[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the js-tooling group with 3 updates: fallow, oxfmt and oxlint.

Updates fallow from 3.33.1 to 3.34.1

Release notes

Sourced from fallow's releases.

v3.34.1: Oxlint config names, coverage maps, Vue templates and workspace globs

Bug fixes

• The Oxlint plugin reads .oxlintrc.jsonc and oxlint.config.mts. Oxlint finds these config files on its own, but fallow did not read them. Packages in their jsPlugins lists, at the top level and in overrides, showed as unused dependencies, and oxlint.config.mts showed as an unused file. Fallow now reads every config file name that Oxlint finds. Comments and trailing commas in .oxlintrc.jsonc parse correctly. Thanks @​gwynnnplaine for the report and the analysis. (#3525)
• A coverage map with a negative hit count loads. Vitest coverage-v8 can write a negative branch count, for example [5, -1], for the implicit else of an if. Fallow rejected the whole map. When --coverage or FALLOW_COVERAGE named the map, fallow health and fallow audit stopped with exit 2. Fallow now reads a negative count in s, f, b or b_T as 0, which is a miss. An auto-detected map that fails to load now gives a note that says fallow ignored it. Before, the note said that fallow used it. Thanks @​norvalbv for the report and the reproduction. (#3564)
• A < inside a nested Vue <template> keeps the references of the template. In \<template v-if="W">{{ 1 < 2 }}</template>, fallow read the < as the start of a tag and lost each name that the template used. Fallow then reported a named import that only the template used as an unused export. Fallow now skips {{ }} interpolations when it looks for the closing </template>. When no letter, /, ! or ? follows a <, fallow reads it as text, as in HTML. The cache versions change, so a warm cache does not keep the old result. Thanks @​BrocksiNet for the report and the minimal reproduction. (#3543)
• fallow health --type-aware --type-coupling passes --type-aware-require complete on large projects. The command failed --type-aware-require complete on projects with more than 40 coupling edges. The coupling report is one report for the whole project, and it now holds up to 10,000 evidence items. Fallow now reports a complete analysis as complete. Symbol, impact, and API-surface results keep the limit of 40 items. Above 10,000 items, the report stays partial with the evidence-limit reason. Thanks @​samaluk for the report and the experiment. (#3563)

Security

• Workspace globs no longer read directories outside the project root. An absolute entry, or an entry such as ../*, in package.json workspaces, pnpm-workspace.yaml packages, deno.json workspace, or the workspaces.patterns config listed directories outside the root. Fallow added no package from them. But a directory without a package.json got a glob-matched-no-package-json diagnostic with its outside path. Fallow now skips such an entry before it reads the disk. A new workspace-glob-outside-root diagnostic names the entry and the file that declares it. The run does not exit with an error, because npm, pnpm, and yarn accept a ../ workspace entry. A .. that stays inside the root, as in packages/../libs/*, still works. The findings do not change. (#3574)

Full Changelog: fallow-rs/fallow@v3.34.0...v3.34.1

v3.34.0: fallow mutation, segment-safe config globs, audit sub-analysis selection

Changed

• A single * in a config path glob now stays within one path segment. Only ** crosses directories. Before, src/plugins/*/index.js in entry also matched src/plugins/alpha/components/button/index.js. Each nested match became an entry point, so fallow did not report it as an unused file. The rule first applied to entry and dynamicallyLoaded (#3513, closes #3490). It now applies to every config path glob (#3541):

  • ignorePatterns, ignoreFindings, overrides[].files, ignoreExports[].file and ignoreCatalogReferences[].consumer,
  • duplicates.ignore, similarCode.ignore, health.ignore and health.thresholdOverrides[].files,
  • the boundaries zone and coverage globs, and the rule-pack file globs,
  • the framework[] fields usedExports[].pattern, manifestEntries[].manifests and detection.pattern.

  To keep the old match, change the single * to **. For example, change src/generated/* to src/generated/**, and *.test.ts to **/*.test.ts. For each pattern that now matches fewer files, fallow prints a warning on stderr. The warning names the config field, the pattern, the count of files that only the old rule matched, and the rewrite. --quiet hides the warning, and the JSON output does not change. A narrower glob can show new findings. Fallow matches a glob against each file path, not against each directory. Thus a line that you copy from .gitignore can match fewer files in ignorePatterns. Globs that match package names or import specifiers, such as ignoreDependencies and ignoreUnresolvedImports, do not change. Thanks @​jleifeld for the report.

