chore: bump the js-tooling group with 3 updates

[dependabot]

Bumps the js-tooling group with 3 updates: fallow, oxfmt and oxlint.

Updates fallow from 3.11.0 to 3.14.0

Release notes

Sourced from fallow's releases.

v3.14.0: doMock-aware coverage, faster discovery and alias propagation

Mock-aware coverage learns doMock, workspace discovery and alias propagation got faster, and type-aware status tells the truth about how it found the sidecar.

Features

vi.doMock and jest.doMock join the mock-aware coverage model. They never mask test reachability (they are unhoisted and order-sensitive, so masking could produce false uncovered findings), but static path-shaped targets and their __mocks__ manual-mock siblings now receive credit edges on every proven receiver shape, and doUnmock cannot clear a sound hoisted mask. Automock (vi.mock without a factory) keeps coverage credit by pinned, documented decision. The --coverage-gaps docs now spell out the full mock-aware semantics, including what abstains.

Performance

• Workspace discovery: a per-discovery manifest cache stops members reached via multiple workspace sources from being re-read and re-parsed, and Deno config probing collapses to a single filesystem probe per directory. Discovery and diagnostics benchmarks improved 7 to 12 percent with identical behavior.
• Alias propagation: cross-package namespace alias propagation dropped its per-consumer string formatting and redundant clones, recovering the earlier regression and landing faster than the pre-regression baseline.

Fixes

• type-aware status reports truthful discovery sources. Fallow's own launchers now mark self-injected wiring, so status distinguishes npm-wrapper and github-action from a genuinely user-set environment-override, and wrapper-wired discovery failures get the right remediation.
• maxUnitSize semantics are now unambiguous. The schema and docs state explicitly that the four max* health thresholds govern which findings are listed and never move health_score, whose bins keep their fixed cross-project calibration; a regression test locks the score as byte-identical when thresholds change. Thanks @​DeLuke84 for the report that exposed the ambiguity.
• The flaky Windows process-tree lifecycle tests were hardened with deadline polling, serialized execution, and slow-runner headroom.

Full Changelog: fallow-rs/fallow@v3.13.0...v3.14.0

v3.13.0: Action-provisioned type-aware sidecar, flag-proof agent gate

The GitHub Action now provisions the type-aware sidecar itself, and the agent gate stops being fooled by git-level flags.

Features

The Action wires type-aware analysis end to end. A new tri-state type-aware input defaults to auto, which reads your project config: when typeAware.enabled is on (and audit.typeAware does not override it), the Action installs fallow-type-aware at exactly the CLI version it resolved, verifies the version match fail-closed, and exports FALLOW_TYPE_AWARE_BIN. Set true to force provisioning or false to skip it and run fully syntactic. Until now the Action installed only the standalone binary, so typeAware-enabled projects needed manual sidecar wiring in CI.

Bug fixes

The agent gate recognizes git -c … commit and friends. The gate installed by fallow hooks install --target agent only audited git commit / git push when the subcommand immediately followed git, so ordinary forms like git -c user.name=x commit, git --no-pager commit, or git -C dir push silently skipped the audit. Command recognition now tokenizes and steps over git-level options (including value-taking ones like -c, -C, --git-dir) while still ignoring lookalikes such as git log commit-message.txt or git stash push. A new FALLOW_GATE_DEBUG environment variable surfaces skip decisions on stderr for troubleshooting. Thanks @​wouterkroes for the meticulously reproduced report, the payload-based test approach went straight into the test suite.

Full Changelog: fallow-rs/fallow@v3.12.0...v3.13.0

v3.12.0: type-aware audit enablement, rename-aware gating, sturdier baselines

Type-aware analysis and audit --gate new-only now work together out of the box, audits survive git mv, and health baselines got sturdier.

Type-aware + audit, fixed end to end

Three reports converged on the same enablement wall, and all three are gone:

• One config is enough. With typeAware.enabled in .fallowrc, audit --gate new-only no longer exits 2 when base and head semantic identities differ: attribution falls back to identity-independent syntactic sets with a clear warning, semantic-only findings demote to advisory, and a genuinely new finding still fails the gate. A global --no-type-aware flag and an audit.typeAware config field give you an explicit syntactic escape hatch, and macOS /var vs /private/var temp paths no longer abort the run. Thanks @​hckhanh for the detailed enablement-DX report.
• Adding a file no longer degrades the gate. Identity comparison now uses the compatibility rules the identity type was designed with instead of raw equality, and the sidecar's project hash no longer includes the root file listing, so the everyday "this PR adds a new .ts file" diff compares cleanly. Thanks @​lightsound for the precise source-level analysis.
• The npm sidecar wiring is repaired. fallow@3.11.0 pinned fallow-type-aware to the previous version while the launcher requires an exact match, so the sidecar never wired and type-aware hard-failed on npm installs. Both the manifest and the release pipeline now bump the pin in lockstep. Thanks @​lightsound for the report and the bun workaround notes.

Audit survives renames

git mv no longer turns audit --gate new-only red: base findings relocate onto post-rename paths via git rename detection across dead code, complexity, duplication, styling, and cycles, so pure renames attribute as inherited while a rename with edits still gates genuinely new debt. Validated on a real multi-directory rename that previously reported 21 introduced findings and now reports zero. Thanks @​YoniChechik for the excellent report with the minimal repro.

Health and analysis improvements

... (truncated)

Commits

• 3cf8074 chore: release v3.14.0
• 5de19d4 test(process): harden the Unix process-tree registry test against slow runners
• b6f6adc fix(mcp): satisfy redundant_pub_crate on the Windows test lock
• 6e80883 feat(health): credit doMock targets and pin the automock coverage decision (#...
• e054def test(mcp): harden the Windows process-tree lifecycle tests against slow runne...
• b7d1d43 docs(health): state that max thresholds govern findings, never the score (#2118)
• d00354b fix(api): report truthful type-aware discovery sources (#2113)
• 4bc061f perf(config): cache manifest probes during workspace discovery (#2115)
• 85eaa3b perf(graph): cut allocations in cross-package alias propagation (#2114)
• a99fb67 fix(vscode): override brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895
• Additional commits viewable in compare view

Updates oxfmt from 0.61.0 to 0.62.0

Changelog

Sourced from oxfmt's changelog.

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

• 43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

• 6e8e818 oxfmt: Experimental .svelte support (#21700) (leaysgur)

[0.45.0] - 2026-04-13

🐛 Bug Fixes

• 50c389b oxfmt: Support .editorconfig quote_type (#20989) (leaysgur)

[0.44.0] - 2026-04-06

... (truncated)

Commits

• 9a423f2 release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (#25251)
• e6e584b fix(oxfmt): type jsdoc. enum options (#25008)
• See full diff in compare view

Updates oxlint from 1.76.0 to 1.77.0

Changelog

Sourced from oxlint's changelog.

[1.77.0] - 2026-08-03

🐛 Bug Fixes

• 5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

• 9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

Commits

• 9a423f2 release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (#25251)
• 5c0fa61 fix(linter/eslint/no-warning-comments): unify config structs and remove manua...
• 9dc7756 docs(linter/typescript/no-unnecessary-condition): clarify options (#25110)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codspeed-hq]

Merging this PR will not alter performance

✅ 188 untouched benchmarks
⏩ 76 skipped benchmarks¹

---

_{Comparing dependabot/npm_and_yarn/js-tooling-e7fc763f9e (985d3f9) with main (b5e41f4)}

Footnotes

1. 76 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