fallow 2.72.0 → 2.74.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.72.0",
+  "version": "2.74.0",
   "description": "Codebase intelligence for TypeScript and JavaScript. Finds unused code, duplication, circular dependencies, complexity hotspots, and architecture drift. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 94 framework plugins.",
   "license": "MIT",
   "repository": {
@@ -73,13 +73,13 @@
     "@tanstack/intent": "0.0.40"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.72.0",
-    "@fallow-cli/darwin-x64": "2.72.0",
-    "@fallow-cli/linux-x64-gnu": "2.72.0",
-    "@fallow-cli/linux-arm64-gnu": "2.72.0",
-    "@fallow-cli/linux-x64-musl": "2.72.0",
-    "@fallow-cli/linux-arm64-musl": "2.72.0",
-    "@fallow-cli/win32-arm64-msvc": "2.72.0",
-    "@fallow-cli/win32-x64-msvc": "2.72.0"
+    "@fallow-cli/darwin-arm64": "2.74.0",
+    "@fallow-cli/darwin-x64": "2.74.0",
+    "@fallow-cli/linux-x64-gnu": "2.74.0",
+    "@fallow-cli/linux-arm64-gnu": "2.74.0",
+    "@fallow-cli/linux-x64-musl": "2.74.0",
+    "@fallow-cli/linux-arm64-musl": "2.74.0",
+    "@fallow-cli/win32-arm64-msvc": "2.74.0",
+    "@fallow-cli/win32-x64-msvc": "2.74.0"
   }
 }

