chore(deps-dev): bump fallow from 2.89.0 to 2.100.0

[dependabot]

Bumps fallow from 2.89.0 to 2.100.0.

Release notes

Sourced from fallow's releases.

v2.100.0: agent inspect bundles, security verifier workflows, web-format duplicate detection

fallow v2.100.0 bundles new agent and security workflows, broader duplicate detection, framework-aware health, and a batch of accuracy fixes.

Features

fallow inspect for one-shot evidence bundles. A new read-only inspect command composes trace, dead-code, duplication, complexity, and security evidence for a single file or exported symbol into one typed JSON result, without a new analysis pass. It is the CLI and editor equivalent of the MCP inspect_target tool, so an agent can gather context before editing without starting an MCP session:

fallow inspect --file src/api.ts --format json --quiet
fallow inspect --symbol src/api.ts:fetchUser --format json --quiet

Symbol targets add precise trace_export identity plus file-scoped evidence for the analyses that do not yet map to an enclosing symbol. The VS Code inspect command saves dirty files before running.

Security verifier workflows. Two read-only fallow security subcommands close the loop between fallow's candidates and an external verifier:

• fallow security survivors joins raw fallow security --format json candidates with a verdict file, reporting confirmed survivors without rewriting candidate output. It surfaces summary.unverdicted, separates verifier dispositions from unreviewed candidates, and offers --require-verdict-for-each-candidate as a strict complete-verdict CI gate.
• fallow security blind-spots groups unresolved security callees and accepts --file before or after the subcommand.

The unverified-candidate framing (candidates, not proven vulnerabilities) is preserved throughout, and the new contracts are in the schema and generated TypeScript types.

Duplicate detection now covers web formats. fallow dupes tokenizes .css, .scss, .sass, and .less files plus Vue, Svelte, and Astro template and style regions. Section boundaries are respected, so a clone candidate can never be stitched together from script, markup, and style tokens, and same-format namespacing keeps JS, style, and markup regions from forming cross-format clone groups. Warm duplicate-token caches refresh on upgrade.

Framework detector coverage in health JSON. fallow health --format json gains an optional framework_health block listing detected framework ids and per-detector status (active, disabled, abstained, or not-checked) when the run already has the dead-code analysis it needs, so it is visible why a framework-specific finding did or did not surface.

unused-component-prop now covers Svelte 5 $props(). A Svelte prop declared via $props() and read nowhere now reports through the existing rule, with the same output shape, severity, action, and suppression token as Vue and React. It stays conservative, requiring a declared svelte / @sveltejs/kit dependency and abstaining on rest, computed, nested, or whole-object destructures.

Rule packs can ban catalogue-derived effect classes. New banned-effect rules let teams forbid calls whose callee matches an internal security-catalogue effect such as network, storage, shell, crypto, randomness, dom, or database, resolved through the same written and import-resolved callee matching as banned-call. Findings report as policy-violation with scoped suppression via <pack>/<rule-id>.

Bug fixes

• audit --gate new-only no longer flags pre-existing clones as introduced after a line shift. Editing a large file so an unchanged duplicate block moved to new line numbers could fail the gate. Clone attribution now matches inherited clones by content fingerprint independent of line position. Thanks @​dotmaster for the report.
• Local-only value exports report consistently as unused. A value export referenced only by another export in the same file is again treated as unused public surface by default, so dead-code, trace, and stale-suppression detection agree. The fix action still removes only the export modifier.
• fallow dupes --format compact emits traceable clone lines with the code-duplication tag and the stable dup:<id> fingerprint, so agents can jump straight to fallow dupes --trace dup:<id>.

Performance

• SARIF file output streams to disk. Writing SARIF with --output-file / -o (or --sarif-file) streams to the file instead of buffering the whole document, lowering peak memory on large result sets. Output content is unchanged.

Documentation

• MCP server setup now documents project devDependency installs (npx / pnpm exec / yarn / bunx) alongside the global form, fixing an ENOENT startup failure. Thanks @​wouterkroes.
• Refreshed the duplicate-detection benchmark comparison numbers against current upstream releases. Thanks @​kucherenko.

