fallow

Fallow 3.40.0 adds checks for unused namespace members, duplicate export aliases and missing command-line tools, plus workspace-specific settings and targeted mutation analysis.

New analysis and configuration

• unused-namespace-members, duplicate-export-aliases and unlisted-binaries report through the CLI and integrations. These rules default to warnings. With --fail-on-issues, new warnings can fail CI. Disable a rule in top-level rules to retain the previous result.
• ignoreBinaries excludes intentional external commands. workspaces.settings configures dependency exclusions and entry exports per workspace. supportEntry separates development entry points from production analysis. Migration preserves these settings.
• Security analysis recognizes more command, template, network, file and deserialization sinks within existing categories, also when a destructured require() binds the sink.
• mutation --kill-matrix-for checks named tests for redundant mutant kills without running a full kill matrix. Vitest mutation runs now forward the active mutant to Node child processes. Audit counts @effect/vitest tests.

Runtime context and integrations

• Inventory uploads with --with-callers include the entry routes that can reach each function.
• coverage analyze --cloud retains error and performance context. inspect --file --cloud retains browser and caller context. These fields do not change verdicts.
• The MCP server routes Rust workspaces to cargo-fallow. Packaged skill guidance also documents the hosted Fallow Cloud MCP server.
• VS Code keeps sidebar groups expanded after refresh and updates its language client.

Correctness and maintenance

Dead-code analysis fixes false positives involving inherited method results, inline import types, calls with arguments and re-exported schemas. Resolution fixes cover URL-loaded modules, package assets, build-output imports and workspace folder dependencies. Configuration fixes cover project wrappers and framework aliases. Dependency checks recognize config-required packages. Migration handles namespace issue types, and declaration merges avoid duplicate-export findings.

fallow doctor uses the project's package manager for dependency-install commands. Packaged skill guidance now starts with this readiness check.

Graph caches invalidate after dependency installs and after Yarn Plug'n'Play changes. Audit comments explain attribution and gate effects. Initial analysis rebuilds caches after this upgrade. Contributors can set up a checkout with pnpm bootstrap. Shared report types retain their JSON shape. This release also updates dependencies.

Thanks @Smrtnyk for the reports and @cr101 for the targeted mutation-analysis proposal.

https://github.com/fallow-rs/fallow/compare/v3.39.0...v3.40.0

Features

• banned-import rules accept allowNames. A rule can ban a package and keep some of its exports, for example { "kind": "banned-import", "specifiers": ["three"], "allowNames": ["Vector3", "Quaternion"] }. Each entry is an exact imported name, and default allows a default import. A namespace import, a star re-export and a side-effect import always report. A finding of such a rule has matched set to <specifier>: <binding>, for example three: Mesh. Adding allowNames changes the baseline keys and finding ids of that rule, so re-save the baseline in the same commit. Thanks @Smrtnyk for the report. (#4072)

• An explicit flag now says when its rule is off in config. Before, fallow dead-code --unused-deps with unused-dependencies at off printed No issues found. Now fallow prints a note on stderr that the flag did not check the rule. JSON gets the new workspace_diagnostics kind requested-rule-off, with rule and flag. SARIF, Markdown, MCP, the GitHub Action and the GitLab template also show the note. The exit code does not change, so set the rule to "error" to fail on a finding. Thanks @Smrtnyk for the report. (#4067)

• The MCP tool inspect_target returns the cloud section and the compact text. Set cloud: true on a file target to run the same path as fallow inspect --file <path> --cloud. The CLI reads the key from FALLOW_API_KEY in the server environment, then the keychain, then the credentials file. The key is never a tool parameter. A status other than ok does not fail the call. Set format: "compact" to get the plain text of fallow inspect --format compact instead of the JSON bundle. (#4001)

• fallow security reports more sinks. These shapes are now candidates when the value is not a literal:

  • iframe srcdoc as dangerous-html, through assignment, setAttribute, JSX srcDoc, Vue :srcdoc, Svelte srcdoc and Angular [srcdoc];
  • an assignment to src, text, textContent or innerText on a local bound to document.createElement("script") as code-injection, with the callee HTMLScriptElement.<property>. The same property on another element stays quiet;
  • a non-literal argument to Range.createContextualFragment() as dangerous-html.

• The review brief reports security sink substitution. A change that removes a security sink and adds a different sink of the same class in the same file gives a security-check-removed signal. The signal appears in weakening[] of fallow audit --brief and fallow review. The classes are code execution, such as new Function and vm.runInNewContext, and HTML, such as innerHTML and dangerouslySetInnerHTML. A sink that only moves in the file, or goes away, gives no signal. Test files do not take part.

• A graphql-config plugin keeps GraphQL schema and operation files used. The plugin reads the schema and documents globs of graphql.config.*, .graphqlrc, .graphqlrc.* or the graphql key in package.json. It marks the matching .graphql, .gql and .graphqls files as used, and the config file too. A glob is relative to the directory of the config file. A URL, a negated glob, and a glob for source files get no credit.

• fallow audit shows the reason of an added fallow-ignore comment. An added-suppression finding now has a suppression object with kinds, reason and security_without_reason. Write the reason after --, for example // fallow-ignore-next-line security-sink -- the HTML is a constant template. When the comment hides security-sink or security-client-server-leak without a reason, security_without_reason is true. The signal does not change the severity, the verdict or the exit code. To find existing security suppressions without a reason, run fallow suppressions --format json and select reason_present: false.