package/schema.json

@@ -79,6 +79,13 @@
         "$ref": "#/$defs/IgnoreCatalogReferenceRule"
       }
     },
+    "ignoreDependencyOverrides": {
+      "description": "Rules for suppressing `unused-dependency-override` and\n`misconfigured-dependency-override` findings.\n\nEach rule matches by override target package, optionally scoped to the\ndeclaring source file (`pnpm-workspace.yaml` or `package.json`). Useful\nfor overrides targeting purely-transitive packages (CVE-fix pattern)\nwhere the conservative static algorithm would otherwise cry wolf.",
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/IgnoreDependencyOverrideRule"
+      }
+    },
     "ignoreExportsUsedInFile": {
       "description": "Suppress unused-export findings when the exported symbol is referenced\ninside the file that declares it. This mirrors Knip's\n`ignoreExportsUsedInFile` option while still reporting exports that have\nno references at all.",
       "$ref": "#/$defs/IgnoreExportsUsedInFileConfig",
@@ -158,7 +165,10 @@
         "feature-flags": "off",
         "stale-suppressions": "warn",
         "unused-catalog-entries": "warn",
-        "unresolved-catalog-references": "error"
+        "empty-catalog-groups": "warn",
+        "unresolved-catalog-references": "error",
+        "unused-dependency-overrides": "warn",
+        "misconfigured-dependency-overrides": "error"
       }
     },
     "boundaries": {
@@ -566,6 +576,27 @@
         "package"
       ]
     },
+    "IgnoreDependencyOverrideRule": {
+      "description": "Rule for suppressing an `unused-dependency-override` or\n`misconfigured-dependency-override` finding.\n\nA finding is suppressed when ALL provided fields match the finding:\n- `package` matches the override's target package name exactly\n  (case-sensitive). For parent-chain overrides (`react>react-dom`), the\n  target is the rightmost segment (`react-dom`).\n- `source`, if set, scopes the suppression to overrides declared in that\n  source file. Accepts `\"pnpm-workspace.yaml\"` or `\"package.json\"`.\n  When omitted, both sources match.\n\nTypical use cases:\n- Library-internal CI tooling overrides we cannot drop yet\n- Overrides targeting purely-transitive packages (CVE-fix pattern)",
+      "type": "object",
+      "properties": {
+        "package": {
+          "description": "Override target package name (exact match; case-sensitive).",
+          "type": "string"
+        },
+        "source": {
+          "description": "Source file scope: `\"pnpm-workspace.yaml\"` or `\"package.json\"`.\n`None` matches both sources.",
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "package"
+      ]
+    },
     "IgnoreExportsUsedInFileConfig": {
       "description": "Controls whether exports referenced only inside their defining file are\nreported as unused exports.",
       "anyOf": [
@@ -923,9 +954,21 @@
           "$ref": "#/$defs/Severity",
           "default": "warn"
         },
+        "empty-catalog-groups": {
+          "$ref": "#/$defs/Severity",
+          "default": "warn"
+        },
         "unresolved-catalog-references": {
           "$ref": "#/$defs/Severity",
           "default": "error"
+        },
+        "unused-dependency-overrides": {
+          "$ref": "#/$defs/Severity",
+          "default": "warn"
+        },
+        "misconfigured-dependency-overrides": {
+          "$ref": "#/$defs/Severity",
+          "default": "error"
         }
       }
     },
@@ -1001,7 +1044,7 @@
           "const": "feature-sliced"
         },
         {
-          "description": "Bulletproof React: app → features → shared + server.\nFeature modules are isolated from each other; shared utilities and server\ninfrastructure form the base layers.",
+          "description": "Bulletproof React: app → features → shared + server.\nFeature modules are isolated from each other via `autoDiscover`: every\nimmediate child of `src/features/` becomes its own `features/<name>` zone,\nand cross-feature imports are reported as boundary violations.\n\n**Trade-off (intentional):** top-level files in `src/features/` (e.g.\n`src/features/index.ts` barrel, `src/features/types.ts`) do NOT match any\nchild pattern and are unclassified, meaning they are unrestricted by the\npreset. This is deliberate so feature barrels can re-export children\nwithout producing false-positive `features → features/<child>` violations.\nTo classify top-level files strictly, override the `features` zone with\nan explicit user definition that includes a `patterns` field.",
           "type": "string",
           "const": "bulletproof"
         }
@@ -1022,6 +1065,13 @@
             "type": "string"
           }
         },
+        "autoDiscover": {
+          "description": "Directories whose immediate child directories should become separate\nzones under this logical group.\n\nFor example, `{ \"name\": \"features\", \"autoDiscover\": [\"src/features\"] }`\ncreates zones such as `features/auth` and `features/billing`, each with\na pattern for its own subtree. Rules that reference `features` expand to\nevery discovered child zone. If `patterns` is also set, the parent zone\nremains as a fallback after discovered child zones.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "root": {
           "description": "Optional subtree scope for monorepo per-package boundaries.\n\nWhen set, the zone's `patterns` are matched against paths *relative*\nto this directory rather than the project root. At classification\ntime, fallow checks that a candidate path starts with `root` and\nstrips that prefix before glob-matching the patterns against the\nremainder. Files outside the subtree never match the zone.\n\nUseful for monorepos where each package has the same internal\ndirectory layout: instead of writing `packages/app/src/**` and\n`packages/core/src/**` (which collide on shared zone names), set\n`root: \"packages/app/\"` and `patterns: [\"src/**\"]` per package.\n\nTrailing slash and leading `./` are normalized; backslashes are\nconverted to forward slashes. Patterns must NOT redundantly include\nthe root prefix: `root: \"packages/app/\"` with\n`patterns: [\"packages/app/src/**\"]` is rejected with\n`FALLOW-BOUNDARY-ROOT-REDUNDANT-PREFIX` because patterns are\nresolved relative to the root.",
           "type": [
@@ -1031,8 +1081,7 @@
         }
       },
       "required": [
-        "name",
-        "patterns"
+        "name"
       ]
     },
     "BoundaryRule": {
@@ -1381,6 +1430,16 @@
             }
           ]
         },
+        "empty-catalog-groups": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "unresolved-catalog-references": {
           "anyOf": [
             {
@@ -1390,6 +1449,26 @@
               "type": "null"
             }
           ]
+        },
+        "unused-dependency-overrides": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "misconfigured-dependency-overrides": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
         }
       }
     },

package/skills/fallow/SKILL.md

@@ -100,6 +100,8 @@ cargo install fallow-cli        # build from source
 | Test-only dependencies | n/a | Production deps only imported from test files (should be devDependencies) |
 | Unused pnpm catalog entries | `--unused-catalog-entries` | `pnpm-workspace.yaml` entries no workspace package.json references via `catalog:` (default `warn`) |
 | Unresolved pnpm catalog references | `--unresolved-catalog-references` | `package.json` references to `catalog:` / `catalog:<name>` whose catalog does not declare the package; `pnpm install` would fail. Default `error`. Suppress via `ignoreCatalogReferences: [{ package, catalog?, consumer? }]` in fallow config (package.json has no comment syntax). |
+| Unused pnpm dependency overrides | `--unused-dependency-overrides` | `pnpm-workspace.yaml#overrides` / `package.json#pnpm.overrides` entries forcing a version no workspace package depends on. Default `warn`; the `hint` field flags entries that may be intentional pins for transitive CVEs. Suppress via `ignoreDependencyOverrides: [{ package, source? }]` in fallow config. |
+| Misconfigured pnpm dependency overrides | `--misconfigured-dependency-overrides` | `pnpm.overrides` entries whose key is unparsable (empty, dangling separators, malformed selectors) or value is missing/empty. `pnpm install` would fail. Default `error`. Suppression: same `ignoreDependencyOverrides` config rule. |
 
