chore(deps-dev): bump the npm-root group with 4 updates

[dependabot]

Bumps the npm-root group with 4 updates: fallow, jscpd, oxfmt and oxlint.

Updates fallow from 3.6.0 to 3.10.0

Release notes

Sourced from fallow's releases.

v3.10.0: stable type-aware TypeScript analysis

Stable type-aware TypeScript analysis

--type-aware opts into a bounded TypeScript-Go semantic pass that runs after Fallow's normal project analysis. It landed in 3.8.0 as an explicit, repository-only proof; it is now a stable optional contract with a versioned wire protocol and a packaged companion. Default analysis stays fast, syntactic, and independent of Node.js and TypeScript.

npm install --save-dev fallow
npx fallow dead-code --unused-class-members --type-aware

npm installs receive the exact matching fallow-type-aware companion as an optional dependency, so there is nothing else to wire up. See the type-aware analysis guide.

The pass covers five project-wide capabilities:

• exact symbol-use, TypeScript contract, and validated framework-contract decisions for existing dead-code candidates
• symbol traces across namespaces, aliases, and re-export hops
• package API surfaces and cross-file private type leaks
• exact-symbol impact paths and targeted-test suggestions
• advisory public-signature type coupling

Fallow only changes a finding when the checker resolves an exact declaration identity. Name-only matches are never enough, so dynamic computed access, decorators, dependency injection, and runtime registration keep their findings.

Cross-project confirmation

Explicit TypeScript projects are now scanned together, so a use in an application project can confirm a declaration in a referenced library project. String-literal element access is recognized as a use. Explicit solution configs without source files fail closed with per-candidate abstention instead of emitting invalid project metadata.

Checker-backed API and project metadata

Public API analysis no longer treats parameter names or generic type parameters as private types, complete semantic results drop unmatched syntactic leak guesses, and overlapping TypeScript projects no longer duplicate API entries or coupling edges. Per-project candidate, confirmed, unresolved, and abstained counts are populated instead of staying zero, including in the programmatic API.

Unavailable API queries keep their syntactic leak findings, a missing entry point keeps mixed-entry results partial, requests above the private-leak candidate cap retain the unrequested tail and report partial capacity, and

... (truncated)

Changelog

Sourced from fallow's changelog.

[3.10.0] - 2026-07-27

Changed

• Type-aware class-member refinement now covers string-literal element access and cross-project consumers. Explicit TypeScript projects are scanned together, so a use in an application project can confirm a declaration in a referenced library project. Dynamic computed access, decorators, dependency injection, and runtime registration still retain the finding when exact symbol evidence is unavailable. Explicit solution configs without source files now fail closed with per-candidate abstention instead of invalid project metadata. The release corpus enforces pinned clean sources, repeated deterministic output, independent source review, and accuracy, resource, and abstention limits. Corpus evidence is now produced by the exact hashed sidecar artifact recorded during discovery instead of importing workspace implementation modules.

Fixed

• Type-aware API and project metadata now reflect checker-backed facts. Public API analysis no longer treats parameter names or generic type parameters as private types, complete semantic API results remove unmatched syntactic leak guesses, and overlapping TypeScript projects no longer duplicate API entries or coupling edges. Per-project candidate, confirmed, unresolved, and abstained counts are populated instead of remaining zero, including in the programmatic API. Unavailable API queries retain syntactic leak findings, and a missing entry point keeps mixed-entry results partial. Corpus artifacts now record and verify the approved ancestor dependency environment, including its lockfile and installed type-declaration tree, rather than claiming that fixtures resolve with no dependencies. The semantic protocol is now version 6, the first stable type-aware wire contract. A canonical manifest now keeps Rust, the sidecar, corpus tooling, and editor packaging aligned. Pre-stable protocol variants are rejected. Private leak confirmation is request-scoped and bounded, incomplete entry-point coverage retains syntactic candidates, and unexpected checker failures surface as errors instead of being mislabeled as unsupported syntax. Requests above the private-leak candidate cap retain the unrequested tail and report partial capacity instead of failing or pruning it. The Rust semantic client and reconciliation logic now have one owner in fallow-api; CLI, editor, runtime, and programmatic paths share it. Cross-platform child-process lifecycle behavior is shared through fallow-process.