• An existing prop-drilling: "error" setting now enforces CI. To report chains without an error, change the rule to warn. Archived JSON reports with effective_severity: "error" also render as errors. A config change does not rewrite those reports.

• Storybook, Vitest, Rstest, Jasmine and Playwright globs now accept every extglob group. One shared rewrite reads @(..), ?(..), +(..), *(..) and !(..) for these plugins and for import.meta.glob.

  • Storybook: before, only @(..) matched. Now ../src/**/!(*.dev).stories.@(js|ts) matches, and !(*.dev) excludes the files that match *.dev.
  • Playwright: before, a testMatch glob with a group made every script below testDir an entry point. Now only the matched files are entry points.
  • Vitest: before, a test.include glob with any group made no file an entry point. So fallow reported every test file as unused. A plain (a|b) group still matches one alternative.
  • Vitest, Rstest and Jasmine: !(..) and *(..) now match.
  • A +(..) group in an include glob now matches one or more repetitions. Before, Vitest, Rstest and Jasmine matched the group once only. The rewrite can also make a few more files entry points, for example a.test.jsx and a.test.tsx for *.test.+(ts|js). An exclude glob still matches the group once only.

• Complexity findings name more callback bodies. A function that got <anonymous> or <arrow> now takes a name from the code around it. Effect.fn("Users.create")(function* ...) gives Users.create, and it("renders", () => ...) gives it("renders"). A generator that a named function returns gives that name, for example load for const load = () => Effect.gen(function* ...). Scores and existing names do not change. A renamed finding gets a new CodeClimate fingerprint one time. An identity baseline gives the allowance of an <anonymous> or <arrow> bucket to the new names in the same file. A file move no longer moves an <arrow> bucket.

• Runs are faster in five places.

  • Plugin detection no longer walks node_modules for a Vitest, Jest or Rstest project glob. Since 3.33.1, a test.projects glob such as apps/**/vitest.config.ts read the full dependency store of a pnpm monorepo once per workspace. Plugin detection then took minutes. The walk now skips node_modules, .git, gitignored paths and symlinks that point out of the project root. Thanks @​wouterkroes for the report (closes #3532).
  • Import resolution is fast again in monorepos whose packages extend a root tsconfig that references them. Since 3.20.0, each source file checked about 760 configs in place of about 30. On a monorepo with 28 references and 4,200 modules, resolve imports takes 0.5 s in place of 10.1 s, with the same findings. Thanks @​thymikee for the report and for the patch in #3504 (closes #3503).
  • A run with a restored CI cache no longer rewrites every cache entry. An entry whose content did not change gets only its new timestamps. On a large monorepo, such a run is about a fifth faster. The dead-code run also frees its parsed modules on a helper thread.
  • An import through a barrel that does export * of many packages is now checked only against the packages that export its name. Findings do not change.
  • Each glob compile is about three times cheaper. A dead-code run takes about 5 to 7 percent fewer instructions on a mid-size project, and the binary is smaller.

• The build uses one oxc version. oxc_coverage_instrument moves to 0.14, which uses oxc 0.152 like the rest of fallow. cargo deny now fails when two versions of the core oxc crates enter the dependency graph.

• The MCP audit tool has a fallow://tools/audit guide. The guide names the five diff-risk rules and holds the styling, coverage, baseline, grouping, runtime-coverage and FALLOW_DIFF_FILE detail. The tool description is now a short summary that points to the guide (#3369).

• The guidance for workspace dependency declarations is clearer. Root imports of npm workspace packages need a dependency declaration, although npm links resolve them. The guidance covers private and tooling ancestor exceptions, self-references and explicit opt-outs. The policy does not change. Thanks @​VariableVince for the question (closes #3325).

