chore: bump fallow from 3.5.0 to 3.6.0 in the js-tooling group

[dependabot]

Bumps the js-tooling group with 1 update: fallow.

Updates fallow from 3.5.0 to 3.6.0

Release notes

Sourced from fallow's releases.

v3.6.0: compact JSON by default, reusable audit caches, Windows diagnostics fix

fallow v3.6.0 makes --format json leaner by default, adds first-class cleanup for reusable audit caches, and fixes editor diagnostics on Windows.

Features

Compact JSON by default

fallow --format json now emits compact JSON. Machine consumers get the same schema and values with less output, and JSON success and error documents still end with exactly one line feed. Pass the global --pretty flag when you want indented JSON for manual inspection:

fallow --format json            # compact (default)
fallow --format json --pretty   # indented

Schema commands follow the same compact-by-default behavior. SARIF, Code Climate, saved baselines, snapshots, caches, and other persisted JSON keep their existing presentation. Thanks @​avidianity for the request (Closes #1861).

Root-owned reusable audit caches you can clean safely

Each requested project root now keeps a single base-worktree cache that is rebuilt in place when the resolved base SHA changes, and the reuse lock is held for the audit lifetime so a cleanup or a different-base rebuild can never remove files under a running audit. A new subcommand cleans caches explicitly:

fallow audit-cache remove --root ./my-project --dry-run   # preview
fallow audit-cache remove --root ./my-project --yes       # remove

Temporary source snapshots are private on Unix, predictable sidecars reject symlinks, and Git administration cleanup is restricted to the current repository's verified worktree entry. Thanks @​ryolambert for the contribution (#1893).

Bug fixes

• Windows editor diagnostics render again. LSP paths no longer retain the Windows verbatim path prefix that produced a UriError and prevented diagnostics from rendering. Thanks @​Bro3Simon for the detailed report (Closes #1899).

• Package-less TypeScript project references keep dependency ownership at the parent package. Unused-dependency attribution now credits each imported package to the deepest workspace root that actually declares a package.json, so a tsconfig project reference without its own manifest no longer captures (and then misreports) dependencies that belong to its parent package.

Full Changelog: fallow-rs/fallow@v3.5.1...v3.6.0

v3.5.1: sharper dead-code crediting, license-token hardening

This patch sharpens dead-code crediting for two common architecture patterns, hardens license-token file handling, and speeds up named re-export and workspace bucketing at scale.

Fixes

unused-class-members no longer false-flags interface-typed property dispatch (ports-and-adapters / hexagonal DI). A method reached through a property whose declared type is an interface, on a class that implements that interface, is now credited. Given Deps.greeter: GreeterPort, class GreeterAdapter implements GreeterPort, and a call site useIt(deps: Deps) { deps.greeter.greet() }, fallow now keeps GreeterAdapter.greet. Direct-parameter and variable dispatch already worked; this closes the interface-property hop that dominates hexagonal findings. Genuinely-unused methods still report. Thanks @​lukeramsden for the clean minimal reduction. (Closes #1863)

unused-class-members no longer false-flags a factory that returns an object literal. A factory returning an inferred object literal whose property values are class instances, consumed cross-module as const ui = createUi(); ui.orders.placeOrder(), now credits OrdersPage.placeOrder. Every property-value shape resolves: a direct new Class(), a local const alias, and a member read of a separately-constructed instance (a typed field or a getter). Nested object literals, the assigned-then-returned form, and same-file consumption are all covered. This is the general root cause behind the Playwright page-object-factory pattern; it is not Playwright-specific. Thanks @​committedpazz for the precise bisection. (Closes #1858)

Next.js metadata route config exports are no longer reported as unused. App Router sitemap, robots, manifest, icon, and social image route files now credit the framework-consumed dynamic, revalidate, fetchCache, runtime, preferredRegion, and maxDuration exports. dynamicParams and arbitrary helper exports remain reportable because Next.js does not re-export them from generated metadata route handlers.

Star re-exports no longer make a source module's default export appear used. ECMAScript export * excludes default, so fallow now keeps an unused source default visible unless it is explicitly re-exported.

fallow migrate suggestions use recognized suppression issue kinds. When migrating an ignoreUnresolved entry, the generated warning now suggests the singular unresolved-import token, validated against fallow's own suppression parser.