• effect.schemaExportsAsTypes reports unused Effect schemas as unused types. With `{ "effect": { "schemaExportsAsTypes":

Changed

• fallow audit scans the temp dir for old base-snapshot caches at most once per hour. Before, each audit scanned every fallow-audit-base-cache-* entry in the temp dir. Entries of deleted repos stay until they age out, so a long-lived CI runner or developer machine can collect tens of thousands of them. With 59,000 entries, one audit of a small project took about 2.5 s instead of 0.3 s. Now the first audit in each hour scans the temp dir. The other audits sweep only the cache of their own project root. Old entries of other repos are reclaimed at most one hour later. fallow audit-cache prune still scans every entry on each run, and its output does not change. (#4020)

Bug fixes

• The audit cache sweep removes the .lock file of a cache that it reclaims (Unix). The sweep used to keep these .lock files for ever. They grew without limit, and one host had more than 15,000 of them. Every full sweep and every fallow audit-cache prune read each one. fallow audit-cache prune --format json reports a bare lock file that it removes. The report gives the new reason orphaned-lock. Windows keeps the .lock file and reports lock-only as before. (#4021)
• The VS Code extension is on the VS Code Marketplace and Open VSX again. The 3.38.0 release did not publish it, so the marketplaces still offered 3.37.0. This release publishes 3.38.1. (#4025)
• The VS Code extension bundles minimatch 11.0.3. The language client requested minimatch 10, which has a denial of service through glob pattern amplification (GHSA-g3hv-75wg-m249). The extension only matches globs that the fallow language server sends. (#4031)
• The output schema names fallow dead-code --impact-closure for affected_not_shown. The field description in the audit brief, in docs/output-schema.json and in the output contract types named fallow check --impact-closure, a command that does not exist. (#4028)

Full Changelog: https://github.com/fallow-rs/fallow/compare/v3.38.0...v3.38.1

Features

• fallow health can report files that are too long. Set health.maxFileLines or pass --max-file-lines <N>. Fallow then reports each file with more physical lines than the limit, blank and comment lines included. The default is 0, so the check is off. The new complexity-file-lines rule (default error) decides if a long file fails the run. SARIF and CodeClimate use the rule id fallow/long-file. thresholdOverrides[].maxFileLines sets a different limit for some files. In fallow audit, an existing long file stays inherited until it grows by 5 lines or more. Set the limit in an old project to stop further growth. The MCP check_health and Code Mode combined tools and the Node bindings accept the limit. The GitHub Action has a max-file-lines input, the GitLab template has FALLOW_MAX_FILE_LINES, and the VS Code Health view shows long files. (#3977)

• fallow coverage setup --cloud plans a Fallow Cloud setup in one command. Fallow Cloud joins runtime coverage to the static inventory only when every step uses the same commit SHA. The plan gives beacon snippets that read the SHA from an environment variable, such as VERCEL_GIT_COMMIT_SHA or VITE_FALLOW_COMMIT_SHA. It also gives GitHub Actions steps in cloud.ci.steps: a full-history checkout, the inventory upload, the source-map uploads and the deployment registration for $GITHUB_SHA. The plan names the key variables and never a key value. It writes no file. --json adds a cloud object. --wait polls Fallow Cloud until every step is done. It exits 0 on success, 1 on a timeout and 2 on an authentication, key scope or input error. (#3976)

• fallow cloud login stores a read-only Fallow Cloud key without copy and paste. The command shows a code and a URL. After an organization owner approves the code, fallow stores the key in the OS keychain. With no keychain, fallow stores it in ~/.config/fallow/credentials with mode 0600. fallow cloud logout removes the key. Commands that read production data, and the MCP cloud tools, search for a key in this order: --api-key, $FALLOW_API_KEY, the keychain, the credentials file. Upload commands still read only --api-key and $FALLOW_API_KEY, because the stored key is read-only. (#4000)

• fallow inspect --file <path> --cloud shows production data for each function in a file. For each function you get its state in the deployment, its state over the period, calls, error groups, CPU milliseconds per hour and never-run branch ranges. Fallow pairs each local function with its deployed function by stable id, then by its name and position among functions with the same name. A missing key, a plan limit or an unreachable cloud prints a status in the cloud section, and the run does not fail. The new --format compact prints about 1 KB of plain text per file, which an editor hook can add to the context as it is. (#4000)

• --lean makes the JSON report smaller for agent context. Use it with --format json on fallow dead-code, fallow health or the bare fallow run. The lean report omits empty arrays and dead-code summary counts that are zero. The lean report keeps one workspace diagnostic per kind and the first 10 rows of the hotspots, file_scores and large_functions tables. <table>_omitted gives the number of rows left out. --full-tables keeps every row. The root field profile: "lean" marks a lean report. Runs without --lean do not change. (#4007, #3992)

• fallow mutation --kill-matrix lists tests that may be redundant. This opt-in mode runs every covering test of each mutant, so the run can take longer. It reports a test when other tests also kill every mutant that the test kills. Review each reported test before you remove it. (#3997)

• Source-map uploads record where each generated line starts. fallow coverage upload-source-maps adds x_fallow_line_starts to each map. Fallow Cloud uses this field to find the function behind a browser Long An