npm / fallow
fallow
What changed in fallow 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.
12 breaking2 security38 new APIs and options4 performance14 behavior and defaults6 tooling23 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initfallow 399 changes
Breaking changes 12
Code Mode refuses incomplete type-aware runs requiring complete evidence, limits typed results to 16 MiB, and runs subprocesses with stdin from the null device.
A single * now matches within one path segment across every config path glob; use ** to cross directories. Fallow warns when a pattern now matches fewer files.
The API and Node bindings reject configs that enable type-aware analysis or configure audit baselines, returning explicit unsupported-setting errors.
With an auto-detected base, audit also compares merged default-branch commits and treats their findings as inherited; explicit base settings retain single-base comparison.
A run exits with code 2 when baseline failures stop every mutant run and reports the first failure clearly.
A mutation run exits with code 2 if its self-check executes no tests, preventing a false 100% score.
Mutation runs reject unsafe cache directories and exit with code 2; writes to ignored files are now detected as worktree changes.
A segment such as .* no longer matches a parent directory; hidden files inside the project root still match.
An error setting now enforces prop-drilling chains in CI; use warn to report chains without an error.
The variable still accepts target=level and level directives, but now skips span and field directives.
The enabled field is now an Option<bool>; callers should set typeAware.enabled in call options to run type-aware analysis through the API or Node bindings.
The action, GitLab template, and
fallow healthnow count only health findings remaining after a baseline.
Security 2
Fallow skips workspace glob entries outside the project root before reading the disk and reports the entry and declaring file with a new diagnostic.
Jest and Vitest project entries are read only when they resolve inside the project root, preventing config reads outside it.
New APIs and options 38
Widens mutation scope beyond the default changed-code scope.
Allows a mutation run to proceed with a dirty git worktree.
Allows planning mutants near file-system, process, network or database calls that would otherwise be pruned.
Sets the default selection for the audit dead-code sub-analysis.
Sets the default selection for the audit duplication sub-analysis.
Sets the default selection for the audit health sub-analysis.
Built-in support adds project and entry-point recognition for mise, railway, textlint, jasmine, rstest, serverless-framework, osls, flue, typescript-content-mapper, alchemy and opentelemetry.
Audit JSON reports diff-risk findings in a new section, also available in SARIF, CodeClimate, compact and markdown output.
Adds --only and --skip to select audit sub-analyses; skipped analyses are omitted on both head and base.
Setting this variable keeps audit on a single-base comparison instead of using the auto-detected merged-default-branch comparison.
The command reports and removes old base-snapshot cache entries.
The import format now accepts an optional commit field.
Health reports hidden change coupling and change dispersion, including coupled file pairs and additional hotspot metrics.
Adds each complexity finding's mutation score next to its CRAP score without changing CRAP or the health score.
A new command mutates changed code and runs project tests to measure mutation score, survivors, covering tests and test reach.
Shows a selected mutant against the current file using the last run report or the file named by --report.
The MCP audit tool now has a guide covering diff-risk rules and audit details; the tool description points to it.
Set this variable to 0 to keep an API or Node binding call syntactic.
Strong hidden-coupling pairs add this factor to refactoring targets; files without another target can receive resolve_hidden_coupling targets.
Caps covered mutants run; coverage still counts planned mutants that did not run.
Makes a mutation score below the specified minimum exit with code 1.
Selects the mutation test runner; auto detects supported Vitest, node:test or bun test versions.
Enables type-checking of mutation survivors through the --type-aware companion.
Runs each mutant without reusing earlier killed or survived results from the fallow cache.
Nuxt config files with mjs, cjs, mts, and cts extensions are now read; plugins, middleware, and modules count one level deep.
Selects and ranks mutants without running code.
The rule can report or gate prop-drilling chains, with source-hop overrides, suppressions, baselines, audit attribution and incremental changed-hop scopes; it remains off by default.
Sets the time allowed for each runner process to start, finish its dry run or reload; the default is 2m.
Type-checks each survivor through the --type-aware companion; survivors that add a type error leave the score.
A new default-warn rule reports handlers for project tags that no code produces when no unused-tagged-error finding covers the tag.
A new default-warn dead-code rule reports Effect layers that only unused layers compose.
A new default-warn rule reports tagged error classes referenced by types or catchTag handlers but never constructed, failed with or decoded.
Loads verdicts that mark equivalent mutants, which do not affect the score.
The GitLab template can use a duplication baseline on the default run and reports stale or mismatched baselines.
This environment variable judges health and duplication baselines supplied through integration inputs or CLI flags.
The GitLab template can use a health baseline on the default run and reports stale or mismatched baselines.
With a loaded health baseline, the GitHub summary shows new findings and accepted findings as context.
