Update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
archlinux	container	digest	82b1b08 → b944cc6
bun (source)	uses-with	patch	1.4.0 → 1.4.2
fallow-rs/fallow	action	minor	v3.22.0 → v3.24.0
github/codeql-action	action	minor	v4.37.9 → v4.38.0
pnpm/action-setup	action	minor	v6.0.10 → v6.1.0

---

Release Notes

oven-sh/bun (bun)

v1.4.2: Bun v1.4.2

Compare Source

To install Bun v1.4.2

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.2:

bun upgrade

Read Bun v1.4.2's release notes on Bun's blog

Thanks to 3 contributors!

• @​dylan-conway
• @​jarred-sumner
• @​robobun

v1.4.1

Compare Source

fallow-rs/fallow (fallow-rs/fallow)

v3.24.0: : Findings that say when the run behind them was incomplete

Compare Source

This release is about output honesty: a number that is a floor should not be presented as a total, a zero that means "not measured" should say so, and a mutation resting on an incomplete picture should not be one click away.

Findings say when the run behind them was incomplete

A file that fails to parse, one the size guard skipped, one that could not be read: each of those silently yields zero imports, which can make a live export read as dead. Nine dead-code arrays now carry an optional reachability_caveats[] naming exactly that, so a reader who never scrolls back to the diagnostics list still sees it. fallow fix refuses to apply a mutation under a caveat (skip_reason: "low_confidence_incomplete_analysis"), the actions contract reports auto_fixable: false with the reason in its note, and the review formats withhold the one-click ```suggestion block rather than hedging in prose above it. Findings themselves are never withheld, filtered, reordered, or re-severitied, and no exit code changes. A run that read every file it discovered is byte-identical.

New commands

• fallow trace --path <FROM> <TO> walks the import graph and returns the shortest chain between two modules, with type-only hops reported rather than skipped. Also over MCP as trace_import_path.
• fallow trace-error [FILE|-] resolves a runtime stack trace against the project graph. It refuses to overclaim: a frame matching several definitions is ambiguous, one matching none stays not_found. Also over MCP as trace_error.
• fallow doctor gains three advisory checks for installed dependencies and cache reuse.
• The MCP server gains get_cloud_runtime_context, which reads a repository's runtime facts from fallow cloud and returns the same runtime_coverage block the local tools return. The key comes from FALLOW_API_KEY in the server environment and is never a call argument. This is the only fallow MCP tool that makes a network call.

Reproducible churn

Recency weighting, ownership staleness, and the churn window read the system clock at three separate points, so numbers drifted between runs over the same commit. All three now resolve one instant from HEAD's committer timestamp, FALLOW_CLOCK_EPOCH pins it explicitly, and hotspot_summary reports which clock it used and whether that is reproducible.

Smaller, honest envelopes

The review brief carried its impact closure twice, uncapped, which on a one-file change was more than half the envelope. graph_facts.reachable_from is gone; impact_closure now reports an exact affected_count, a capped sample, and an affected_by_dir rollup that says whether a change stayed inside its module. fallow dupes --no-fragments and the MCP find_dupes include_fragments parameter return location-only clone instances. The MCP tool list stops inlining detail every session pays for on connect.

Fixes worth calling out

• The duplication token cache works on Windows again. Metadata is the fast path, not the verdict, so a missing inode change time falls back to content instead of never hitting.
• A class member read through const { method } = instance counts as used.
• A quoted jq filter in a CI run: block is no longer read as an entry glob.
• fallow fix prints forward slashes on Windows.
• dupes --top N reported two different scopes in one stats object; all four numbers now describe the measured corpus, with explicit shown and omitted counts.
• The dashboard link printed after a coverage upload no longer 404s.
• fallow coverage analyze --cloud keeps the functions the runtime actually ran.
• fallow license refresh can recover from a stale stored license using an API key.

Thanks @​Ha1baraA11, @​kristersd, and @​carlrannaberg for reports and patches in this release.

Three analysis caches change format together, so the first run after upgrading is cold.

Full changelog: fallow-rs/fallow@v3.23.0...v3.24.0

v3.23.0: : a readiness check, and reports that survive a moved checkout

Compare Source

An empty Fallow report has always been ambiguous. It can mean the project is clean, or it can mean Fallow never resolved your config and analyzed almost nothing, and until now the output looked the same either way.

