# What changed in fallow > 99 changes in fallow 3 from its official release notes, upgrade guides and advisories: 12 breaking, 2 security, 38 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/fallow/ To see which of these apply to a repository, run `npx @unstale/cli init` in it. ## fallow 3 ### Breaking changes - Code Mode refuses incomplete type-aware runs requiring complete evidence, limits typed results to 16 MiB, and runs subprocesses with stdin from the null device. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A single * now matches within one path segment across every config path glob; use ** to cross directories. Fallow warns when a pattern now matches fewer files. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The API and Node bindings reject configs that enable type-aware analysis or configure audit baselines, returning explicit unsupported-setting errors. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - With an auto-detected base, audit also compares merged default-branch commits and treats their findings as inherited; explicit base settings retain single-base comparison. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A run exits with code 2 when baseline failures stop every mutant run and reports the first failure clearly. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A mutation run exits with code 2 if its self-check executes no tests, preventing a false 100% score. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Mutation runs reject unsafe cache directories and exit with code 2; writes to ignored files are now detected as worktree changes. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A segment such as .* no longer matches a parent directory; hidden files inside the project root still match. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - An error setting now enforces prop-drilling chains in CI; use warn to report chains without an error. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The variable still accepts target=level and level directives, but now skips span and field directives. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The enabled field is now an Option; callers should set typeAware.enabled in call options to run type-aware analysis through the API or Node bindings. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The action, GitLab template, and `fallow health` now count only health findings remaining after a baseline. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) ### Security - Fallow skips workspace glob entries outside the project root before reading the disk and reports the entry and declaring file with a new diagnostic. (3.34.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.1) - Jest and Vitest project entries are read only when they resolve inside the project root, preventing config reads outside it. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) ### New APIs and options - Widens mutation scope beyond the default changed-code scope. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Allows a mutation run to proceed with a dirty git worktree. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Allows planning mutants near file-system, process, network or database calls that would otherwise be pruned. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Sets the default selection for the audit dead-code sub-analysis. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Sets the default selection for the audit duplication sub-analysis. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Sets the default selection for the audit health sub-analysis. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Built-in support adds project and entry-point recognition for mise, railway, textlint, jasmine, rstest, serverless-framework, osls, flue, typescript-content-mapper, alchemy and opentelemetry. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Audit JSON reports diff-risk findings in a new section, also available in SARIF, CodeClimate, compact and markdown output. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Adds --only and --skip to select audit sub-analyses; skipped analyses are omitted on both head and base. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Setting this variable keeps audit on a single-base comparison instead of using the auto-detected merged-default-branch comparison. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The command reports and removes old base-snapshot cache entries. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The import format now accepts an optional commit field. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Health reports hidden change coupling and change dispersion, including coupled file pairs and additional hotspot metrics. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Adds each complexity finding's mutation score next to its CRAP score without changing CRAP or the health score. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A new command mutates changed code and runs project tests to measure mutation score, survivors, covering tests and test reach. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Shows a selected mutant against the current file using the last run report or the file named by --report. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The MCP audit tool now has a guide covering diff-risk rules and audit details; the tool description points to it. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Set this variable to 0 to keep an API or Node binding call syntactic. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Strong hidden-coupling pairs add this factor to refactoring targets; files without another target can receive resolve_hidden_coupling targets. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Caps covered mutants run; coverage still counts planned mutants that did not run. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Makes a mutation score below the specified minimum exit with code 1. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Selects the mutation test runner; auto detects supported Vitest, node:test or bun test versions. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Enables type-checking of mutation survivors through the --type-aware companion. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Runs each mutant without reusing earlier killed or survived results from the fallow cache. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Nuxt config files with mjs, cjs, mts, and cts extensions are now read; plugins, middleware, and modules count one level deep. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Selects and ranks mutants without running code. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The rule can report or gate prop-drilling chains, with source-hop overrides, suppressions, baselines, audit attribution and incremental changed-hop scopes; it remains off by default. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Sets the time allowed for each runner process to start, finish its dry run or reload; the default is 2m. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Type-checks each survivor through the --type-aware companion; survivors that add a type error leave the score. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A new default-warn rule reports handlers for project tags that no code produces when no unused-tagged-error finding covers the tag. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A new default-warn dead-code rule reports Effect layers that only unused layers compose. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A new default-warn rule reports tagged error classes referenced by types or catchTag handlers but never constructed, failed with or decoded. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Loads verdicts that mark equivalent mutants, which do not affect the score. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The GitLab template can use a duplication baseline on the default run and reports stale or mismatched baselines. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - This environment variable judges health and duplication baselines supplied through integration inputs or CLI flags. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - The GitLab template can use a health baseline on the default run and reports stale or mismatched baselines. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - With a loaded health baseline, the GitHub summary shows new findings and accepted findings as context. