[dependabot]

Bumps fallow from 2.75.0 to 3.34.0.

Release notes

Sourced from fallow's releases.

v3.34.0: fallow mutation, segment-safe config globs, audit sub-analysis selection

Changed

• A single * in a config path glob now stays within one path segment. Only ** crosses directories. Before, src/plugins/*/index.js in entry also matched src/plugins/alpha/components/button/index.js. Each nested match became an entry point, so fallow did not report it as an unused file. The rule first applied to entry and dynamicallyLoaded (#3513, closes #3490). It now applies to every config path glob (#3541):

  • ignorePatterns, ignoreFindings, overrides[].files, ignoreExports[].file and ignoreCatalogReferences[].consumer,
  • duplicates.ignore, similarCode.ignore, health.ignore and health.thresholdOverrides[].files,
  • the boundaries zone and coverage globs, and the rule-pack file globs,
  • the framework[] fields usedExports[].pattern, manifestEntries[].manifests and detection.pattern.

  To keep the old match, change the single * to **. For example, change src/generated/* to src/generated/**, and *.test.ts to **/*.test.ts. For each pattern that now matches fewer files, fallow prints a warning on stderr. The warning names the config field, the pattern, the count of files that only the old rule matched, and the rewrite. --quiet hides the warning, and the JSON output does not change. A narrower glob can show new findings. Fallow matches a glob against each file path, not against each directory. Thus a line that you copy from .gitignore can match fewer files in ignorePatterns. Globs that match package names or import specifiers, such as ignoreDependencies and ignoreUnresolvedImports, do not change. Thanks @​jleifeld for the report.

• An existing prop-drilling: "error" setting now enforces CI. To report chains without an error, change the rule to warn. Archived JSON reports with effective_severity: "error" also render as errors. A config change does not rewrite those reports.

• Storybook, Vitest, Rstest, Jasmine and Playwright globs now accept every extglob group. One shared rewrite reads @(..), ?(..), +(..), *(..) and !(..) for these plugins and for import.meta.glob.

  • Storybook: before, only @(..) matched. Now ../src/**/!(*.dev).stories.@(js|ts) matches, and !(*.dev) excludes the files that match *.dev.
  • Playwright: before, a testMatch glob with a group made every script below testDir an entry point. Now only the matched files are entry points.
  • Vitest: before, a test.include glob with any group made no file an entry point. So fallow reported every test file as unused. A plain (a|b) group still matches one alternative.
  • Vitest, Rstest and Jasmine: !(..) and *(..) now match.
  • A +(..) group in an include glob now matches one or more repetitions. Before, Vitest, Rstest and Jasmine matched the group once only. The rewrite can also make a few more files entry points, for example a.test.jsx and a.test.tsx for *.test.+(ts|js). An exclude glob still matches the group once only.

• Complexity findings name more callback bodies. A function that got <anonymous> or <arrow> now takes a name from the code around it. Effect.fn("Users.create")(function* ...) gives Users.create, and it("renders", () => ...) gives it("renders"). A generator that a named function returns gives that name, for example load for const load = () => Effect.gen(function* ...). Scores and existing names do not change. A renamed finding gets a new CodeClimate fingerprint one time. An identity baseline gives the allowance of an <anonymous> or <arrow> bucket to the new names in the same file. A file move no longer moves an <arrow> bucket.

• Runs are faster in five places.

  • Plugin detection no longer walks node_modules for a Vitest, Jest or Rstest project glob. Since 3.33.1, a test.projects glob such as apps/**/vitest.config.ts read the full dependency store of a pnpm monorepo once per workspace. Plugin detection then took minutes. The walk now skips node_modules, .git, gitignored paths and symlinks that point out of the project root. Thanks @​wouterkroes for the report (closes #3532).
  • Import resolution is fast again in monorepos whose packages extend a root tsconfig that references them. Since 3.20.0, each source file checked about 760 configs in place of about 30. On a monorepo with 28 references and 4,200 modules, resolve imports takes 0.5 s in place of 10.1 s, with the same findings. Thanks @​thymikee for the report and for the patch in #3504 (closes #3503).
  • A run with a restored CI cache no longer rewrites every cache entry. An entry whose content did not change gets only its new timestamps. On a large monorepo, such a run is about a fifth faster. The dead-code run also frees its parsed modules on a helper thread.
  • An import through a barrel that does export * of many packages is now checked only against the packages that export its name. Findings do not change.
  • Each glob compile is about three times cheaper. A dead-code run takes about 5 to 7 percent fewer instructions on a mid-size project, and the binary is smaller.

• The build uses one oxc version. oxc_coverage_instrument moves to 0.14, which uses oxc 0.152 like the rest of fallow. cargo deny now fails when two versions of the core oxc crates enter the dependency graph.

• The MCP audit tool has a fallow://tools/audit guide. The guide names the five diff-risk rules and holds the styling, coverage, baseline, grouping, runtime-coverage and FALLOW_DIFF_FILE detail. The tool description is now a short summary that points to the guide (#3369).