A readiness command

fallow doctor settles it before you run anything. The command checks the project root, which config actually resolved, whether workspace discovery found what you expect, whether external plugins load, and whether the optional type-aware companion is available. Every check is a local read, so nothing is analyzed and nothing is written.

npx fallow doctor
npx fallow doctor --format json

Fallow doctor (.)
[OK] root: Project root is an accessible directory.
[OK] config: Configuration resolved from .fallowrc.json.
[OK] workspaces: Workspace discovery completed (30 workspace packages).
[OK] plugins: No external plugins are configured; built-in detection remains available.
[-] type-aware: Type-aware analysis is not enabled.
Status: ready

A failed required check exits 2. There is no exit 1, because that code means error-severity findings and doctor looks at your setup, not your code. For agents, --format json --quiet gives you a status to branch on and a checks[].message per check to report back.

Reports that stay put when the checkout moves

Duplication groups that share a full content hash used to take an ordinal derived from absolute-path digests. Move an unchanged checkout to a different directory and the same handle could land on a different group. Those groups now use report-scoped dup:<16hex>-rN handles ordered by canonical fragment, location, and metric. Health complexity ties break on project-relative path, line, column, and function name, so --top selects the same finding wherever the repository lives.

If you suppress duplication findings, read this before upgrading. Legacy numeric collision handles (dup:<16hex>-N) are still valid syntax and are deliberately not aliases for the corrected ones. An old collision suppression or baseline key will resurface its finding for review, rather than match some other group without telling you. Regenerate the report, look at the group, then refresh its ignoredClones key or baseline. Update every installation before you store -rN keys, since older versions reject that syntax; minimumVersion pins the released version a shared config needs.

Ordinary dup:<8hex> and widened dup:<16hex> handles are unaffected, which is most of them.

Detection accuracy

Four people filed four bugs this cycle, and all four are fixed here.

A class member reached through an object container or an object alias, rather than directly on the instance, was never followed (#​2546, thanks @​Ericlm). Binaries invoked through varlock run -- <bin> lost their argument boundaries in package-script parsing (#​2551, reported and fixed by @​PrinceD96 in #​2552). fallow-ignore-next-line unused-catalog-entry was suggested by the finding and then did nothing, because quoted YAML scalar content was dropped in catalog parsing (#​2548, thanks @​michalius). Scoped package names rendered as empty strings in review --brief (#​2553, thanks @​Elia97).

Oxlint configs that declare jsPlugins now count those as referenced dependencies, so Ultracite-style setups stop reporting their lint plugins as unused.

Editors and CI

Zed reaches the parity its extension API allows. Exact diagnostic codes go in initialization_options.mutedCategories, where a team can commit them alongside the project. Inline complexity Code Lens is opt-in through health.inlineComplexity, and advisory security candidate diagnostics turn on through your project rules like anywhere else. The Zed guide separates those LSP features from full fallow health and fallow security CLI runs, and says plainly that the current extension API offers no contribution point for a Fallow-owned sidebar or status-bar item.

Inline review comments now carry clone evidence: the stable dup: handle with line and instance counts, plus each peer copy as a repository-relative range, so a reviewer can open the other copies from the comment (thanks @​Jerc92 for #​2550).

The VS Code integration frames LSP messages by bytes, which fixes stream desynchronization on workspace paths containing non-ASCII characters.

For agents

Every MCP tool parameter now carries a description taken from the CLI help, so a tool reads the same way in an agent as it does in a terminal. guard now spells out its own contract. It reads config and runs no analysis, and a path matching no configured zone comes back as an empty rule set instead of an error. The server instructions point at tools/list and the resources instead of listing every tool inline, which keeps them from drifting each time the roster changes.

The agent instruction surface got a prompt audit. Numbers that had rotted were deleted rather than refreshed, since a refreshed number rots again next release, and the CLI reference now names fallow dead-code in the three places it still used the legacy check alias.

Install

npx fallow@3.23.0 doctor

Full Changelog: fallow-rs/fallow@v3.22.0...v3.23.0

github/codeql-action (github/codeql-action)

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

pnpm/action-setup (pnpm/action-setup)

v6.1.0

Compare Source

What's Changed

• feat: support pnpm v12 by @​zkochan in #​288

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.