chore: bump the js-tooling group with 3 updates

[dependabot]

Bumps the js-tooling group with 3 updates: fallow, oxfmt and oxlint.

Updates fallow from 3.16.0 to 3.17.0

Release notes

Sourced from fallow's releases.

v3.17.0: Type-aware CI output and Windows reliability

Type-aware analysis is easier to use in CI, more accurate around ambiguous exports, and more reliable across platforms.

Highlights

• Type-aware results render directly in CI: check and audit now support pr-comment-github, pr-comment-gitlab, review-github, and review-gitlab. fallow report --from <results.json> supports the same formats while preserving audit conclusions, semantic completeness, diff positions, ownership groups, and repository path prefixes. Required incomplete analysis fails closed. Thanks @​Jerc92 for #2272.
• Type-aware analysis starts reliably from npm and VS Code on Windows: the npm launcher uses Node for the companion, the VSIX includes every supported native semantic backend, and native child processes stay hidden without weakening process-tree cleanup. Thanks @​VariableVince for reporting #2284.

Accuracy and reliability

• Ambiguous export * collisions no longer blame contributing source files: Fallow suppresses ambiguity-attributable unused declaration, unused member, unrendered component, and unprovided injection findings. fallow trace exposes the additive star_export_ambiguity field with the contributing origins and namespaces. #2268, #2283
• External generic constraints stay bounded: type-aware public-signature scans avoid expanding complete external structural graphs while preserving project-local constraint edges. Unsupported Svelte virtual-module exports now fail closed with the stable svelte-virtual-module-exports reason instead of claiming complete evidence. Thanks @​cmoyates for the detailed reports behind #2271.
• Action binary verification has a hard deadline: the bundled Action supervises verification from a file, preserves normal exit statuses, and returns status 124 with one focused workflow error on timeout. Thanks @​Jonathangadeaharder for reporting #2273.

Performance

• Duplicate spread calculation, local type extraction, named-export indexing, and JSON root serialization now avoid unnecessary sorting, allocation, and copying. #2266, #2267, #2281, #2282

Compatibility

• Strict machine-readable consumers should update for type-aware wire protocol 7 and semantic schema 3. Every versioned JSON root that can embed this contract has a corresponding schema-version bump. Unversioned trace and inspect roots remain unchanged. Regenerate validators from the current output schema.

Full Changelog: fallow-rs/fallow@v3.16.0...v3.17.0

Commits

• ecf5a31 fix(release): install Windows platform candidate
• e08e3e0 chore: release v3.17.0
• 7e8519b fix: start type-aware reliably on Windows
• 78632bb feat(ci): render type-aware feedback from saved results
• 8437d52 fix: close analysis and audit follow-ups
• 4084184 perf(extract): deduplicate local type declarations once
• 7a84424 perf(types): bucket clone spread locations
• e6a86ac fix(action): bound installed binary verification
• f66e6e8 ci(benchmarks): add round five walltime suites
• 6ab2c84 fix(type-aware): bound generic scans and identify Svelte host gaps
• Additional commits viewable in compare view

Updates oxfmt from 0.63.0 to 0.64.0

Changelog

Sourced from oxfmt's changelog.

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

• 43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

... (truncated)

Commits

• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• c07fe7c feat(oxfmt): support experimentalOperatorPosition (#25643)
• fed6681 docs(oxfmt): skip expanding overrides options (#25572)
• See full diff in compare view

Updates oxlint from 1.78.0 to 1.79.0

Release notes

Sourced from oxlint's releases.

oxlint v1.79.0 & oxfmt v0.64.0

Table of Contents

• Oxlint v1.79.0
• Oxfmt v0.64.0

Oxlint v1.79.0

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

See React Compiler Support for details.

🚀 Features

• 9b7394e linter/typescript/no-empty-object-type: Implement suggestion (#25833) (Mikhail Baev)

🐛 Bug Fixes

• 345f981 react_compiler: Skip node_modules by default (#25859) (Boshen)
• 2f40afa linter/unicorn/no-array-callback-reference: Ignore effect library imports (#25857) (Michaël Bitard)
• 7b565a0 linter: Align React Compiler rule categories (#25840) (Boshen)
• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• f8e4884 linter/eslint/no-useless-constructor: Allow parameter properties (#25811) (camc314)
• e4b6993 linter: Report exhaustive effect dependencies (#25829) (Boshen)
• 742e25f linter/eslint/no-return-assign: Anchor diagnostic on return stmt (#25803) (camc314)
• b831ca8 react-compiler: Improve derived state diagnostic (#25804) (Boshen)
• 5908c87 linter/jest/prefer-mock-return-shorthand: Preserve implementations using this (#25802) (camc314)
• f6b2265 linter/eslint/no-redeclare: Run in ES modules, skipping only the globals check (#25691) (Hamody We)
• ca9f553 linter/unicorn/prefer-default-parameters: Mark fixer as a suggestion (#25801) (camc314)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• d5483f8 linter/typescript/no-useless-empty-export: Skip TS declaration files (#25789) (Evyatar Daud)
• 57f2199 linter/typescript/no-useless-empty-export: Report after imports (#25786) (camc314)
• 633bc19 linter/typescript/no-unnecessary-type-conversion: Mark fixer as suggestion (#25787) (camc314)
• dea3339 linter/typescript/explicit-module-boundary-types: Anchor diagnostics on arrows (#25779) (camc314)
• 5cd6f02 linter/eslint/array-callback-return: Anchor diagnostic on callback (#25780) (camc314)
• ef8cebf linter/eslint/preserve-caught-error: Handle AggregateError options (#25775) (camc314)
• c108d5c linter: Improve React Compiler diagnostics (#25742) (Boshen)
• c9ec55e react-compiler: Improve diagnostic spans (#25731) (Boshen)
• 1cbbcb7 linter/unicorn/prefer-string-replace-all: Apply fixes in one pass (#25709) (Mikhail Baev)
• dec0a86 react-compiler: Standardize diagnostics (#25702) (Boshen)
• 5fd77f7 linter/react/display-name: Report curried HOC inner component (#25662) (camc314)
• 4dbb80e linter/import/no-named-as-default: Report local export conflicts (#25658) (camc314)
• e8a7214 linter/react/rules-of-hooks: Report hooks inside try blocks (#25670) (camc314)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• d901d24 linter/react/exhaustive-deps: Handle destructured object dependencies (#25669) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• fa36f26 linter/react/no-this-in-sfc: Detect this in nested arrow callbacks (#25653) (camc314)
• 44d1be3 linter/typescript/no-var-requires: Run rule on JavaScript (#25664) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

Commits

• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
• aa49d86 fix(linter): allow spread rule options in config types (#25675)
• 8922381 refactor(linter): remove inactive react config rule (#25740)
• 8c4552d feat(linter)!: split react/react-compiler into per-category rules (#25500)
• 36f8451 fix(linter/eslint/no-eval): align indirect default with ESLint (#25656)
• beb724d fix(linter/eslint/no-unused-vars): report bare underscore parameters (#25663)
• 4004c10 fix(linter/eslint/no-irregular-whitespace): check comments by default (#25660)
• 285820e fix(linter/no-large-snapshots): precompile and document allowed snapshot matc...
• 4df5835 fix(linter): allow capitalized built-in calls (#25516)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codspeed-hq]

Merging this PR will not alter performance

✅ 188 untouched benchmarks
⏩ 76 skipped benchmarks¹

---

_{Comparing dependabot/npm_and_yarn/js-tooling-faa642d709 (4674263) with main (2839d36)}

Footnotes

1. 76 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