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - The GitHub Action and GitLab template can use a health baseline on the default run; they report stale or mismatched baselines. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) ### Performance - Imports through barrels that export many packages are checked only against packages exporting the imported name; findings do not change. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Each glob compile is about three times cheaper, reducing dead-code run instructions and binary size. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Import resolution is faster in monorepos whose packages extend a root tsconfig that references them, with the same findings. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Project-glob walks skip node_modules, .git, gitignored paths and symlinks outside the project root, avoiding slow dependency-store walks. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) ### Behavior and default changes - More callback bodies receive names from surrounding code; renamed findings get a new CodeClimate fingerprint once, and identity baselines transfer allowances to the new names in the same file. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The Rust API and Node binding place patch paths like --diff-file; foreign or ambiguous paths return the full report with a not-applied outcome. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The config schema now accepts extends as a single string. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Runs with a restored CI cache no longer rewrite unchanged cache entries; they update timestamps only. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Clone detection now reports clones inside objects passed to calls, and may show clone groups in chained code when an earlier call has a callback. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Changes the thresholds used to report hidden change-coupling pairs. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The setting now applies to Vue single-file components, including types used by defineProps. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The limit now applies to covered mutants; uncovered mutants do not use the limit. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A client cancellation now stops direct MCP tool calls and code_execute snippets; subprocess calls stop their complete process tree. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Editing package.json, deno.json, or tsconfig.json now rebuilds the cached module graph. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Only value references count toward test reach; type-only imports and value exports used only in type positions no longer qualify. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - A namespace containing only types is reported as an unused type rather than an unused export; namespaces with values remain value exports. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - This setting also judges health and duplication baselines supplied through integration inputs or CLI flags. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - On a bare run, Fallow now notes that health or duplication baselines require `--health-baseline` or `--dupes-baseline`. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) ### Tooling - Five rules report risky changes in changed files: weakened tests, new suppressions, test-only branches, diverged clone siblings and added dependencies. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Trace entries now include line, search visibility, reason and search spelling so developers can find uses missed by name searches. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Recognizes additional plugin sections and reports the closest fallow alternatives for more root config keys. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Fixture analysis credits page-object members used by tests, including supported merged and imported test extensions; projects depending only on playwright can activate the plugin through a Playwright config. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The review brief reports test reach for changed value exports, including reach categories and mocking tests for mocked-only exports. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Recognized Bun, Deno, and Node test commands now identify test entry points and give imported code a static coverage estimate. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) ### Fixes and other changes - Negative hit counts in `s`, `f`, `b` or `b_T` are read as 0, so a coverage map with a negative count no longer stops `fallow health` or `fallow audit`. (3.34.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.1) - Fallow now reads `.oxlintrc.jsonc` and `oxlint.config.mts`, including packages in `jsPlugins` lists at the top level and in `overrides`. (3.34.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.1) - `fallow health --type-aware --type-coupling` can pass `--type-aware-require complete` on large projects; coupling reports hold up to 10,000 evidence items. (3.34.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.1) - Fallow skips `{{ }}` interpolations when finding a nested template's closing tag and reads `<` as text when no letter, `/`, `!` or `?` follows it, preserving template references. (3.34.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.1) - Fallow credits the exports read from a dynamic import and can find return imports inside control-flow blocks in local loader functions. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Default exports that forward imported bindings now keep the importers visible in trace and impact-closure output; fallow fix preserves the forward. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Brief audits no longer report every export as new public API after a preceding run without brief output. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Stale review threads are resolved even when posting an inline comment fails. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - When removing dependencies, the command preserves package.json indentation, line endings, property order, and final newline. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The agent gate audits the work tree named by qualifying git commands, including linked worktrees, and blocks when any audit fails. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Reinstall the agent target to update an installed agent gate script. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Importers of a file that forwards an imported binding through `export default` or `export =` now appear in trace output. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - fallow recommend now uses the valid health configuration key for the maximum cyclomatic complexity recommendation. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Glob patterns with extglob groups, negative entries, or a leading ../ now work; invalid glob patterns give a warning. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - These plugins and import.meta.glob now accept every extglob group, with corrected entry-point matching for grouped globs. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - Pinia store members read through ReturnType aliases or by a setup store's own body now count as used. (3.34.0) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.34.0) - The GitHub Action and GitLab template can use a duplication baseline on the default run; they report stale or mismatched baselines. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - The source-map warning now tries the same paths as Fallow Cloud, avoiding checks against paths the cloud does not use. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - Fallow credits `react` as a dependency when Vitest test files use JSX with the default runtime, subject to TypeScript JSX settings and workspace boundaries. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - Fallow applies Vitest JSX runtime rules only to files that remain included after exclusions and negated include entries. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - Fallow combines project and base include globs when analyzing Vitest projects. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - Fallow reads configs named by `extends` and custom-named project configs, including those matched by a glob. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1) - Fallow now follows Vitest 4 and 5 project inheritance rules when determining the JSX import source. (3.33.1) — [release notes](https://github.com/fallow-rs/fallow/releases/tag/v3.33.1)