chore(deps): bump the github-actions group across 1 directory with 4 updates

[dependabot]

Bumps the github-actions group with 4 updates in the / directory: actions/setup-node, github/codeql-action/init, github/codeql-action/analyze and fallow-rs/fallow.

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Updates github/codeql-action/init from 4.36.3 to 4.37.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.3 to 4.37.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Updates fallow-rs/fallow from 3.0.0 to 3.6.0

Release notes

Sourced from fallow-rs/fallow's releases.

v3.6.0: compact JSON by default, reusable audit caches, Windows diagnostics fix

fallow v3.6.0 makes --format json leaner by default, adds first-class cleanup for reusable audit caches, and fixes editor diagnostics on Windows.

Features

Compact JSON by default

fallow --format json now emits compact JSON. Machine consumers get the same schema and values with less output, and JSON success and error documents still end with exactly one line feed. Pass the global --pretty flag when you want indented JSON for manual inspection:

fallow --format json            # compact (default)
fallow --format json --pretty   # indented

Schema commands follow the same compact-by-default behavior. SARIF, Code Climate, saved baselines, snapshots, caches, and other persisted JSON keep their existing presentation. Thanks @​avidianity for the request (Closes #1861).

Root-owned reusable audit caches you can clean safely

Each requested project root now keeps a single base-worktree cache that is rebuilt in place when the resolved base SHA changes, and the reuse lock is held for the audit lifetime so a cleanup or a different-base rebuild can never remove files under a running audit. A new subcommand cleans caches explicitly:

fallow audit-cache remove --root ./my-project --dry-run   # preview
fallow audit-cache remove --root ./my-project --yes       # remove

Temporary source snapshots are private on Unix, predictable sidecars reject symlinks, and Git administration cleanup is restricted to the current repository's verified worktree entry. Thanks @​ryolambert for the contribution (#1893).

Bug fixes

• Windows editor diagnostics render again. LSP paths no longer retain the Windows verbatim path prefix that produced a UriError and prevented diagnostics from rendering. Thanks @​Bro3Simon for the detailed report (Closes #1899).

• Package-less TypeScript project references keep dependency ownership at the parent package. Unused-dependency attribution now credits each imported package to the deepest workspace root that actually declares a package.json, so a tsconfig project reference without its own manifest no longer captures (and then misreports) dependencies that belong to its parent package.

Full Changelog: fallow-rs/fallow@v3.5.1...v3.6.0

v3.5.1: sharper dead-code crediting, license-token hardening

This patch sharpens dead-code crediting for two common architecture patterns, hardens license-token file handling, and speeds up named re-export and workspace bucketing at scale.

Fixes

unused-class-members no longer false-flags interface-typed property dispatch (ports-and-adapters / hexagonal DI). A method reached through a property whose declared type is an interface, on a class that implements that interface, is now credited. Given Deps.greeter: GreeterPort, class GreeterAdapter implements GreeterPort, and a call site useIt(deps: Deps) { deps.greeter.greet() }, fallow now keeps GreeterAdapter.greet. Direct-parameter and variable dispatch already worked; this closes the interface-property hop that dominates hexagonal findings. Genuinely-unused methods still report. Thanks @​lukeramsden for the clean minimal reduction. (Closes #1863)

unused-class-members no longer false-flags a factory that returns an object literal. A factory returning an inferred object literal whose property values are class instances, consumed cross-module as const ui = createUi(); ui.orders.placeOrder(), now credits OrdersPage.placeOrder. Every property-value shape resolves: a direct new Class(), a local const alias, and a member read of a separately-constructed instance (a typed field or a getter). Nested object literals, the assigned-then-returned form, and same-file consumption are all covered. This is the general root cause behind the Playwright page-object-factory pattern; it is not Playwright-specific. Thanks @​committedpazz for the precise bisection. (Closes #1858)

Next.js metadata route config exports are no longer reported as unused. App Router sitemap, robots, manifest, icon, and social image route files now credit the framework-consumed dynamic, revalidate, fetchCache, runtime, preferredRegion, and maxDuration exports. dynamicParams and arbitrary helper exports remain reportable because Next.js does not re-export them from generated metadata route handlers.

