chore: bump the js-tooling group with 3 updates

[dependabot]

Bumps the js-tooling group with 3 updates: fallow, oxfmt and oxlint.

Updates fallow from 3.17.0 to 3.20.0

Release notes

Sourced from fallow's releases.

v3.20.0: Yarn PnP resolution, monorepo tsconfig scope, review schema 8

Highlights

Yarn Plug'n'Play projects resolve like any other project. A PnP install has no populated node_modules, so every bare import used to miss and fall through to the much slower path, which on a large monorepo meant minutes of import resolution instead of seconds. fallow now detects .pnp.cjs at the analyzed root or one of its ancestors and resolves bare specifiers through the manifest, anchored to the directory that holds it, so a run started from another directory and an editor session resolve the same way. Manifests that are not inlined (pnpEnableInlining: false) are unsupported and stay on the old path. Thanks to @​PatrickShaw for the report and the implementation.

Project-reference monorepos resolve correctly and much faster. A tsconfig.json reached through references that declares neither include nor files now applies only to files under its own directory, matching the compiler's **/* default project scope. It previously claimed every file in the repository, so its paths aliases leaked into sibling packages and every referenced project was walked for every import. Alongside that, the per-run tsconfig and canonicalize caches no longer serialize every lookup behind a single lock or deep-copy the parsed document on each hit. Together these turn the resolution phase on a large project-reference monorepo from minutes into seconds. Thanks again to @​PatrickShaw.

The review brief carries author actions, test adjacency, and independent slices. Review-brief schema 7 moves to 8, all additive. A judgment returned through --walkthrough-file may set action to block, address, consider, or fyi, validated on reentry and echoed on the accepted judgment, so the author reading a note knows what is required and what is optional. Each direction unit reports whether a test imports it directly and whether that test moved with the change. The partition reports independent slices: connected components of the inter-unit graph, so a change that splits along a graph-proven seam says so. The dependency decision arm now fires, batching added entries and major bumps per manifest and weighting them by their in-repo importers.

Behavior changes worth reading before you upgrade

• A strict run can now exit 1 where it exited 0. When a config contains any per-path overrides entry, the exit code is decided by per-file severity resolution. That path never consulted import-direction boundary violations, and it started from unpromoted base rules, so --fail-on-issues and --ci could pass an error-severity boundary-violation and every warn-severity finding. Both are fixed, so a pipeline with overrides that passed before can now fail without any config or code change. The findings themselves are unchanged; only the exit code is. To keep the previous outcome, set the rule to off rather than warn, or drop the strict flag for that job. Thanks to @​DeLuke84 for a precise repro.
• The referenced-tsconfig scope fix can surface new findings. An import that only resolved through the old repository-wide leak is now an unresolved-import finding, which is error severity by default, and a file reachable only through such an import may be reported as unused. If a subdirectory config intentionally holds shared paths, give it an explicit include, or move those aliases to a config whose directory contains the importing files.
• Function counts change for files with bodyless declarations. Overload signatures, abstract members, and declare function no longer count as functions, so file scores move on those files without any code change, and a file whose declarations are all bodyless leaves the file-score table. Metrics averaged over the function population shift accordingly.

Coverage and health

• Coverage matching finds functions by their body location. Each coverage-map function entry now contributes up to three candidate positions, so a function whose only structural match was its body location scores against real coverage instead of a static estimate. Because an expression-bodied arrow's recorded body is the next arrow in a curried chain, a body-start candidate yields to a declaration at the same position, which keeps every arrow of a middleware chain, a higher-order component, or a curried class property matchable. Regression baselines are unaffected; re-save health baselines if you run with --coverage, because a newly matched function can cross the CRAP ceiling. Thanks to @​PrinceD96 for the report and the contribution.

Notes for integrators

• The graph cache version moves twice in this release, so the first run after upgrading rebuilds import resolution instead of replaying results that predate the two resolution fixes.
• docs/backwards-compatibility.md records the exit-code and tsconfig-scope changes under "Notable behavior changes within v3".

Full Changelog: fallow-rs/fallow@v3.19.0...v3.20.0

v3.19.0: one-pass agent install, MCP resources, similar-code discovery

Highlights

One command to wire your coding agents. npx fallow agent install detects Claude Code, Codex, and Cursor from the project, your home directory, and the session, then writes what each one reads: an AGENTS.md task map (plus an @AGENTS.md import in CLAUDE.md), the fallow skill, the MCP server registration, and the commit/push gate. Every write carries a marker, re-running is byte-stable, --dry-run shows the plan, and fallow agent status / fallow agent uninstall cover the same surfaces. Nothing is fabricated when no harness is detected, hand-written MCP entries are never replaced or removed without --force, and --force on an unparsable config file saves the old bytes next to it first. fallow setup-hooks is deprecated in favor of this command (it keeps working through the 3.x line with a warning).