Features

• fallow mutation measures how well the tests detect code changes. The command makes small changes (mutants) in the changed code and runs the project tests against each one. A mutant that no test fails on survives. The report gives the mutation score over the tested mutants and the survivors by file with their covering tests. It also gives the share of mutants that a test reaches.
  • The default scope is the changed code against the base ref, as for audit. --all and file paths widen or narrow it.
  • --plan selects and ranks the mutants and runs no code. fallow mutation inspect <mutant_id> shows one mutant against the current file. It reads the report of the last run, or the file that --report names. A changed file gives a stale status.
  • The runner is Vitest (>=4.1.0 <6.0.0), node:test of Node.js 22.18 or later, or bun test (>=1.4.0 <2.0.0). The default mutation.runner: auto detects it. An unsupported version exits with code 2 and FALLOW_MUTATION_RUNNER_UNSUPPORTED (#3407).
  • The node:test runner takes the module loading flags of the node --test command in the project scripts, such as --experimental-transform-types and --import (#3487). A borp script is a node:test run, and its globs give the test entry points (#3482).
  • Vue, Svelte and Astro components get mutants in their script blocks. Code that the framework compiler moves out of its block gives no mutant, for example the arguments of defineProps. An expression that holds a Svelte rune call gets no mutant, but the arguments of a rune still get mutants. With node:test and bun test, the plan leaves component files out with the skip reason runner-cannot-load (#3470).

... (truncated)

Commits

• 6605f96 chore: release v3.34.1
• d21bf47 fix(workspace): skip workspace globs that can leave the project root (#3574)
• 18d548e chore: resolve the first CodeQL alerts (#3573)
• 86582fc chore: tighten the release process after v3.34.0 (#3572)
• 4c3565e chore: add CodeQL and resolve dependency advisories (#3571)
• cdb8d8b fix(type-aware): carry project-wide evidence in type-coupling reports (#3570)
• 4426826 fix(extract): keep Vue template references when a nested template has a < (#3...
• 38697f8 fix(health): accept a coverage map with a negative hit count (#3568)
• 5ada5d2 fix(oxlint): read .oxlintrc.jsonc and oxlint.config.mts (#3567)
• a25c3c8 feat(scripts): rebase a stacked branch with ship-rebase --upstream (#3559)
• Additional commits viewable in compare view

Updates oxfmt from 0.72.0 to 0.73.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.73.0

💥 BREAKING CHANGES

• 1ef2888 oxfmt: [BREAKING] Improve --migrate prettier (#27444) (leaysgur)
• c2e6d5f formatter_toml: [BREAKING] Add oxc_formatter_toml crate wrapping oxc-toml (#27365) (leaysgur)

🚀 Features

• ce4e8dc oxfmt: Support overrides[].parser -> associations[].language migration (#27475) (leaysgur)
• a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
• 77f8156 oxfmt/lsp: Show root config errors to LSP client (#26014) (Sysix)
• c1adce3 oxfmt/lsp: Support astro language (#27388) (leaysgur)
• 4f024a1 oxfmt: Support astro plugin in --migrate prettier (#27387) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

🐛 Bug Fixes

• 76ec31b formatter_css: Support css-in-js placeholders in property names and conditions (#27640) (leaysgur)
• 99bb268 formatter_css: Keep css-in-js placeholder as media type (#27639) (leaysgur)
• 372849e formatter: Fix crash on css-in-js comment containing interpolation (#27638) (leaysgur)
• da692b8 formatter: Wrap export default class|function consistently (#27628) (leaysgur)
• 21dee96 formatter: Keep parens around TSInstantiationExpression before ! and export (#27626) (leaysgur)
• b6eb914 oxfmt: Normalize symlink targets in CLI snapshots (#27498) (camc314)
• 5dae56f oxfmt/lsp: Return error on config resolving error (#26003) (Sysix)
• 676cc60 formatter/jsdoc: Preserve paragraphs by checking @description tag width (#27439) (leaysgur)
• 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
• db360de oxfmt: Load svelte plugin for svelte-in-mdx-in-md (#27369) (leaysgur)
• 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)
• d730fdd formatter_core: Leave blank frontmatter without dispatcher (#27359) (leaysgur)

📚 Documentation

• 4a28c91 formatter_css: Clarify missed-semicolon-accepted divergence (#27433) (leaysgur)
• 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)
• 37b3c48 formatter_markdown: Fix DIVERGENCES.md examples and slug to match behavior (#27358) (leaysgur)

Changelog

Sourced from oxfmt's changelog.

