Update github actions - #669

v1.4.2: Bun v1.4.2

Compare Source

To install Bun v1.4.2

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.2:

bun upgrade

Read Bun v1.4.2's release notes on Bun's blog

Thanks to 3 contributors!

• @​dylan-conway
• @​jarred-sumner
• @​robobun

v1.4.1

Compare Source

v3.23.0: : a readiness check, and reports that survive a moved checkout

Compare Source

An empty Fallow report has always been ambiguous. It can mean the project is clean, or it can mean Fallow never resolved your config and analyzed almost nothing, and until now the output looked the same either way.

A readiness command

fallow doctor settles it before you run anything. The command checks the project root, which config actually resolved, whether workspace discovery found what you expect, whether external plugins load, and whether the optional type-aware companion is available. Every check is a local read, so nothing is analyzed and nothing is written.

npx fallow doctor
npx fallow doctor --format json

Fallow doctor (.)
[OK] root: Project root is an accessible directory.
[OK] config: Configuration resolved from .fallowrc.json.
[OK] workspaces: Workspace discovery completed (30 workspace packages).
[OK] plugins: No external plugins are configured; built-in detection remains available.
[-] type-aware: Type-aware analysis is not enabled.
Status: ready

A failed required check exits 2. There is no exit 1, because that code means error-severity findings and doctor looks at your setup, not your code. For agents, --format json --quiet gives you a status to branch on and a checks[].message per check to report back.

Reports that stay put when the checkout moves

Duplication groups that share a full content hash used to take an ordinal derived from absolute-path digests. Move an unchanged checkout to a different directory and the same handle could land on a different group. Those groups now use report-scoped dup:<16hex>-rN handles ordered by canonical fragment, location, and metric. Health complexity ties break on project-relative path, line, column, and function name, so --top selects the same finding wherever the repository lives.

If you suppress duplication findings, read this before upgrading. Legacy numeric collision handles (dup:<16hex>-N) are still valid syntax and are deliberately not aliases for the corrected ones. An old collision suppression or baseline key will resurface its finding for review, rather than match some other group without telling you. Regenerate the report, look at the group, then refresh its ignoredClones key or baseline. Update every installation before you store -rN keys, since older versions reject that syntax; minimumVersion pins the released version a shared config needs.

Ordinary dup:<8hex> and widened dup:<16hex> handles are unaffected, which is most of them.

Detection accuracy

Four people filed four bugs this cycle, and all four are fixed here.

A class member reached through an object container or an object alias, rather than directly on the instance, was never followed (#​2546, thanks @​Ericlm). Binaries invoked through varlock run -- <bin> lost their argument boundaries in package-script parsing (#​2551, reported and fixed by @​PrinceD96 in #​2552). fallow-ignore-next-line unused-catalog-entry was suggested by the finding and then did nothing, because quoted YAML scalar content was dropped in catalog parsing (#​2548, thanks @​michalius). Scoped package names rendered as empty strings in review --brief (#​2553, thanks @​Elia97).

Oxlint configs that declare jsPlugins now count those as referenced dependencies, so Ultracite-style setups stop reporting their lint plugins as unused.

Editors and CI

Zed reaches the parity its extension API allows. Exact diagnostic codes go in initialization_options.mutedCategories, where a team can commit them alongside the project. Inline complexity Code Lens is opt-in through health.inlineComplexity, and advisory security candidate diagnostics turn on through your project rules like anywhere else. The Zed guide separates those LSP features from full fallow health and fallow security CLI runs, and says plainly that the current extension API offers no contribution point for a Fallow-owned sidebar or status-bar item.

Inline review comments now carry clone evidence: the stable dup: handle with line and instance counts, plus each peer copy as a repository-relative range, so a reviewer can open the other copies from the comment (thanks @​Jerc92 for #​2550).

The VS Code integration frames LSP messages by bytes, which fixes stream desynchronization on workspace paths containing non-ASCII characters.

For agents

Every MCP tool parameter now carries a description taken from the CLI help, so a tool reads the same way in an agent as it does in a terminal. guard now spells out its own contract. It reads config and runs no analysis, and a path matching no configured zone comes back as an empty rule set instead of an error. The server instructions point at tools/list and the resources instead of listing every tool inline, which keeps them from drifting each time the roster changes.

The agent instruction surface got a prompt audit. Numbers that had rotted were deleted rather than refreshed, since a refreshed number rots again next release, and the CLI reference now names fallow dead-code in the three places it still used the legacy check alias.

Install

npx fallow@3.23.0 doctor

Full Changelog: fallow-rs/fallow@v3.22.0...v3.23.0

v6.1.0

Compare Source

What's Changed

• feat: support pnpm v12 by @​zkochan in #​288

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0