... (truncated)

Changelog

Sourced from fallow's changelog.

[3.6.0] - 2026-07-15

Changed

• --format json now emits compact JSON by default. Machine consumers get the same schema and values with less output. Use the global --pretty flag when indented JSON is useful for manual inspection. JSON success and error documents still end with exactly one line feed. Schema commands follow the same compact-by-default behavior, while generated schema artifacts remain indented. SARIF, Code Climate, saved baselines, snapshots, caches, and other persisted JSON keep their existing presentation. (Closes #1861)

• Reusable audit base snapshots are root-owned and safe to clean while audits run. Each requested project root now has one base-worktree cache that is rebuilt in place when the full resolved base SHA changes. The reuse lock stays held for the audit lifetime, old SHA-keyed caches remain reclaimable, and fallow audit-cache remove --root <PATH> provides explicit preview and confirmation controls. Temporary source snapshots are private on Unix, predictable sidecars reject symlinks, and Git administration cleanup is restricted to the current repository's verified worktree entry. Thanks @​ryolambert for the contribution (#1893).

Fixed

• Windows editor diagnostics use valid file URIs. LSP paths no longer retain the Windows verbatim path prefix that prevented diagnostics from rendering. (Closes #1899)

• Package-less TypeScript project references keep dependency ownership at the parent package. Unused-dependency attribution now credits each imported package to the deepest workspace root that actually declares a package.json, so a tsconfig project reference without its own manifest no longer captures (and then misreports) dependencies that belong to its parent package.

[3.5.1] - 2026-07-14

Fixed

• Next.js metadata route config exports are no longer reported as unused. App Router sitemap, robots, manifest, icon, and social image route files now credit the framework-consumed dynamic, revalidate, fetchCache, runtime, preferredRegion, and maxDuration exports. dynamicParams and arbitrary helper exports remain reportable because Next.js does not re-export them from generated metadata route handlers.

• fallow migrate suggestions use recognized suppression issue kinds. When migrating an ignoreUnresolved entry, the generated warning now suggests the singular unresolved-import token, and a regression test validates every concrete suppression token in the migration table against fallow's parser.

• Regression baseline help explains the existing config update flow. Running --save-regression-baseline without a path updates regression.baseline in the discovered fallow config, or creates .fallowrc.json when none exists. Supplying a path still writes a standalone baseline file.

• unused-class-members no longer false-flags a method dispatched through an interface-typed property (ports-and-adapters / hexagonal DI). A method reached through a property whose declared type is an interface, on a class that implements that interface (useIt(deps: Deps) { deps.greeter.greet() } where Deps.greeter: GreeterPort and class GreeterAdapter implements GreeterPort), now credits GreeterAdapter.greet. The interface dispatch already worked through a direct parameter or variable (useIt(g: GreeterPort) { g.greet() }); this closes the remaining gap where the receiver is reached via an interface property hop, which dominates hexagonal-architecture findings. A genuinely-unused method on the implementing class still reports. Thanks @​lukeramsden for the clean minimal reduction. (Closes #1863)

... (truncated)

Commits

• 32b3f89 chore: release v3.6.0
• 5795c10 fix(ci): drop flaky pnpm cache from release-validation setup-node
• 4e46717 fix(audit): silence Windows unnecessary_wraps on ownership no-op
• 2fb4b7d test(audit): resolve integration cache paths via production hash
• 502e793 test(audit): mirror production hashing in reusable-cache identity test
• bef4d7d chore(docker): pin FALLOW_VERSION 3.5.1 with refreshed checksums
• 852cc98 chore: remove superpowers workflow artifacts
• a6c74e7 fix: harden analysis and integration contracts
• d261eb3 fix(lsp): normalize Windows diagnostic paths
• 3ab6c16 fix(cli): honor JSON style for schema commands
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codspeed-hq]

Merging this PR will improve performance by 17.02%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 187 untouched benchmarks
⏩ 76 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	lookup_single_original_position_for	601.7 ns	514.2 ns	+17.02%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/npm_and_yarn/js-tooling-d758743505 (ee297cc) with main (5a98d0a)}

Footnotes

1. 76 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