The GitHub Action and GitLab template can use a health baseline on the default run; they report stale or mismatched baselines.
Performance 4
Imports through barrels that export many packages are checked only against packages exporting the imported name; findings do not change.
Each glob compile is about three times cheaper, reducing dead-code run instructions and binary size.
Import resolution is faster in monorepos whose packages extend a root tsconfig that references them, with the same findings.
Project-glob walks skip node_modules, .git, gitignored paths and symlinks outside the project root, avoiding slow dependency-store walks.
Behavior and default changes 14
More callback bodies receive names from surrounding code; renamed findings get a new CodeClimate fingerprint once, and identity baselines transfer allowances to the new names in the same file.
The Rust API and Node binding place patch paths like --diff-file; foreign or ambiguous paths return the full report with a not-applied outcome.
The config schema now accepts extends as a single string.
Runs with a restored CI cache no longer rewrite unchanged cache entries; they update timestamps only.
Clone detection now reports clones inside objects passed to calls, and may show clone groups in chained code when an earlier call has a callback.
Changes the thresholds used to report hidden change-coupling pairs.
The setting now applies to Vue single-file components, including types used by defineProps.
The limit now applies to covered mutants; uncovered mutants do not use the limit.
A client cancellation now stops direct MCP tool calls and code_execute snippets; subprocess calls stop their complete process tree.
Editing package.json, deno.json, or tsconfig.json now rebuilds the cached module graph.
Only value references count toward test reach; type-only imports and value exports used only in type positions no longer qualify.
A namespace containing only types is reported as an unused type rather than an unused export; namespaces with values remain value exports.
This setting also judges health and duplication baselines supplied through integration inputs or CLI flags.
On a bare run, Fallow now notes that health or duplication baselines require
--health-baselineor--dupes-baseline.
Tooling 6
Five rules report risky changes in changed files: weakened tests, new suppressions, test-only branches, diverged clone siblings and added dependencies.
Trace entries now include line, search visibility, reason and search spelling so developers can find uses missed by name searches.
Recognizes additional plugin sections and reports the closest fallow alternatives for more root config keys.
Fixture analysis credits page-object members used by tests, including supported merged and imported test extensions; projects depending only on playwright can activate the plugin through a Playwright config.
The review brief reports test reach for changed value exports, including reach categories and mocking tests for mocked-only exports.
Recognized Bun, Deno, and Node test commands now identify test entry points and give imported code a static coverage estimate.
Fixes and other changes 23
Negative hit counts in
s,f,borb_Tare read as 0, so a coverage map with a negative count no longer stopsfallow healthorfallow audit.Fallow now reads
.oxlintrc.jsoncandoxlint.config.mts, including packages injsPluginslists at the top level and inoverrides.fallow health --type-aware --type-couplingcan pass--type-aware-require completeon large projects; coupling reports hold up to 10,000 evidence items.Fallow skips
{{ }}interpolations when finding a nested template's closing tag and reads<as text when no letter,/,!or?follows it, preserving template references.Fallow credits the exports read from a dynamic import and can find return imports inside control-flow blocks in local loader functions.
Default exports that forward imported bindings now keep the importers visible in trace and impact-closure output; fallow fix preserves the forward.
Brief audits no longer report every export as new public API after a preceding run without brief output.
Stale review threads are resolved even when posting an inline comment fails.
When removing dependencies, the command preserves package.json indentation, line endings, property order, and final newline.
The agent gate audits the work tree named by qualifying git commands, including linked worktrees, and blocks when any audit fails.
Reinstall the agent target to update an installed agent gate script.
Importers of a file that forwards an imported binding through
export defaultorexport =now appear in trace output.fallow recommend now uses the valid health configuration key for the maximum cyclomatic complexity recommendation.
Glob patterns with extglob groups, negative entries, or a leading ../ now work; invalid glob patterns give a warning.
These plugins and import.meta.glob now accept every extglob group, with corrected entry-point matching for grouped globs.
Pinia store members read through ReturnType aliases or by a setup store's own body now count as used.
The GitHub Action and GitLab template can use a duplication baseline on the default run; they report stale or mismatched baselines.
The source-map warning now tries the same paths as Fallow Cloud, avoiding checks against paths the cloud does not use.
Fallow credits
reactas a dependency when Vitest test files use JSX with the default runtime, subject to TypeScript JSX settings and workspace boundaries.Fallow applies Vitest JSX runtime rules only to files that remain included after exclusions and negated include entries.
Fallow combines project and base include globs when analyzing Vitest projects.
Fallow reads configs named by
extendsand custom-named project configs, including those matched by a glob.Fallow now follows Vitest 4 and 5 project inheritance rules when determining the JSX import source.