 ## MCP Tools
 
@@ -109,7 +111,7 @@ When using fallow via MCP (`fallow-mcp`), the following tools are available:
 |------|-------------|
 | `analyze` | Full dead code analysis (unused files/exports/types/dependencies/members + circular dependencies + boundary violations + stale suppressions). Private type leaks are an opt-in API hygiene check via `issue_types: ["private-type-leaks"]`. Set `boundary_violations: true` as a convenience alias for `issue_types: ["boundary-violations"]`. Set `group_by` to `"owner"`, `"directory"`, `"package"`, or `"section"` to partition results. The `section` mode reads GitLab CODEOWNERS `[Section]` headers and emits `owners` metadata per group |
 | `check_changed` | Incremental analysis of files changed since a git ref |
-| `find_dupes` | Code duplication detection. Set `changed_since` to scope to changed files since a git ref |
+| `find_dupes` | Code duplication detection. Set `changed_since` to scope to changed files since a git ref. Set `min_occurrences` (≥ 2, default 2) to hide pair-only clones and focus on widespread copy-paste; JSON gains `stats.clone_groups_below_min_occurrences` when the filter hides anything |
 | `fix_preview` | Dry-run auto-fix preview |
 | `fix_apply` | Apply auto-fixes (destructive) |
 | `check_health` | Complexity metrics, health scores, hotspots, and refactoring targets. Set `group_by` to `owner`, `directory`, `package`, or `section` for per-group `vital_signs` / `health_score`; SARIF results gain `properties.group`, CodeClimate issues gain a top-level `group` field |

package/skills/fallow/references/cli-reference.md

@@ -138,10 +138,11 @@ By default, `fallow dupes` skips generated framework output matching `**/.next/*
 |------|------|---------|-------------|
 | `--format` | `human\|json\|sarif\|compact\|markdown\|codeclimate\|gitlab-codequality\|pr-comment-github\|pr-comment-gitlab\|review-github\|review-gitlab` | `human` | Output format |
 | `--quiet` | bool | `false` | Suppress progress bars |
-| `--top` | number | — | Show only the N largest clone groups (sorted by line count descending). Summary stats reflect the full project. |
+| `--top` | number | — | Show only the N most-duplicated clone groups (sorted by instance count desc, tiebreak: line count desc, then path/line). Summary stats reflect the full project. |
 | `--mode` | `strict\|mild\|weak\|semantic` | `mild` | Detection mode |
 | `--min-tokens` | number | `50` | Minimum token count for a clone |
 | `--min-lines` | number | `5` | Minimum line count for a clone |
+| `--min-occurrences` | number | `2` | Minimum number of occurrences before a clone group is reported (must be ≥ 2). Raise to skip pair-only clones and focus on widespread copy-paste worth refactoring. `fallow init` writes `minOccurrences: 3` into new projects. |
 | `--threshold` | number | `0` | Fail if duplication exceeds this percentage |
 | `--skip-local` | bool | `false` | Only report cross-directory duplicates |
 | `--cross-language` | bool | `false` | Strip type annotations for TS↔JS matching |
@@ -191,7 +192,7 @@ fallow dupes --format json --quiet --baseline fallow-baselines/dupes.json --thre
 
 ## `fix`: Auto-Remove Unused Code
 
-Auto-removes unused exports and dependencies.
+Auto-removes unused exports, dependencies, enum members, and pnpm catalog entries.
 
 ### Flags
 
@@ -203,6 +204,13 @@ Auto-removes unused exports and dependencies.
 | `--format` | `human\|json` | `human` | Output format |
 | `--quiet` | bool | `false` | Suppress progress bars |
 
