chore(deps): bump fallow-rs/fallow from 3.0.0 to 3.2.0 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: fallow-rs/fallow.

Updates fallow-rs/fallow from 3.0.0 to 3.2.0

Release notes

Sourced from fallow-rs/fallow's releases.

v3.2.0: configurable large-function threshold, surfaced in the health summary

Health: a configurable "function too big" threshold, surfaced in the summary

This release makes the unit-size (large-function) check configurable and reports the effective ceiling in the health output.

health.maxUnitSize: raise the large-function bar instead of switching it off

The line count at which a function is reported as an oversized "large function" was hardcoded to 60 LOC. That made test suites noisy: a describe() callback spans hundreds of lines, and each large it() body trips the threshold too. The only escape was health.ignore, which drops every health signal (complexity, CRAP, hotspots) for those files, so you lost complexity checking on your test code as well.

You can now raise the bar rather than turning it off:

• Set a global health.maxUnitSize (default 60).
• Or scope it to a glob with a per-file thresholdOverrides entry, for example { "files": ["**/*.test.*"], "maxUnitSize": 500 }. Leave functions empty so the override covers both the describe() wrapper and the individual it() blocks.

Complexity, cognitive, and CRAP findings on those files are unchanged. Like the existing maxCyclomatic / maxCognitive / maxCrap overrides, this filters the reported "large functions" list; the descriptive unit-size profile and the health score still reflect raw sizes (use health.ignore to remove a file from the score entirely). Resolved thresholds are inspectable via fallow config. Thanks @​digulla for the request. (Closes #1731)

The health JSON summary reports the effective unit-size threshold

The summary block on fallow health --format json already carried max_cyclomatic_threshold, max_cognitive_threshold, and max_crap_threshold, but not a unit-size sibling, so a consumer reading the summary to learn which thresholds a run uses saw only three of the four. It now also carries max_unit_size_threshold (the effective global health.maxUnitSize, default 60). The human report's "Large functions" section reflects the configured global instead of a static "60" when health.maxUnitSize is raised project-wide. This is an additive-required field matching the existing max*Threshold siblings; no change to the unit-size check itself. (Closes #1750)

Other changes

• Reuse the audit analysis context in the programmatic API path for less redundant work per run.
• Benchmark-harness coverage and CI sharding improvements (internal).

Full Changelog: fallow-rs/fallow@v3.1.0...v3.2.0

v3.1.0: dev-dependency-in-production rule, member tracing, conditional dynamic imports

Features

New rule: dev-dependency-in-production

The promote-side mirror of test-only-dependency and type-only-dependency. A package in devDependencies that a production (non-test, non-config) file imports at runtime is flagged so you can promote it to dependencies, because pnpm install --prod omits devDependencies and the import breaks in production.

Only imports from files reachable from a runtime entry point count as evidence, so repo tooling (scripts/, benchmarks, rollup-config chains) does not trigger it, and workspace-owned files are governed by their own manifest. Type-only production imports are not flagged, and a package also present in dependencies / peerDependencies / optionalDependencies is left alone. Defaults to warn; suppress a package via ignoreDependencies. Surfaces in human, JSON, SARIF, Code Climate, compact, and markdown output, in fallow explain, and as an LSP diagnostic.

Thanks @​CallumHoward for the implementation.

Trace tooling now covers class, enum, and store members

fallow dead-code --trace FILE:MEMBER previously errored export 'X' not found when pointed at a class member, so a member finding could not be debugged from the trace tool. On an export miss the trace now falls back to a member trace that names the owning class, reports its reachability and usage, lists who imports it, and points at the right --unused-class-members inspection command. The MCP trace_export tool and Code Mode return the same member trace in-process, so AI agents get parity with the CLI. Trace not-found errors across trace_export / trace_file / trace_clone now carry an actionable help pointer to the right discovery tool.