[3.9.1] - 2026-07-24

Added

• fallow impact statusline exposes a compact, read-only Impact summary for agent status lines. It reports the latest whole-project issue count, its trend from the prior full scan, and the number of findings cleared while

... (truncated)

Commits

• 2881013 test: scope process lint expectation to Unix
• 55d72c0 feat(config): add ignoreFindings to hide findings without removing files from...
• d3b7350 fix(deps): credit dependencies referenced by config callbacks and CLI flags
• cca693b test: avoid global sidecar environment mutation
• d73cee9 fix(graph): preserve TypeScript path aliases excluded by ignorePatterns
• 7667b6a test: share type-aware sidecar launcher
• 11bf96c fix: increase standalone icon safe area
• 7f3aee3 fix: normalize type-aware Windows paths
• 1142d22 test: expose type-aware CLI failure output
• c151c4e fix: make type-aware release validation portable
• Additional commits viewable in compare view

Updates jscpd from 5.0.12 to 5.0.14

Release notes

Sourced from jscpd's releases.

Release v5.0.14

New Features

• --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset (javascript,jsx,typescript,tsx). When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped (positions still reference the original source), so function f(a: number): void matches function f(a). Also configurable as crossFormats in .jscpd.json / package.json (string, array-of-strings, or array-of-arrays). Cross-format clones are attributed to one member format in per-format statistics. (#810)

Bug Fixes

• Prose-only Markdown files are now analyzed — the Markdown tokenizer only extracted fenced code blocks, so .md files without code fences produced zero tokens and were silently skipped (-f markdown matched 0 files in Markdown-only projects). Prose is now tokenized too, so duplicated prose is detected as clones, while embedded code fences keep being detected under their own sub-format pools. (#883)

Dependencies

• Bump regex to 1.13.1 in /rust
• Bump globset to 0.4.19 in /rust
• Bump ignore to 0.4.28 in /rust
• Bump xxhash-rust to 0.8.16 in /rust

Published Packages

• cpd-core@0.1.7 on crates.io
• cpd-finder@0.1.9 on crates.io
• cpd-reporter@0.1.7 on crates.io
• cpd-tokenizer@0.1.8 on crates.io
• jscpd@5.0.14 on crates.io
• cpd@5.0.14 on npm
• jscpd-darwin-arm64@5.0.14 on npm
• jscpd-darwin-x64@5.0.14 on npm
• jscpd-linux-x64-gnu@5.0.14 on npm
• jscpd-linux-arm64-gnu@5.0.14 on npm
• jscpd-linux-x64-musl@5.0.14 on npm
• jscpd-windows-x64-msvc@5.0.14 on npm

Not Yet Published

• jscpd@5.0.14 (published: 5.0.12)

Commits

• 2a6a1a4 release: cpd-v5.0.14
• See full diff in compare view

Updates oxfmt from 0.60.0 to 0.61.0

Commits

• 65fe65d release(apps): oxlint v1.76.0 && oxfmt v0.61.0 (#24976)
• See full diff in compare view

Updates oxlint from 1.75.0 to 1.76.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

• 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
• 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
• bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
• 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
• 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
• 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
• ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

• 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
• 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
• 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
• 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
• a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
• ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
• 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
• ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
• e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
• 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
• 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
• fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
• ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
• dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
• 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
• cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

• 25d577e language_server: Start tools in parallel (#15500) (Sysix)
• 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
• 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
• 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
• 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
• 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

• 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
• 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
• a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
• 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
• 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
• 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.76.0] - 2026-07-27

🚀 Features

• 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)
• 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)
• 016cf2a linter/oxc: Add bad-match-all-arg rule (#24900) (camc314)
• cdc941e linter/n: Implement exports-style rule (#24087) (Mikhail Baev)
• 1ad6f6c linter/eslint: Implement id-denylist rule (#24632) (Mikhail Baev)

📚 Documentation

• 3ff2e0e linter: Clarify config extends types (#24936) (Boshen)

Commits

• 65fe65d release(apps): oxlint v1.76.0 && oxfmt v0.61.0 (#24976)
• 3ff2e0e docs(linter): clarify config extends types (#24936)
• 8d31dfa feat(linter): verify eslint/no-restricted-globals config schema (#24598)
• 7069621 feat(linter): verify jest/vitest prefer-lowercase-title config schema (#24724)
• 016cf2a feat(linter/oxc): add bad-match-all-arg rule (#24900)
• cdc941e feat(linter/n): implement exports-style rule (#24087)
• 1ad6f6c feat(linter/eslint): implement id-denylist rule (#24632)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[rlorenzo]

Superseded by #291, which applies these same four updates (fallow 3.10.0, jscpd 5.0.14, oxfmt 0.61.0, oxlint 1.76.0) at identical versions.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml