chore(deps): bump fallow-rs/fallow from 3.14.0 to 3.17.0

[dependabot]

Bumps fallow-rs/fallow from 3.14.0 to 3.17.0.

Release notes

Sourced from fallow-rs/fallow's releases.

v3.17.0: Type-aware CI output and Windows reliability

Type-aware analysis is easier to use in CI, more accurate around ambiguous exports, and more reliable across platforms.

Highlights

• Type-aware results render directly in CI: check and audit now support pr-comment-github, pr-comment-gitlab, review-github, and review-gitlab. fallow report --from <results.json> supports the same formats while preserving audit conclusions, semantic completeness, diff positions, ownership groups, and repository path prefixes. Required incomplete analysis fails closed. Thanks @​Jerc92 for #2272.
• Type-aware analysis starts reliably from npm and VS Code on Windows: the npm launcher uses Node for the companion, the VSIX includes every supported native semantic backend, and native child processes stay hidden without weakening process-tree cleanup. Thanks @​VariableVince for reporting #2284.

Accuracy and reliability

• Ambiguous export * collisions no longer blame contributing source files: Fallow suppresses ambiguity-attributable unused declaration, unused member, unrendered component, and unprovided injection findings. fallow trace exposes the additive star_export_ambiguity field with the contributing origins and namespaces. #2268, #2283
• External generic constraints stay bounded: type-aware public-signature scans avoid expanding complete external structural graphs while preserving project-local constraint edges. Unsupported Svelte virtual-module exports now fail closed with the stable svelte-virtual-module-exports reason instead of claiming complete evidence. Thanks @​cmoyates for the detailed reports behind #2271.
• Action binary verification has a hard deadline: the bundled Action supervises verification from a file, preserves normal exit statuses, and returns status 124 with one focused workflow error on timeout. Thanks @​Jonathangadeaharder for reporting #2273.

Performance

• Duplicate spread calculation, local type extraction, named-export indexing, and JSON root serialization now avoid unnecessary sorting, allocation, and copying. #2266, #2267, #2281, #2282

Compatibility

• Strict machine-readable consumers should update for type-aware wire protocol 7 and semantic schema 3. Every versioned JSON root that can embed this contract has a corresponding schema-version bump. Unversioned trace and inspect roots remain unchanged. Regenerate validators from the current output schema.

Full Changelog: fallow-rs/fallow@v3.16.0...v3.17.0

v3.16.0: honest template scoring, prunable audit cache, visible demotion

Health scoring gets more honest and more configurable in this release: template-family units drop the CRAP dimension they could never earn coverage for, Svelte {#snippet} blocks are scored as their own units, and thresholdOverrides finally reach file scores and refactoring targets. The audit cache becomes observable and prunable, new-only duplication demotion is no longer invisible, and a batch of correctness fixes lands across the type-aware sidecar, manual-mock detection, and the resolver.

Features

• fallow audit-cache prune: the audit cache garbage collector now explains what it does, and a new audit-cache prune subcommand removes stale entries on demand. --dry-run previews the policy without touching disk, --max-age-days overrides the age ceiling (flag, then FALLOW_AUDIT_CACHE_MAX_AGE_DAYS, then audit.cacheMaxAgeDays, then the 30-day default), and the JSON maintenance envelope reports per-entry dispositions with reclaimed_bytes counting only bytes actually removed from disk. Legacy git registrations that are only deregistered report under deregistered and are never counted as reclaimed. RUST_LOG=fallow=debug surfaces per-entry GC decisions during normal audit runs. (#2221)
• Observable duplication demotion: when --gate new-only demotes an introduced clone group to inherited, the decision is now visible. Demoted entries carry demotion_reason (currently no-added-lines), audit-family JSON always includes attribution.duplication_demoted, and --explain prints the demotion decision with the diff source it used. (#2220)
• Svelte {#snippet} blocks are their own complexity units: top-level snippets score as <snippet:NAME> units with nesting rebased to zero, so extracting markup into a snippet moves the score. Snippet units are exact-match keys for health.thresholdOverrides[].functions. (#2227)
• Broader declarative plugin manifests: typed manifest field paths with bounded [*] object-array traversal and exact exists predicates, strict JSON rules that reject JSONC input, and deterministic plugin-check limit diagnostics. Thanks @​M-Hassan-Raza. (#2165)

Health scoring changes

• Template-family units no longer participate in the CRAP dimension: a template carries no direct test coverage, so \<template> and <snippet:NAME> findings gate on the cyclomatic and cognitive dimensions only and never report crap, coverage_pct, or coverage_tier. A maxCrap override scoped to a template unit reports a matched row explaining the entry can be removed. (#2235)
• thresholdOverrides and maxCrap reach file scores and refactoring targets: file scoring and the add_test_coverage target rule now compare CRAP against the effective per-function ceiling instead of a fixed 30. Rows whose breaches were let through by configuration carry crap_exempted and crap_effective_threshold. (#2228)

Bug fixes

• Windows: --gate new-only no longer fails on pre-existing findings: the base-snapshot focus set is built from git rev-parse --show-toplevel, whose spelling can differ from the canonicalized project root (8.3 path components, drive-letter case), so no path mapped into the base worktree and the base dead-code results were filtered away entirely. Every inherited finding then looked introduced and failed the gate. Path matching now compares simplified and canonicalized forms, and a base run whose focus set cannot be expressed leaves its results unfiltered.
• jest/vitest __mocks__ parity: vitest root-level __mocks__ manual mocks for node modules are no longer reported as unused files, and literal X/__mocks__ imports and the /__mocks__ virtual package suffix now follow each framework's actual semantics. (#2225, #2226)
• Type-aware sidecar and root typescript stay in lockstep: the root lockfile pins the same typescript the sidecar needs, and a new preflight exits with a message naming the resolved version, its path, and the install command when the resolvable install is missing or too old, instead of a bare module-resolution error. (#2236)
• No wasted sidecar work when private-type-leaks is off: the type-aware layer only requests the api-surface capability when the check is active, pinned by an end-to-end config test in both directions. (#2218, #2219)
• MCP audit tool description matches the payload: the description now documents the nested complexity block that audit JSON actually carries. (#2217)
• Effective barrel exports resolve through one binding model: explicit-over-star precedence, ambiguous star origins vs convergent diamonds, separate type and value namespaces, and canonical binding identity now hold through usage propagation, public exports, duplicate analysis, trace provenance, caches, and the type-aware sidecar. Thanks @​M-Hassan-Raza. (#2210)
• Package tooling stays out of production reachability: build and tooling scripts no longer make devDependencies look like production dependencies. Thanks @​Jerc92. (#2211)
• Partial GitLab review posts now warn: inline-review jobs surface a warning when posting only partially succeeds instead of reporting clean success. Thanks @​Jerc92. (#2209)
• Scoped-package manual mocks: factory-less jest.mock/vi.mock of a scoped package no longer fabricates an unused-file candidate. (#2213)

... (truncated)

Commits

• ecf5a31 fix(release): install Windows platform candidate
• e08e3e0 chore: release v3.17.0
• 7e8519b fix: start type-aware reliably on Windows
• 78632bb feat(ci): render type-aware feedback from saved results
• 8437d52 fix: close analysis and audit follow-ups
• 4084184 perf(extract): deduplicate local type declarations once
• 7a84424 perf(types): bucket clone spread locations
• e6a86ac fix(action): bound installed binary verification
• f66e6e8 ci(benchmarks): add round five walltime suites
• 6ab2c84 fix(type-aware): bound generic scans and identify Svelte host gaps
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)