Star re-exports no longer make a source module's default export appear used. ECMAScript export * excludes default, so fallow now keeps an unused source default visible unless it is explicitly re-exported.

fallow migrate suggestions use recognized suppression issue kinds. When migrating an ignoreUnresolved entry, the generated warning now suggests the singular unresolved-import token, validated against fallow's own suppression parser.

... (truncated)

Changelog

Sourced from fallow-rs/fallow's changelog.

Changelog

All notable changes to fallow are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• VS Code can set a changed-code baseline at HEAD in one command. The new Fallow: Set Baseline at HEAD palette command creates the local lightweight fallow-baseline tag, writes fallow.changedSince to a single-folder workspace, and refreshes analysis. It confirms before mutation, never pushes a remote ref, refuses to move an existing tag, and leaves multi-root workspaces unchanged until per-root baseline semantics exist.

Fixed

• Imported churn history is bounded and validated before analysis. Churn files now enforce a serialized size limit, reject paths outside the project, and report line-total overflow as an input error instead of panicking or wrapping.

• Unified diffs read from stdin enforce the same size cap as diff files. Oversized or invalid stdin now disables line filtering and reports all findings instead of allocating an unbounded buffer or parsing a truncated diff.

• Source and plugin-manifest symlinks stay inside the project root. Broken links, directory targets, and links to outside files are skipped before content is read, while links to regular files inside the project remain supported under their visible paths.

• Large minified bundles no longer exhaust memory during analysis. Dense single-line bundles (precompiled editor assets such as ProseMirror) could drive taint-tracking memory up without bound, so fallow dead-code climbed to tens of GiB and produced no output on repos that ship them. Per-module taint recording is now capped, so these repos analyze in normal time and memory. (#1843)

• Analysis is more robust on large, generated, and minified codebases. A follow-up hardening pass to the taint-memory fix bounds or linearizes several other paths that could grow super-linearly on adversarial input: duplicate export and class heritage grouping, star re-export propagation, object-binding and factory-return candidate resolution, JSDoc import scanning, template and CSS-in-JS expression scanning (now depth-guarded against stack overflow on pathologically nested input), and the health-time line-number and mask scanners. Analysis output is unchanged on ordinary code. (#1843)

... (truncated)

Commits

• 32b3f89 chore: release v3.6.0
• 5795c10 fix(ci): drop flaky pnpm cache from release-validation setup-node
• 4e46717 fix(audit): silence Windows unnecessary_wraps on ownership no-op
• 2fb4b7d test(audit): resolve integration cache paths via production hash
• 502e793 test(audit): mirror production hashing in reusable-cache identity test
• bef4d7d chore(docker): pin FALLOW_VERSION 3.5.1 with refreshed checksums
• 852cc98 chore: remove superpowers workflow artifacts
• a6c74e7 fix: harden analysis and integration contracts
• d261eb3 fix(lsp): normalize Windows diagnostic paths
• 3ab6c16 fix(cli): honor JSON style for schema commands
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Fallow audit report

Found 3 findings.

Details

Severity	Rule	Location	Description
minor	fallow/unused-dev-dependency	examples/package.json:15	Package '@tanstack/react-query' is in devDependencies but never imported; imported in other workspaces: packages/integration, packages/petstore-fastify
minor	fallow/unused-dev-dependency	examples/package.json:17	Package 'react' is in devDependencies but never imported; imported in other workspaces: packages/integration, packages/petstore-fastify
minor	fallow/unused-dev-dependency	packages/integration/package.json:24	Package 'fastify' is in devDependencies but never imported; imported in other workspaces: packages/petstore-contract, packages/petstore-fastify

Generated by fallow.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.