Bug fixes

Conditional and logical dynamic imports are now traced

import(cond ? './a' : './b') and import(x || './b') previously produced no module-graph edge, so every file reachable only through such an import (and its whole transitive subtree) was falsely reported as unused-files / unused-exports. Extraction now emits one edge per statically-resolvable branch, including parenthesized and no-substitution template forms, across all dynamic-import shapes: bare expressions, const x = await import(...) declarations, .then() callbacks, React.lazy / next/dynamic arrow wrappers, and Angular/Vue route loadComponent / component callbacks. Genuinely runtime arguments (import(someVar)) still yield no edge, and repeated literals across branches deduplicate to a single edge.

Thanks @​Jerc92 for the contribution.

... (truncated)

Changelog

Sourced from fallow-rs/fallow's changelog.

Changelog

All notable changes to fallow are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[3.2.0] - 2026-07-05

Added

• The fallow health JSON summary now reports the effective unit-size threshold. summary on fallow health --format json already carried max_cyclomatic_threshold, max_cognitive_threshold, and max_crap_threshold, but not a unit-size sibling, so a consumer reading the summary to learn which thresholds a run uses saw only three of the four. It now also carries max_unit_size_threshold (the effective global health.maxUnitSize, default 60), and the human report's "Large functions" section reflects the configured global instead of a static "60" when health.maxUnitSize is raised project-wide. Additive-required field matching the existing max*Threshold siblings; no change to the unit-size check itself. (Closes #1750)

• New health.maxUnitSize threshold for the "function too big" (unit-size) check, configurable globally and per file. Previously the line-count at which a function is reported as an oversized "large function" was hardcoded to 60 LOC with no way to change it, so test suites reported many large functions: a describe() block's callback spans hundreds of lines, and each big it() body trips the threshold too. The only workaround was health.ignore, which drops every health signal (complexity, CRAP, hotspots) for those files, so you also lost complexity checking on your test code. You can now raise the bar instead of switching it off: set a global health.maxUnitSize (default 60), or scope it to a glob with a per-file thresholdOverrides entry, e.g. { "files": ["**/*.test.*"], "maxUnitSize": 500 }. Leave functions empty so the override covers both the describe() wrapper and the individual it() blocks. Complexity, cognitive, and CRAP findings on those files are unchanged. Like the existing maxCyclomatic / maxCognitive / maxCrap overrides, this filters the reported "large functions" list; the descriptive unit-size profile and the health score still reflect raw sizes (use health.ignore to remove a file from the score entirely). Functions within their effective ceiling are simply omitted from the large_functions JSON array; the resolved thresholds are inspectable via fallow config. Thanks @​digulla for the request. (Closes #1731)

[3.1.0] - 2026-07-05

... (truncated)

Commits

• 0d56827 chore: release v3.2.0
• afa3c17 fix(health): pluralize the large-functions unit-size footer (#1753)
• 185c6a7 feat(health): expose max unit size threshold in summary
• 47220ee ci: shard benchmarks by affected component
• 9dc768e perf: broaden codspeed benchmark coverage
• 1d14a77 feat(health): add maxUnitSize threshold override for the large-function check...
• c6bbfa3 docs: align benchmark file count
• ede3bcd docs: correct benchmark ratio claims
• d461313 chore: guard benchmark harness drift
• 9ea521d chore: stabilize codspeed benchmark shards
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Fallow audit report

Found 3 findings.

Details

Severity	Rule	Location	Description
minor	fallow/unused-dev-dependency	examples/package.json:15	Package '@tanstack/react-query' is in devDependencies but never imported; imported in other workspaces: packages/integration, packages/petstore-fastify
minor	fallow/unused-dev-dependency	examples/package.json:17	Package 'react' is in devDependencies but never imported; imported in other workspaces: packages/integration, packages/petstore-fastify
minor	fallow/unused-dev-dependency	packages/integration/package.json:24	Package 'fastify' is in devDependencies but never imported; imported in other workspaces: packages/petstore-contract, packages/petstore-fastify

Generated by fallow.

[dependabot]

Looks like fallow-rs/fallow is updatable in another way, so this is no longer needed.