MCP reference material as resources. fallow-mcp now serves fallow://tools, fallow://issue-types, fallow://explain plus the fallow://explain/{issue_type} template, fallow://task-matrix, and the config, plugin, and rule-pack JSON Schemas as read-only, cacheable resources. Payloads are plain documents (the schema resources are byte-identical to fallow config-schema and friends), the server version travels in each content item's _meta, and fallow schema gains a matching mcp_resources block. Fallow is also listed in the official MCP Registry.

Opt-in semantic similar-code discovery. fallow similar-code finds functions that may share intent despite different syntax, through a pinned and verified local model. It is advisory by design: explicit local setup, model provenance, a persistent vector cache, source-grounded candidate inspection, a fail-closed external verdict join, read-only MCP tools, and a Node API, with no participation in bare analysis, audit gates, SARIF, editor diagnostics, or auto-fix.

Detection and plugins

• StyleX theme styling. defineVars, unstable_defineVarsNested, createTheme, and unstable_createThemeNested are modeled with the framework's real token shape and theme-application semantics, including same-file reads, partial overrides, empty reset themes, and namespace or default aliases.
• size-limit is recognized. A new built-in plugin credits every declared @size-limit/* and size-limit-* package, treats size-limit as tooling, and keeps every config form it searches reachable, including a config inside a workspace package when the tool is hoisted to the monorepo root. Thanks to @​robinvdvleuten for the contribution in #2413.

Fixes

• React Native and Expo platform families are no longer reported as duplicate exports. With the react-native or expo plugin active, dead-code folds each Metro family (UserMenu.tsx, UserMenu.ios.tsx, UserMenu.web.tsx, ...) into one representative before duplicate detection; a genuine duplicate in an unrelated file is still reported. Thanks to @​issacfriedman for the report in #2407.
• fallow impact statusline names a newer Impact store. An older binary reading a store written by a newer fallow now prints data from newer fallow · upgrade this fallow instead of the generic data unavailable line.

Deprecated

• fallow setup-hooks: use fallow agent install (every harness in one pass) or fallow hooks install --target agent (the gate alone). The command keeps working throughout fallow 3 with a one-line warning and is removed in the next major.

Full Changelog: fallow-rs/fallow@v3.18.0...v3.19.0

... (truncated)

Commits

• 85d490c ci(release): initialize the pnpm store before caching on Windows
• 5a2a685 chore: release v3.20.0
• fe3fdd2 fix(health): match Istanbul coverage by body location and skip bodyless decla...
• 446e3f0 docs(changelog): move the review schema 8 entries to Unreleased
• 8d53657 fix(check): fail strict runs on findings the override path let through (#2447)
• d877424 feat(graph): resolve Yarn Plug'n'Play projects through the PnP manifest (#2435)
• b0585d4 fix(graph): scope a referenced tsconfig without include to its own directory ...
• 8c3c5b7 perf(graph): cut tsconfig cache lock contention on large monorepos (#2437)
• 6afdf4f chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#2430)
• 9406571 chore(napi): sync transitive similar-code platform pins to v3.19.0
• Additional commits viewable in compare view

Updates oxfmt from 0.64.0 to 0.65.0

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• See full diff in compare view

Updates oxlint from 1.79.0 to 1.80.0

Release notes

Sourced from oxlint's releases.

oxlint v1.80.0 & oxfmt v0.65.0

Table of Contents

• Oxlint v1.80.0
• Oxfmt v0.65.0

Oxlint v1.80.0

🚀 Features

• 70c3e35 linter/typescript/no-confusing-non-null-assertion: Implement suggestion (#26012) (Mikhail Baev)

🐛 Bug Fixes

• 17ae11c linter/oxc/double-comparisons: Handle grouped logical expressions (#26044) (camc314)
• 8a353a7 linter/eslint/no-control-regex: Refine help message text (#25996) (Rahul Mishra)
• 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
• 8d94cd1 linter/eslint/no-useless-rename: Preserve type modifiers (#26020) (Cameron)
• 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
• 51d36d7 linter/vue: Resolve vue imports via shared import helpers (#25903) (Connor Shea)
• 83a68d2 linter/react/no-react-children: Resolve react imports by symbol (#25901) (Connor Shea)
• 124e196 linter: Resolve globals by reference, not by name (#25905) (Connor Shea)
• a701bcc linter: Remove invalid React compiler doc links (#25900) (Boshen)

📚 Documentation

• 9b7e153 linter: Set version to 1.79.0 for rules shipped in 1.79.0 (#25902) (connorshea)

Oxfmt v0.65.0

🐛 Bug Fixes

• bf37dd5 formatter: Preserve class decorators before export when the statement is suppressed (#26034) (leaysgur)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

Commits

• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codspeed-hq]

Merging this PR will not alter performance

✅ 188 untouched benchmarks
⏩ 77 skipped benchmarks¹

---

_{Comparing dependabot/npm_and_yarn/js-tooling-e140c5367f (a4d7f17) with main (680be9c)}

Footnotes

1. 77 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