[0.73.0] - 2026-10-13

🚀 Features

• a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

📚 Documentation

• 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

... (truncated)

Commits

• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• a495e82 feat(oxfmt): support associations config to specify language over filepath ...
• 408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
• 5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
• 902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
• See full diff in compare view

Updates oxlint from 1.87.0 to 1.88.0

Release notes

Sourced from oxlint's releases.

oxlint v1.88.0

💥 BREAKING CHANGES

• 7730e14 ast: [BREAKING] Refactor comment attachment storage (#27512) (camc314)
• c904b61 ast: [BREAKING] Add comment attachment storage (#27393) (camc314)

🚀 Features

• bde9f69 oxlint/lsp: Show config errors to LSP client (#25486) (Sysix)
• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

🐛 Bug Fixes

• 82ecc43 linter/sort-keys: Compare natural order like ESLint (#27579) (Dunqing)
• 598ac03 linter/unicorn/prefer-bigint-literals: Unwrap redundant constructor call; don't auto-fix for lost precision (#25690) (Jacob Bandes-Storch)
• 2512213 linter: Prevent conflicting type import fixes (#27409) (camc314)
• 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
• 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

⚡ Performance

• 91b588c linter/oxc/bad-array-method-on-arguments: Check arguments references once (#26930) (camc314)
• c5f47ed linter/plugins: Inline firstCommentAtOrAfter into call sites (#27539) (overlookmotel)
• c5f9235 linter/plugins: Use shift over multiply for powers of 2 (#27536) (overlookmotel)
• 8c57c5e linter: Share one source per file across type-aware diagnostics (#27462) (Max Schwenk)
• 19c227d minifier: Use ident when checking specific id names (#27208) (Armano)

📚 Documentation

• 98cc2b4 linter/plugins: Improve documentation for firstCommentAtOrAfter (#27538) (overlookmotel)
• 3bb54f6 linter: Update stale comment (#27519) (overlookmotel)
• 848a4e7 linter: Update fix metadata for tsgolint rules that already provide fixes (#27408) (Mikhail Baev)

Changelog

Sourced from oxlint's changelog.

[1.88.0] - 2026-10-13

🚀 Features

• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

... (truncated)

Commits

• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• 3c361a7 feat(linter/unicorn/prefer-query-selector): add allowWithVariables option (...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​oxfmt@​0.72.0 ⏵ 0.73.0			+1	+1
	npm/​oxlint@​1.87.0 ⏵ 1.88.0	+1		+1	+2
	npm/​fallow@​3.33.1 ⏵ 3.34.1	+1	+2

View full report

[codspeed]

Merging this PR will degrade performance by 25.97%

2 warnings, 1 note

⚠️ 8 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

⚠️ Base and head ran on different runner types

Some benchmarks with significant performance changes were compared across different runner types, so the changes might not come from the code. Run base and head on the same runner type, or use CodSpeed Macro Runners for more stable results.

Learn more about Macro Runners

Open the report in CodSpeed to investigate

ℹ️ 15 benchmarks have no flamegraph

The flamegraph wasn't generated: most of the time was spent in runtime internals, which would leave nothing useful to analyze.

See affected benchmarks

⚡ 2 improved benchmarks
❌ 3 regressed benchmarks
✅ 183 untouched benchmarks
⏩ 77 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	real_world_lookup_single[Preact] srcmap WASM buf	61.4 µs	157.2 µs	-60.93%
❌	real_world_lookup_single[Preact] srcmap WASM flat	101.8 µs	197.4 µs	-48.42%
❌	real_world_lookup_single[Preact] source-map-js	570.4 µs	652 µs	-12.51%
⚡	serialize_medium_10k_segments_to_json	2.3 ms	2.1 ms	+13.33%
⚡	lookup_single_original_position_for	1,070.2 ns	961.8 ns	+11.26%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/npm_and_yarn/js-tooling-4bfba8ec85 (479f77c) with main (489c64b)²}

Footnotes

1. 77 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on main (38d6453) during the generation of this report, so 489c64b was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