• The guidance for workspace dependency declarations is clearer. Root imports of npm workspace packages need a dependency declaration, although npm links resolve them. The guidance covers private and tooling ancestor exceptions, self-references and explicit opt-outs. The policy does not change. Thanks @​VariableVince for the question (closes #3325).

Features

• fallow mutation measures how well the tests detect code changes. The command makes small changes (mutants) in the changed code and runs the project tests against each one. A mutant that no test fails on survives. The report gives the mutation score over the tested mutants and the survivors by file with their covering tests. It also gives the share of mutants that a test reaches.
  • The default scope is the changed code against the base ref, as for audit. --all and file paths widen or narrow it.
  • --plan selects and ranks the mutants and runs no code. fallow mutation inspect <mutant_id> shows one mutant against the current file. It reads the report of the last run, or the file that --report names. A changed file gives a stale status.
  • The runner is Vitest (>=4.1.0 <6.0.0), node:test of Node.js 22.18 or later, or bun test (>=1.4.0 <2.0.0). The default mutation.runner: auto detects it. An unsupported version exits with code 2 and FALLOW_MUTATION_RUNNER_UNSUPPORTED (#3407).
  • The node:test runner takes the module loading flags of the node --test command in the project scripts, such as --experimental-transform-types and --import (#3487). A borp script is a node:test run, and its globs give the test entry points (#3482).
  • Vue, Svelte and Astro components get mutants in their script blocks. Code that the framework compiler moves out of its block gives no mutant, for example the arguments of defineProps. An expression that holds a Svelte rune call gets no mutant, but the arguments of a rune still get mutants. With node:test and bun test, the plan leaves component files out with the skip reason runner-cannot-load (#3470).
  • The plan prunes the mutants in the default export of a tool config file, such as vite.config.ts, with the reason framework-config (#3483). A mutant inside a function of the config stays.
  • The regex-literal operator removes a ^ or $ anchor, negates a character class, or swaps the case of \d, \w or \s.
  • A run refuses a dirty git worktree unless --allow-dirty is set. The plan prunes mutants near file system, process, network or database calls unless --allow-side-effects is set. Fallow does not write to project files, and the report lists any path that the tests changed. -o <file> writes the report after the run, and the worktree check leaves that file out.
  • With --max-mutants, the coverage counts the planned mutants that did not run. The dry run decides their coverage. A capped run therefore reports the coverage of the full run.
  • The exit code is 0 by default. --min-score or mutation.minScore makes a lower score exit with 1. --verdicts <file> marks equivalent mutants, which leave the score.
  • A survived or timed-out mutant runs once more, so host load alone does not count as detection. A changed result is flaky and leaves the score. retried: true marks a status from both runs.
  • A type test (*.test-d.ts, *.spec-d.ts, or a TypeScript file below test-d/) is not a test file of the plan.
  • --typecheck or mutation.typecheck type-checks each survivor through the --type-aware companion. A survivor that adds a type error gets compile_error and leaves the score. Without a companion, the run exits with 2 before the tests start. A Vue, Svelte or Astro survivor stays survived with the skip reason unsupported-file (#3471).
  • Each no_coverage mutant has a test_reach object with the class mocked-only, none, none-file, transitive or direct.
  • A run reuses the killed and survived results of an earlier run from the fallow cache. The key covers the mutant, its covering tests and their imports, the runner setup and config, the lockfile, and the tsconfig.json extends chain. Dynamic imports that the module graph does not resolve, and files that a test reads, are not in the key. --no-cache runs each mutant.
  • fallow health --mutation-report <file> adds the mutation score of each complexity finding next to its CRAP score. The score never changes CRAP or the health score.
  • The new mutation config section sets the runner, the operators, the minimum score and the concurrency. --setup-timeout sets how long each runner process can take to start, finish its dry run or reload (default 2m).
• fallow audit takes --only and --skip. The values are the same as for bare fallow: dead-code, architecture, dupes and health. The config keys audit.deadCode, audit.health and audit.dupes set the default selection. A skipped sub-analysis is skipped on the head and on the base, so it leaves the verdict, summary and attribution. A warn-only gate for complexity and duplication is now fallow audit --skip dead-code with the complexity rules at warn.
  • The JSON report omits the block of a skipped sub-analysis and sets summary.dead_code_skipped, complexity_skipped or duplication_skipped.

... (truncated)

Commits

• 2823b65 chore: release v3.34.0
• 1127834 chore: release v3.34.0
• e6c7aa7 perf(plugins): do not walk node_modules for a test project glob (#3560)
• 647aac2 fix(graph): resolve dynamic import patterns that start with ../ (#3558)
• f7f3d1e fix(nuxt): credit plugins, middleware and modules one level deep (#3557)
• 010676c fix(mutation): check the run path before a zero-test error counts as a kill (...
• e5b5043 fix(mutation): require Bun 1.4.0 and test the runner floors in CI (#3554)
• 75c0c60 fix(plugins): keep test runner project configs inside the project root (#3556)
• 85e79dd docs(ship): watch the newest run when the main wait times out (#3552)
• 133d4c8 test(fuzz): fuzz untrusted-input parsers and fix dot-wildcard glob escape (#3...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.