chore(deps): bump fallow-rs/fallow from 3.14.0 to 3.18.0

[dependabot]

Bumps fallow-rs/fallow from 3.14.0 to 3.18.0.

Release notes

Sourced from fallow-rs/fallow's releases.

v3.18.0: more accurate graphs, consistent diagnostics, leaner editor packages

Fallow 3.18.0 makes dead-code analysis more accurate across equivalent module shapes, aligns workspace and programmatic diagnostics with the CLI, and reduces normal VS Code extension downloads with platform-specific packages.

Highlights

• Equivalent module shapes now receive equivalent credit: default exports, static CommonJS maps, namespace and star chains, whole-module consumers, entry namespaces, dynamic and require imports, type namespaces, ambient modules, and framework handovers now retain the right reachability. Dotted member reads remain narrow, so unused siblings still report. #2391, #2397
• Workspace and programmatic diagnostics agree with the CLI: run-owned diagnostics are deterministic and project-relative, typed MCP routes apply supported CLI precedence, and listing routes no longer inherit analysis-stage diagnostics from earlier calls in the same process. Fresh MCP processes on Windows also return normally instead of stalling while next-step facts are assembled. #2392, #2396
• VS Code downloads are roughly 82 to 84 percent smaller: the extension now publishes universal and platform-specific packages for macOS, Linux, and Windows. Open VSX currently uses the universal package for win32-arm64 until that exact target becomes available; all other supported targets use their matching package.

Accuracy and reliability

• Trace, impact, and type-aware proof now agree: declaration lanes, reachability, declaration merges, and star collisions share the same verdict. Ambiguous exports return explicit ambiguity evidence instead of a misleading unused or not-found result. #2390
• CSS Modules use one crediting model across supported extensions: CSS, SCSS, Sass, and Less modules now handle aliased default imports, whole-object handovers, and duplicate class names in separate files consistently. Precise member reads still leave unused classes reportable. #2395
• Framework, ambient, and MDX extraction covers the remaining equivalent shapes: Astro, JSX member tags, module augmentations, local namespace members, import X = require(...), and ambient star exports now contribute the right evidence. MDX preserves multiline statements, JSX initializers, dynamic imports, comments, strings, and source locations while rejecting prose that merely looks like code. #2393
• Convex custom function directories are supported: the integration now honors a safe functions directory from convex.json. Thanks @​pierre-H for reporting #2387.
• Bun dependency overrides fail closed: resolutions and dependency-override selectors now use package-manager-aware parsing, accurate source locations, and safe handling for unreadable or shadowed lockfile state. Projects with legacy bun.lockb receive an actionable workspace diagnostic instead of unsafe removal advice. #2358, #2367, #2394
• Capability contracts derive from the CLI: machine-readable output formats, aliases, and the public exit-code ladder now keep fallow schema, packaged adapters, and agent guidance synchronized.
• Audit coverage attribution is consistent: the base pass uses the same coverage data as the head pass, and custom coverage paths participate in cache invalidation correctly.
• Inline review findings follow explicit lifecycles: clean reruns no longer repeat resolution replies, while a genuine recurrence opens a fresh reviewable lifecycle. Thanks @​Jerc92 for #2370.
• Windows launcher verification covers every production path: host-independent fixtures exercise lazy verification and sentinel cache behavior in regular CI and release validation. Thanks @​NgoQuocViet2001 for the groundwork in #2288.

Performance

• Trace output avoids redundant evidence: trace JSON omits duplicate direct references when no second namespace carries evidence, while dual-namespace traces keep the full per-lane payload. The stable trace benchmark improved by roughly 46 percent in local WallTime and 31 percent in the matching CodSpeed simulation.

Compatibility

• No configuration migration or schema-version bump is required. The new trace ambiguity and namespace evidence, workspace diagnostics, and diagnostic kinds are additive. Consumers that exhaustively match diagnostic kinds should continue to treat unknown informational values defensively.
• Bare-specifier re-exports inside ambient module bodies are now classified as type-only package usage. In --production mode, a production dependency used only through such a declaration can now produce the existing type-only-dependency finding. Move it to devDependencies when appropriate, or add it to ignoreDependencies when the declaration intentionally describes a runtime package.

Full Changelog: fallow-rs/fallow@v3.17.0...v3.18.0

v3.17.0: Type-aware CI output and Windows reliability

Type-aware analysis is easier to use in CI, more accurate around ambiguous exports, and more reliable across platforms.

Highlights

• Type-aware results render directly in CI: check and audit now support pr-comment-github, pr-comment-gitlab, review-github, and review-gitlab. fallow report --from <results.json> supports the same formats while preserving audit conclusions, semantic completeness, diff positions, ownership groups, and repository path prefixes. Required incomplete analysis fails closed. Thanks @​Jerc92 for #2272.
• Type-aware analysis starts reliably from npm and VS Code on Windows: the npm launcher uses Node for the companion, the VSIX includes every supported native semantic backend, and native child processes stay hidden without weakening process-tree cleanup. Thanks @​VariableVince for reporting #2284.

Accuracy and reliability

• Ambiguous export * collisions no longer blame contributing source files: Fallow suppresses ambiguity-attributable unused declaration, unused member, unrendered component, and unprovided injection findings. fallow trace exposes the additive star_export_ambiguity field with the contributing origins and namespaces. #2268, #2283
• External generic constraints stay bounded: type-aware public-signature scans avoid expanding complete external structural graphs while preserving project-local constraint edges. Unsupported Svelte virtual-module exports now fail closed with the stable svelte-virtual-module-exports reason instead of claiming complete evidence. Thanks @​cmoyates for the detailed reports behind #2271.
• Action binary verification has a hard deadline: the bundled Action supervises verification from a file, preserves normal exit statuses, and returns status 124 with one focused workflow error on timeout. Thanks @​Jonathangadeaharder for reporting #2273.

Performance

• Duplicate spread calculation, local type extraction, named-export indexing, and JSON root serialization now avoid unnecessary sorting, allocation, and copying. #2266, #2267, #2281, #2282

... (truncated)

Commits

• a87665c fix(release): stage Windows candidate version
• 536f96d chore: release v3.18.0
• 2262b4b fix(engine): detach Git probes from MCP stdin
• 26ba73c fix(ci): allow cold-cache check completion
• 4330a63 Merge pull request #2402 from fallow-rs/feat/contract-doc-drift
• cee2844 fix: align capability contracts and agent guidance
• 03e1d1b chore: start contract drift fix
• e3a0f98 test(mcp): bound env route analysis threads
• 73b67a1 fix(ci): initialize Windows pnpm cache store
• 77cf2cf perf(trace): omit redundant namespace evidence
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #601.