+### What gets fixed
+
+- Unused exports (removes the `export` keyword; whole-enum block when every member is unused)
+- Unused dependencies (removed from `package.json`)
+- Unused enum members (removed from the declaration)
+- Unused pnpm catalog entries (removed from `pnpm-workspace.yaml` by line-aware deletion; comments preserved). When the last entry of a catalog group is removed, the header is rewritten to `catalog: {}` / `<name>: {}` so pnpm doesn't reject the resulting null value. Entries with non-empty `hardcoded_consumers` are skipped to avoid breaking `pnpm install`; the skip is surfaced in the JSON fix output as `{"type": "remove_catalog_entry", "applied": false, "skipped": true, "skip_reason": "hardcoded_consumers", "consumers": [...]}`. After a successful catalog edit the CLI emits a one-line `Run pnpm install to refresh pnpm-lock.yaml` reminder. The JSON envelope carries a top-level `"skipped"` count alongside `"total_fixed"` for partial-fix gating.
+
 ### Examples
 
 ```bash
@@ -424,7 +432,7 @@ fallow health --format json --quiet --trend
 ```json
 {
   "schema_version": 3,
-  "version": "2.71.1",
+  "version": "2.73.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -810,7 +818,7 @@ fallow audit \
 ```json
 {
   "schema_version": 3,
-  "version": "2.71.1",
+  "version": "2.73.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -883,7 +891,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 3,
-  "version": "2.71.1",
+  "version": "2.73.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1302,7 +1310,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 ```json
 {
   "schema_version": 3,
-  "version": "2.71.1",
+  "version": "2.73.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1449,7 +1457,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 ```json
 {
   "schema_version": 3,
-  "version": "2.71.1",
+  "version": "2.73.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -1493,7 +1501,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "check": {
     "schema_version": 3,
-    "version": "2.71.1",
+    "version": "2.73.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],
@@ -1515,7 +1523,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
   },
   "dupes": {
     "schema_version": 3,
-    "version": "2.71.1",
+    "version": "2.73.0",
     "elapsed_ms": 82,
     "total_clones": 15,
     "total_lines_duplicated": 230,
@@ -1524,7 +1532,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
   },
   "health": {
     "schema_version": 3,
-    "version": "2.71.1",
+    "version": "2.73.0",
     "elapsed_ms": 32,
     "summary": {},
     "findings": [],

package/types/output-contract.d.ts

@@ -117,10 +117,22 @@ stale_suppressions: StaleSuppression[]
  * Entries in pnpm-workspace.yaml's catalog: or catalogs: sections not referenced by any workspace package via the catalog: protocol.
  */
 unused_catalog_entries?: UnusedCatalogEntry[]
+/**
+ * Named groups under pnpm-workspace.yaml's catalogs: section that declare no package entries. The top-level catalog: map is not reported.
+ */
+empty_catalog_groups?: EmptyCatalogGroup[]
 /**
  * Workspace package.json references to catalogs (catalog: or catalog:<name>) that do not declare the consumed package. pnpm install will error until the named catalog grows to include the package or the reference is switched / removed.
  */
 unresolved_catalog_references?: UnresolvedCatalogReference[]
+/**
+ * Entries in pnpm-workspace.yaml's overrides: section, or package.json's pnpm.overrides block, whose target package is not declared by any workspace package and is not present in pnpm-lock.yaml. Default severity is warn because projects without a readable lockfile fall back to manifest-only checks; the hint field flags those conservative cases.
+ */
+unused_dependency_overrides?: UnusedDependencyOverride[]
+/**
+ * pnpm.overrides entries whose key or value does not parse as a valid override spec (empty key, empty value, malformed selector, unbalanced parent matcher). pnpm install will reject these. Default severity is error.
+ */
+misconfigured_dependency_overrides?: MisconfiguredDependencyOverride[]
 entry_points?: EntryPoints
 summary?: CheckSummary
 baseline_deltas?: BaselineDeltas
@@ -143,7 +155,7 @@ export interface FixAction {
 /**
  * Kebab-case identifier for the fix action.
  */
-type: ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference")
+type: ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override")
 /**
  * Whether `fallow fix` can apply this fix automatically.
  */
@@ -207,9 +219,9 @@ export interface AddToConfigAction {
  */
 type: "add-to-config"
 /**
- * Always false for config actions.
+ * True when `fallow fix` can apply this config action automatically for the current action type. `ignoreExports` duplicate-export actions are auto-fixable when a config file exists; older scalar config-ignore actions remain manual.
  */
-auto_fixable: false
+auto_fixable: boolean
 /**
  * Human-readable description of the config change.
  */
@@ -219,12 +231,14 @@ description: string
  */
 config_key: string
 /**