Full Changelog: fallow-rs/fallow@v2.99.0...v2.100.0

v2.99.0: opt-in suppression reasons

This release adds opt-in suppression hygiene and fixes three reported issues across detection accuracy, the editor extension, and catalog support.

Features

... (truncated)

Changelog

Sourced from fallow's changelog.

[2.100.0] - 2026-06-19

Added

• Rule packs can now ban catalogue-derived effect classes. banned-effect rules let teams forbid calls whose callee matches an internal security-catalogue effect such as network, storage, shell, crypto, randomness, dom, or database. The effect is stored on each security_matchers.toml row and resolved through the same written plus import-resolved callee matching used by banned-call, including framework dependency gates. Findings continue to report as policy-violation with scoped suppression via <pack>/<rule-id>. (Closes #1143.)

• fallow dupes now scans authored web-format code outside JS and TS. Duplicate detection now tokenizes .css, .scss, .sass, and .less files, plus Vue and Svelte template and style regions and Astro template and style regions. SFC and Astro regions keep section boundaries, so a clone candidate cannot be formed by stitching script, markup, and style tokens together. Warm duplicate-token caches refresh on upgrade because older caches stored these files as empty or script-only streams.

• unused-component-prop now covers Svelte 5 $props() destructures. Svelte components that declare a prop through $props() and never read it in their script or markup now report through the existing unused-component-prop rule. The finding keeps the same output shape, severity, manual action, and suppression token as Vue and React component-prop findings. It stays conservative by requiring a declared svelte or @sveltejs/kit dependency and abstaining when a $props() destructure contains rest, computed, nested, or whole-object shapes that could hide a use.

• fallow inspect bundles every evidence query for one file or exported symbol. The new read-only inspect command exposes on the CLI (and in the editor) the same evidence bundle the MCP inspect_target tool returns: it composes existing trace, dead-code, duplication, complexity, and security evidence into one typed JSON result without adding a new analyzer pass. Target a file with fallow inspect --file src/foo.ts or a symbol with fallow inspect --symbol src/foo.ts:Foo; symbol targets add precise trace_export identity plus file-scoped evidence for the analyses that do not yet map to an enclosing symbol. The VS Code inspect command saves dirty files before running and consumes the typed output.

• fallow health --format json can now report framework detector coverage. When a health run already has the dead-code analysis output it needs, health JSON gains an optional framework_health block listing the detected framework ids and the scoped status of each framework detector (active, disabled, abstained, or not-checked). This makes it visible why a framework-specific finding did or did not surface in a given run. The block is omitted when the run did not need analysis data, so default health output stays lean.

• fallow security gains verifier-workflow outputs for CI and agents. Two read-only subcommands close the loop between fallow's security candidates and an external verifier. fallow security survivors joins raw fallow security --format json candidates with a verdict file so confirmed survivors are reported without rewriting the candidate output; it surfaces summary.unverdicted, separates verifier dispositions from unreviewed candidates in human output, and offers --require-verdict-for-each-candidate as a strict complete-verdict CI gate (structured exit 2 on an incomplete verdict file). fallow security blind-spots groups unresolved security callees and accepts --file before or after the subcommand. The new output contracts are wired through schema generation and the generated TypeScript types, and the unverified-candidate framing is preserved throughout.

Changed

• SARIF file output now streams to disk. Writing SARIF with --output-file / -o (or --sarif-file) streams the report to the file instead of building the whole document in memory first, lowering peak memory on large result sets. Output content is unchanged.

Fixed

• Local-only value exports now report consistently as unused exports. A value export that is only referenced by another export in the same file is again treated as unused public surface by default, so dead-code, trace, and stale suppression detection agree. The fix action still removes only the export modifier, leaving the local declaration available to same-file consumers. Teams that intentionally export this pattern can keep using @public, ignoreExports, or ignoreExportsUsedInFile.

• fallow dupes avoids cross-format clone groups for web-format tokens. Duplicate token hashes now include the active source namespace, so JS, style, and markup regions do not form clone groups with each other just because their punctuation or identifier shapes match. Large-corpus duplicate detection also prefilters files with no repeated minTokens shingle before suffix-array analysis, and the real-world benchmark watchdog now allows the expanded Next.js combined-analysis surface to complete on CI while streaming progress, preserving diagnostics through a script-local timeout, and avoiding unused full-report serialization.

