mark unicorn rules as recommended (#27670) (Cam McHenry)
• c44a355 linter: Mark typescript rules as recommended from upstream (#27634) (Cam McHenry)
• 6b49dba linter: Mark eslint rules as recommended from upstream (#27632) (Cam McHenry)

🐛 Bug Fixes

• 7c47246 linter: Check module specifiers and string values that contain lone surrogates (#26717) (Dunqing)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• 326904f linter/unicorn/no-useless-undefined: Allow undefined in React.useRef (#25027) (Chris Dokurno)
• f9cf165 linter/unicorn/prefer-spread: Ignore super method calls (#27868) (camc314)
• 00484e1 linter/eslint/prefer-const: Report destructuring assignments inside blocks (#27856) (camc314)
• 9c35461 linter/eslint/sort-vars: Report every out-of-order declaration (#27767) (camc314)
• 01e1c5e linter/unicorn/prefer-string-replace-all: Resolve regex variables (#27769) (camc314)
• 7f474d5 linter/eslint/no-loop-func: Detect writes after the loop (#27754) (camc314)
• 4b7fea6 linter/eslint/block-scoped-var: Ignore declarations without writes (#27760) (camc314)
• 2947917 linter/eslint/no-lonely-if: Check final else blocks in else-if chains (#27759) (camc314)
• fc039b5 linter/eslint/sort-imports: Check imports after other statements (#27749) (camc314)
• 1acba97 linter/unicorn/prefer-at: Report slice index reads once (#27762) (camc314)
• 6190e26 linter/eslint/prefer-arrow-callback: Ignore functions used as conditional tests (#27533) (Anzal Husain Abidi)
• b3cdaaf linter/eslint/sort-keys: Check computed identifier names (#27748) (camc314)
• 170e608 linter/unicorn/prefer-native-coercion-functions: Check object methods and function properties (#27750) (camc314)
• 9261df7 linter/unicorn/prefer-string-raw: Check object property values (#27758) (camc314)
• ddea86b linter/eslint/prefer-template: Report separate nested concatenations (#27764) (camc314)
• 2c67197 linter/eslint/no-unused-vars: Count conditional calls in sequences as uses (#27755) (camc314)
• 7f22fa0 linter/unicorn/prefer-regexp-test: Check logical operands in boolean contexts (#27761) (camc314)
• 3c44398 linter/eslint/class-methods-use-this: Count this in parameter defaults (#27756) (camc314)
• d85923f linter/eslint/no-param-reassign: Report rest parameter writes (#27765) (camc314)
• 8ea47bb linter/unicorn/prefer-type-error: Handle parenthesized type checks (#27766) (camc314)
• e96856c linter/unicorn/catch-error-name: Check unused underscore-prefixed names (#27751) (camc314)
• d8ca399 linter/unicorn/no-array-callback-reference: Ignore callback factory calls (#27763) (camc314)
• 1267ab8 linter/eslint/max-params: Count rest parameters (#27757) (camc314)
• 9ff25c3 linter/eslint/no-useless-assignment: Report dead stores to function parameters (#27735) (camc314)
• ee5e730 linter/eslint/no-setter-return: Check setters in property descriptors (#27731) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.89.0] - 2026-10-19

🐛 Bug Fixes

• 9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#27699) (camc314)

Commits

• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• 9a424c2 fix(oxlint,oxfmt): correct Node.js TypeScript support range (#27699)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​oxfmt@​0.73.0 ⏵ 0.74.0	-7
	npm/​oxlint@​1.88.0 ⏵ 1.89.0	+1		+1	+2
	npm/​fallow@​3.34.1 ⏵ 3.36.0

View full report

[codspeed]

Merging this PR will not alter performance

1 warning, 1 note

⚠️ 7 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

ℹ️ 15 benchmarks have no flamegraph

The flamegraph wasn't generated: most of the time was spent in runtime internals, which would leave nothing useful to analyze.

See affected benchmarks

✅ 188 untouched benchmarks
⏩ 77 skipped benchmarks¹

---

_{Comparing dependabot/npm_and_yarn/js-tooling-d1220132cc (765714b) with main (032b784)}

Footnotes

1. 77 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