chore: bump the js-tooling group with 3 updates

[dependabot]

Bumps the js-tooling group with 3 updates: fallow, oxfmt and oxlint.

Updates fallow from 3.20.0 to 3.25.0

Release notes

Sourced from fallow's releases.

v3.25.0: positional path scope, runtime coverage joins callbacks and object members

Scope any file command to a path

Bare fallow, check, dupes, health, audit, security, fix, list and similar-code now take an optional positional path:

npx fallow src/components
npx fallow health src/api/client.ts
npx fallow fix src/legacy

The whole-project graph is still built, so every cross-file fact stays sound. Only the reported findings narrow, and fix plans and applies only the fixes that touch scoped files.

Resolution is root-first for a bare relative path, ./ and ../ are honoured as current-directory claims, and a missing or outside-root path is rejected with an actionable exit-2 error rather than silently analysing the whole project. The scope composes with --workspace as one more workspace root and intersects with --changed-since and --diff-file. audit narrows its changed-file universe so verdict and base attribution stay coherent, while its base pass stays unscoped because it runs in another worktree.

Runtime coverage joins far more of your code

fallow coverage analyze --cloud joins cloud runtime rows against a static index that was built from the health and complexity pass, which enumerates declarations and bindings only. Everything else the runtime instrumenter names, an arrow passed to a call and named after its callee (rows.map(...), sqliteTable("t", {}, (table) => [...]), .references(() => ...)), an object-literal method, a getter or setter, and a function assigned to a member, had nothing to join against. Those rows landed in cloud_functions_unmatched instead of reaching findings and hot_paths, and in a typical service those are exactly the highest-traffic functions, so the hot-path list was led by whichever declaration happened to be enumerated.

The index now carries every function the instrumenter would name, resolved through the same walker the static inventory upload uses, so the identity matches the stable_id the cloud stores. A function known only by the callee it was passed to is flagged as a callback and its verdict copy names the call site ("Callback passed to map; ...") instead of pointing at a declaration that does not exist.

The static function inventory was fixed on the same terms: an object-literal method, a function-valued property, a getter or setter, a function assigned to a member expression, and an anonymous export default were left at their (anonymous_N) placeholder while the instrumenter names them run, execute, get closed, rollback and default. Both sides now agree, so an uploaded inventory entry and the runtime row for the same function share one identity.

... (truncated)

Commits

• 30167b4 chore: release v3.25.0
• 03aad8c fix(cli): print forward slashes in the check and health human output
• 423ce06 fix(coverage): index instrumenter-named callbacks and object members for the ...
• b7722af feat(coverage): report the caller-edge size guard in the inventory blob
• 69d8d81 feat: support positional PATH scope across file commands
• 4b8d691 chore: advance the schema policy baseline to v3.24.1
• 594fccb chore(docker): pin FALLOW_VERSION 3.24.1 with refreshed checksums
• 59ce79f chore(napi): sync package.json / package-lock / index.js to v3.24.1
• c2da9fc chore: release v3.24.1
• 3628395 ci: stop a third-party apt source failing the cross-compile jobs
• Additional commits viewable in compare view

Updates oxfmt from 0.65.0 to 0.67.0

Changelog

Sourced from oxfmt's changelog.

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

... (truncated)

Commits

• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• 9a612d5 chore(deps): update npm packages (#26178)
• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• 5ff57f8 fix(formatter/sort-imports): handle custom side effect groups (#26217)
• 63bc313 chore(npm): update funding URL (#26066)
• See full diff in compare view

Updates oxlint from 1.80.0 to 1.82.0

Release notes

Sourced from oxlint's releases.

oxlint v1.82.0 & oxfmt v0.67.0

Table of Contents

• Oxlint v1.82.0
• Oxfmt v0.67.0

Oxlint v1.82.0

💥 BREAKING CHANGES

• 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

🐛 Bug Fixes

• aa38ddf linter/unicorn/numeric-separators-style: Correct schema defaults (#26393) (camc314)
• 562dd14 jsx-a11y/anchor-has-content: Allow anchors passed as custom component props (#26360) (Mikhail Baev)
• 253cdb2 linter/eslint/id-length: Exempt TS interface/type-literal members with never (#26310) (Pearce Ropion)
• 8c7ea76 ast_visit: Account for trimmed source offsets (#26223) (Cameron)
• 5f9cffc linter/typescript/no-explicit-any: Fix rest parameter to unknown[] (#26279) (camc314)
• 4de9fa3 linter/react/jsx-no-literals: Check nested JSX expression literals (#26253) (camc314)
• 07851b9 parser: Fix debug assert failure when lexer error with tokens enabled (#26229) (overlookmotel)
• 9cee146 oxlint/lsp: Don't try to parse fix message, always fallback (#26204) (Sysix)
• a662c40 linter/eslint/no-useless-assignment: Handle destructuring assignments (#25925) (camc314)
• 304bd9a linter/eslint/no-array-constructor: Handle ASI hazards in fixer (#26166) (Hamody We)
• b41bb35 linter: Qualify rules in rules output (#26250) (camc314)
• 895c685 linter/typescript/no-extraneous-class: Avoid deleting class expressions (#26231) (camc314)
• 4ba33c8 linter/eslint/no-unused-vars: Handle stored arrow references (#26225) (camc314)

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

Oxfmt v0.67.0

💥 BREAKING CHANGES

• 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)
• 2c9a947 parser: [BREAKING] Reduce MAX_LEN to 256 bytes below u32::MAX (#26352) (overlookmotel)

🚀 Features

• 68e12ab formatter_css: Follow the oxc-css-parser's acceptance line (#26337) (leaysgur)

🐛 Bug Fixes

• f7acdc0 formatter: Treat a JSDoc cast target as opaque in chain layouts (#26375) (leaysgur)
• 104061b formatter: Keep JSDoc cast parens with a comment inside them (#26374) (leaysgur)
• 3d00a76 formatter_css: Keep comment inside important and simple-vars colon (#26370) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

• 5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

• 9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

... (truncated)

Commits

• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
• 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
• 63bc313 chore(npm): update funding URL (#26066)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codspeed]

Merging this PR will improve performance by 10.11%

⚡ 1 improved benchmark
✅ 187 untouched benchmarks
⏩ 77 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	lookup_single_original_position_for	1.2 µs	1.1 µs	+10.11%

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/npm_and_yarn/js-tooling-db5eff7750 (ea0d8cb) with main (f7baba3)}

Footnotes

1. 77 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