chore(deps): bump fallow-rs/fallow from 2 to 3
Imported from GitHub pull request El-SaMa/hollahoop#93 by @dependabot[bot].
Bumps fallow-rs/fallow from 2 to 3.
<details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fallow-rs/fallow/releases">fallow-rs/fallow's releases</a>.</em></p> <blockquote> <h2>v3.0.0: new brand, styling audit, rule packs, and architecture guard</h2> <h2>Fallow 3.0</h2> <p><strong>Your code-health gate now reviews your styles. Same PR, same JSON, no new tool.</strong></p> <p>Fallow 3.0 is a major release for one reason: <code>fallow audit</code>, the gate that already reviews your TypeScript and JavaScript, now reviews your CSS and CSS-in-JS in the same PR, in the same JSON stream, with no separate tool and no extra config. That is the change that crossed the version to 3.0.</p> <p>Alongside it: policy-as-code with rule packs, a pre-edit architecture guard, better PR and MR reporting, and a new brand mark.</p> <p><strong>No breaking changes.</strong> CLI flags, configuration, and JSON output contracts are all unchanged. The major bump marks the platform milestone (styling in audit), not a breaking API change. GitHub Action users on <code>@v2</code> should move to <code>@v3</code> to keep receiving releases.</p> <pre lang="bash"><code>npm install -g [email protected] # or npx [email protected] </code></pre> <h3>Styling analysis, now inside <code>fallow audit</code></h3> <p>Run <code>fallow audit</code> on your next PR and styling feedback lands next to your JS and TS findings, in the same JSON. No new command, no new config, no second tool. Findings are verdict-neutral by default: they report, they do not fail the gate. What you get:</p> <ul> <li>Design-system drift and near-duplicate theme tokens</li> <li>Duplicate CSS blocks and selector-complexity hotspots</li> <li>Dead styling surface and broken references</li> <li>Raw one-off values that bypass your tokens</li> </ul> <p>The deep pass scans the project-wide styling surface, then narrows cross-file results back to the anchors the PR touched. A two-file change gets styling feedback scoped to those two files, not a repo-wide dump.</p> <p>Two new findings, <code>css-token-drift</code> and <code>raw-style-value</code>, flag introduced raw values on design-system axes: colors, font sizes, line heights, radii, and shadows. They are low-confidence and verify-first, so they stay off the gate until you opt in:</p> <pre lang="jsonc"><code>// gate on drift once you trust it "rules": { "css-token-drift": "error" } </code></pre> <p>Dialing it back:</p> <ul> <li><code>--no-css</code> (or <code>audit.css: false</code>) disables styling analysis entirely.</li> <li><code>--no-css-deep</code> (or <code>audit.cssDeep: false</code>) keeps the local styling checks and skips only the project-wide reachability pass.</li> </ul> <p>Styling actions are report-only (<code>auto_fixable: false</code>). Agents surface the finding and let you verify and edit by hand, rather than rewriting your styles for you.</p> <h3>Custom rules: policy as code</h3> <p>Encode your architecture in declarative rule packs, enforce them in the same gate, and let agents check the rules before writing a line.</p> <ul> <li><strong>Authoring.</strong> <code>fallow rule-pack init | list | test | schema</code> scaffolds, inspects, and validates policy packs. <code>init</code> drops in a starter or architecture-oriented pack and can wire it straight into your config. <code>list</code> shows loaded packs with their sources, severities, matchers, and messages (human or JSON). <code>test</code> and <code>schema</code> validate a pack before you ship it.</li> <li><strong>V2 matchers.</strong> Scope rules to boundary <code>zones</code>, ban direct exports with <code>banned-export</code>, and use a trailing <code>/*</code> banned-import specifier for subpath-only deep-import bans. Everything reports under one stable <code>policy-violation</code> family, so existing suppressions and CI keep working untouched.</li> <li><strong>A guard that runs before the edit.</strong> <code>fallow guard <files></code> tells you which rules govern a file before a line is written: its boundary zone, allowed import zones, forbidden call patterns, rule-pack rules, effective severities, and suppression tokens. It works on files that do not exist yet, and it is exposed as the read-only MCP <code>guard</code> tool, so an agent can ask "what rules apply here?" and stay inside the lines from the first draft.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fallow-rs/fallow/commit/2b0f0b7283637bd408ae54942452b7468cc68f79"><code>2b0f0b7</code></a> chore: release v3.30.0</li> <li><a href="https://github.com/fallow-rs/fallow/commit/6eef5eb5c0cdddca5dad26cd165f2e309625dff0"><code>6eef5eb</code></a> test: add whole-binary instruction counts and a realistic allocation guard (#...</li> <li><a href="https://github.com/fallow-rs/fallow/commit/19dbc20dcd80ad7b5d313887d0a28e4a4d7491ff"><code>19dbc20</code></a> perf: resolve each specifier once and scan CSS and source maps in linear time...</li> <li><a href="https://github.com/fallow-rs/fallow/commit/35f17b1030d1f89c163a6c1bd222a2327301bd9a"><code>35f17b1</code></a> fix: review follow-ups for the test-path predicate, entry weight and optimiza...</li> <li><a href="https://github.com/fallow-rs/fallow/commit/68889aaa9e4790487459899990934a6bd00f6910"><code>68889aa</code></a> fix(flags): give medium confidence to generic SDK names without a flag import...</li> <li><a href="https://github.com/fallow-rs/fallow/commit/dc159e939c854a8d5b6dd992aa3167104bbc87b5"><code>dc159e9</code></a> fix: pass release validation on Windows (<a href="https://redirect.github.com/fallow-rs/fallow/issues/2929">#2929</a>)</li> <li><a href="https://github.com/fallow-rs/fallow/commit/630b1ddb12376f5355649c16ded0ef0149ba1503"><code>630b1dd</code></a> feat(flags): add vendor state, gates and every format to the retirement repor...</li> <li><a href="https://github.com/fallow-rs/fallow/commit/affac831cd224704f89d9fd58fbce3b99803b851"><code>affac83</code></a> feat(flags): add a per-flag retirement report (<a href="https://redirect.github.com/fallow-rs/fallow/issues/2928">#2928</a>)</li> <li><a href="https://github.com/fallow-rs/fallow/commit/0350e6e8d1207faa2948b9be80f1ae94e2877778"><code>0350e6e</code></a> fix(lsp): reload a kept session when a plugin file or rule pack changes (<a href="https://redirect.github.com/fallow-rs/fallow/issues/2926">#2926</a>)</li> <li><a href="https://github.com/fallow-rs/fallow/commit/ae37ae5988fd9fa53064e67c53ce132cf3a9e487"><code>ae37ae5</code></a> feat(plugins): add built-in Waku plugin (<a href="https://redirect.github.com/fallow-rs/fallow/issues/2921">#2921</a>)</li> <li>Additional commits viewable in <a href="https://github.com/fallow-rs/fallow/compare/v2...v3">compare view</a></li> </ul> </details> <br />Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
<details> <summary>Dependabot commands and options</summary> <br />
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)