- * Value to add to the config key. Shape depends on `config_key`. For scalar config keys (`ignoreDependencies`, others) this is a string such as `"lodash"`. For `ignoreExports` this is an array of `{ file, exports }` rule objects so the snippet can be merged into the user's config verbatim.
+ * Value to add to the config key. Shape depends on `config_key`. For scalar config keys (`ignoreDependencies`, others) this is a string such as `"lodash"`. For `ignoreExports` this is an array of `{ file, exports }` rule objects so the snippet can be merged into the user's config verbatim. For `ignoreCatalogReferences` and `ignoreDependencyOverrides` this is an object whose shape matches the rule entry users add to their fallow config.
  */
 value: (string | {
 file: string
 exports: string[]
-}[])
+}[] | {
+
+})
 /**
  * Optional URL pointing at a stable JSON Schema fragment that describes the shape of `value`. Agents that intend to validate `value` before writing it into a user's config can fetch the linked schema and run it against `value`. The URL is a JSON Pointer fragment into fallow's main config schema (e.g. `schema.json#/properties/ignoreExports` for the ignoreExports action, or `schema.json#/properties/ignoreDependencies/items` for the per-package ignoreDependencies action). Strictly additive: consumers that ignore the field keep working unchanged.
  */
@@ -594,6 +608,25 @@ hardcoded_consumers?: string[]
 actions?: IssueAction[]
 introduced?: AuditIntroduced
 }
+/**
+ * A named pnpm catalog group under catalogs: with no package entries.
+ */
+export interface EmptyCatalogGroup {
+/**
+ * Named catalog group under the top-level catalogs: map.
+ */
+catalog_name: string
+/**
+ * Relative path to pnpm-workspace.yaml.
+ */
+path: string
+/**
+ * 1-based line number of the empty catalog group header.
+ */
+line: number
+actions?: IssueAction[]
+introduced?: AuditIntroduced
+}
 /**
  * A workspace package.json reference (catalog: or catalog:<name>) pointing at a catalog that does not declare the consumed package. `pnpm install` will fail with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_CATALOG_PROTOCOL.
  */
@@ -621,6 +654,80 @@ available_in_catalogs?: string[]
 actions?: IssueAction[]
 introduced?: AuditIntroduced
 }
+/**
+ * A pnpm.overrides entry whose target package is not declared in any workspace package.json (directly or as a declared parent in a parent>child override). May still be intentional for a transitive CVE pin; see `hint`.
+ */
+export interface UnusedDependencyOverride {
+/**
+ * Full original override key as written (e.g. 'react>react-dom', '@types/react@<18').
+ */
+raw_key: string
+/**
+ * Target package the override rewrites (rightmost segment for parent>child keys).
+ */
+target_package: string
+/**
+ * Optional parent package (left side of `>`). Omitted for bare-target keys.
+ */
+parent_package?: string
+/**
+ * Optional version selector on the target (e.g. '<18' for '@types/react@<18'). Omitted when absent.
+ */
+version_constraint?: string
+/**
+ * Right-hand side of the entry: the version pnpm should force.
+ */
+version_range: string
+/**
+ * File the override was declared in. Matches the value users write in `ignoreDependencyOverrides[].source`.
+ */
+source: ("pnpm-workspace.yaml" | "package.json")
+/**
+ * Relative path to the source file.
+ */
+path: string
+/**
+ * 1-based line number of the entry.
+ */
+line: number
+/**
+ * Soft hint reminding consumers to verify the override before removal. Present because projects without a readable lockfile use the conservative package-manifest fallback. Omitted when absent.
+ */
+hint?: string
+actions?: IssueAction[]
+introduced?: AuditIntroduced
+}
+/**
+ * A pnpm.overrides entry whose key or value does not parse as a valid pnpm override spec. `pnpm install` will reject these.
+ */
+export interface MisconfiguredDependencyOverride {
+/**
+ * Full original override key as written.
+ */
+raw_key: string
+/**
+ * Right-hand side of the entry, exactly as written. Empty when the value was missing.
+ */
+raw_value: string
+/**
+ * Classifier for the misconfiguration. 'unparsable-key' = the key is not a valid pnpm shape; 'empty-value' = the value is missing, empty, or contains line breaks.
+ */
+reason: ("unparsable-key" | "empty-value")
+/**
+ * File the override was declared in.
+ */
+source: ("pnpm-workspace.yaml" | "package.json")
+/**
+ * Relative path to the source file.
+ */
+path: string
+/**
+ * 1-based line number of the entry.
+ */
+line: number
+actions?: IssueAction[]
+introduced?: AuditIntroduced
+}
 /**
  * Entry point detection summary showing total detected entry points and their sources.
  */
@@ -655,7 +762,10 @@ circular_dependencies?: number
 boundary_violations?: number
 stale_suppressions?: number
 unused_catalog_entries?: number
+empty_catalog_groups?: number
 unresolved_catalog_references?: number
+unused_dependency_overrides?: number
+misconfigured_dependency_overrides?: number
 }
 /**
  * Per-category delta comparison against a saved baseline. Shows current count, baseline count, and delta for each category.