• fallow dupes --format compact now emits traceable clone lines. Duplication compact output uses the code-duplication issue tag and includes the stable dup:<id> fingerprint plus group, token, line, and instance metadata on each clone instance line, so agents can jump straight to fallow dupes --trace dup:<id> without scraping human output.

• audit --gate new-only no longer reports pre-existing clones as introduced when edits only shift line numbers. Editing a large file in a way that moved an unchanged duplicate block to different line numbers could make the audit gate attribute that inherited clone as newly introduced and fail the gate. Clone attribution now matches inherited clones by their content fingerprint independent of line position, so a line-shift alone keeps the clone inherited. A regression test covers the shifted-duplicate case across platforms. Thanks @​dotmaster for the report. (Closes #1340.)

Documentation

• MCP server setup now covers project devDependency installs. The MCP config snippets previously assumed fallow-mcp was on your PATH (a global install). When fallow is installed as a project devDependency, the binary lives in node_modules/.bin/ and the server fails to start with ENOENT. The MCP integration guide, quickstart, and npm README now show the package-manager runner variants (npx / pnpm exec / yarn / bunx) alongside the global form. Thanks @​wouterkroes for flagging it. (Closes #1343.)

• Refreshed the duplicate-detection benchmark comparison numbers. The README and comparison docs benchmark figures were re-measured against current upstream releases so the published comparison reflects today's numbers. Thanks @​kucherenko for flagging the staleness. (Closes #1316.)

[2.99.0] - 2026-06-18

Added

• A new opt-in require-suppression-reason rule lets teams require a documented reason on every suppression. Suppression comments and @expected-unused JSDoc tags can now carry a trailing -- <reason>, for example // fallow-ignore-next-line unused-export -- public compatibility export or // fallow-ignore-file -- generated route map. The reason text is parsed, cached, and carried through to stale-suppression reporting. With the rule enabled (set rules.require-suppression-reason to warn or error; the default is off, so existing suppressions are unaffected), a suppression that has no reason surfaces as a missing-suppression-reason finding so the team can backfill it. Reported across human, JSON, SARIF, CodeClimate, audit, and baseline output plus the LSP and editors. Thanks @​codingthat for the request. (Closes #1302.)

Fixed

• Nested same-file schema values no longer report as unused when a reachable exported value depends on them. Effect Schema projects commonly pair export const Foo = Schema... with export type Foo = Schema.Schema.Type<typeof Foo>, then compose that value into another exported schema through Schema.Array(Foo). Fallow now walks reachable same-file exported value initializers so the child schema value is credited through the parent schema, while unrelated unused sibling schemas still report. Thanks @​danielo515 for the report. (Closes #1304.)

• The VS Code / VS Codium extension no longer shows inflated totals on startup. On a cold editor start the extension could consume the LSP's first workspace analysis before any document had opened, rendering a stale, too-high issue count until the next edit. Startup analysis now waits for the first opened document, and a save-triggered analysis queues behind an in-flight startup run instead of being dropped. Thanks @​codingthat for the report. (Closes #1303.)

• Catalog rules now read Bun catalogs from root package.json. Bun workspaces that declare catalog entries under workspaces.catalog / workspaces.catalogs (or Bun's accepted top-level catalog / catalogs form) now get the same unresolved-catalog-references, unused-catalog-entries, and empty-catalog-groups coverage as pnpm workspaces with pnpm-workspace.yaml. Fallow still prefers pnpm-workspace.yaml when it exists, preserving existing pnpm behavior. Thanks @​codingthat for the report. (Closes #1301.)

... (truncated)

Commits

• eaeb063 chore: release v2.100.0
• 1779391 test(audit): pin LF in shifted-duplicate test for Windows
• c637b0b fix: make dupes compact output traceable (#1345)
• f916fe3 docs(mcp): cover devDependency install for MCP server setup (#1344)
• f4026a8 test(audit): cover shifted duplicate attribution
• b446f00 fix(unused-exports): report local-only value exports
• 78e2133 fix: tighten security workflow outputs
• b3b936f feat: add catalogue-backed effect policy
• ce9c168 fix(vscode): forward inspect production opt-out
• 88b0c6b fix(ci): skip timed out benchmark projects
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!