fallow 2.74.0 → 2.75.0

package/README.md

@@ -75,7 +75,7 @@ fallow dupes --save-baseline       # Save current duplication as baseline
 
 ## Framework support
 
-94 built-in plugins covering Next.js, Nuxt, Remix, Qwik, SvelteKit, Gatsby, Astro, Angular, NestJS, Expo Router, Vite, Webpack, Vitest, Jest, Playwright, Cypress, Storybook, ESLint, TypeScript, Tailwind, UnoCSS, Prisma, Drizzle, Convex, Turborepo, Hardhat, and many more. Auto-detected from your `package.json`.
+95 built-in plugins covering Next.js, Nuxt, Remix, Qwik, SvelteKit, Gatsby, Astro, Angular, NestJS, AdonisJS, Expo Router, Vite, Webpack, Vitest, Jest, Playwright, Cypress, Storybook, ESLint, TypeScript, Tailwind, UnoCSS, Prisma, Drizzle, Convex, Turborepo, Hardhat, and many more. Auto-detected from your `package.json`.
 
 ## Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.74.0",
+  "version": "2.75.0",
   "description": "Codebase intelligence for TypeScript and JavaScript. Finds unused code, duplication, circular dependencies, complexity hotspots, and architecture drift. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 94 framework plugins.",
   "license": "MIT",
   "repository": {
@@ -73,13 +73,13 @@
     "@tanstack/intent": "0.0.40"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.74.0",
-    "@fallow-cli/darwin-x64": "2.74.0",
-    "@fallow-cli/linux-x64-gnu": "2.74.0",
-    "@fallow-cli/linux-arm64-gnu": "2.74.0",
-    "@fallow-cli/linux-x64-musl": "2.74.0",
-    "@fallow-cli/linux-arm64-musl": "2.74.0",
-    "@fallow-cli/win32-arm64-msvc": "2.74.0",
-    "@fallow-cli/win32-x64-msvc": "2.74.0"
+    "@fallow-cli/darwin-arm64": "2.75.0",
+    "@fallow-cli/darwin-x64": "2.75.0",
+    "@fallow-cli/linux-x64-gnu": "2.75.0",
+    "@fallow-cli/linux-arm64-gnu": "2.75.0",
+    "@fallow-cli/linux-x64-musl": "2.75.0",
+    "@fallow-cli/linux-arm64-musl": "2.75.0",
+    "@fallow-cli/win32-arm64-msvc": "2.75.0",
+    "@fallow-cli/win32-x64-msvc": "2.75.0"
   }
 }

package/skills/fallow/SKILL.md

@@ -95,12 +95,13 @@ cargo install fallow-cli        # build from source
 | Unlisted dependencies | `--unlisted-deps` | Used packages missing from package.json. In monorepos, importing a workspace package from a workspace whose own `package.json` does not list it is reported here too; self-references stay allowed without requiring a package to depend on itself. |
 | Duplicate exports | `--duplicate-exports` | Same symbol exported from multiple modules |
 | Circular dependencies | `--circular-deps` | Import cycles in the module graph |
-| Boundary violations | `--boundary-violations` | Imports crossing architecture zone boundaries. Presets: `layered`, `hexagonal`, `feature-sliced`, `bulletproof` |
+| Boundary violations | `--boundary-violations` | Imports crossing architecture zone boundaries. Presets: `layered`, `hexagonal`, `feature-sliced`, `bulletproof`; `autoDiscover` can create one zone per feature directory |
 | Stale suppressions | `--stale-suppressions` | `fallow-ignore` comments or `@expected-unused` JSDoc tags that no longer match any issue |
 | Test-only dependencies | n/a | Production deps only imported from test files (should be devDependencies) |
 | Unused pnpm catalog entries | `--unused-catalog-entries` | `pnpm-workspace.yaml` entries no workspace package.json references via `catalog:` (default `warn`) |
+| Empty pnpm catalog groups | `--empty-catalog-groups` | Named `catalogs.<name>:` groups in `pnpm-workspace.yaml` with no entries. Top-level `catalog:` placeholders are ignored. Default `warn`. |
 | Unresolved pnpm catalog references | `--unresolved-catalog-references` | `package.json` references to `catalog:` / `catalog:<name>` whose catalog does not declare the package; `pnpm install` would fail. Default `error`. Suppress via `ignoreCatalogReferences: [{ package, catalog?, consumer? }]` in fallow config (package.json has no comment syntax). |
-| Unused pnpm dependency overrides | `--unused-dependency-overrides` | `pnpm-workspace.yaml#overrides` / `package.json#pnpm.overrides` entries forcing a version no workspace package depends on. Default `warn`; the `hint` field flags entries that may be intentional pins for transitive CVEs. Suppress via `ignoreDependencyOverrides: [{ package, source? }]` in fallow config. |
+| Unused pnpm dependency overrides | `--unused-dependency-overrides` | `pnpm-workspace.yaml#overrides` / `package.json#pnpm.overrides` entries whose target package is not declared by any workspace `package.json` and is not present in `pnpm-lock.yaml`. Default `warn`. When the lockfile is missing or unreadable the check degrades to a manifest-only fallback and every finding carries a `hint` reminding consumers to verify before removal. Suppress via `ignoreDependencyOverrides: [{ package, source? }]` in fallow config. |
 | Misconfigured pnpm dependency overrides | `--misconfigured-dependency-overrides` | `pnpm.overrides` entries whose key is unparsable (empty, dangling separators, malformed selectors) or value is missing/empty. `pnpm install` would fail. Default `error`. Suppression: same `ignoreDependencyOverrides` config rule. |
 
 ## MCP Tools

package/skills/fallow/references/cli-reference.md

@@ -72,6 +72,11 @@ Analyzes the project for unused files, exports, dependencies, types, members, an
 | `--circular-deps` | Circular dependencies |
 | `--boundary-violations` | Boundary violations (imports crossing architecture zone boundaries) |
 | `--stale-suppressions` | Stale suppression comments or `@expected-unused` JSDoc tags |
+| `--unused-catalog-entries` | Unused pnpm catalog entries |
+| `--empty-catalog-groups` | Empty named pnpm catalog groups |
+| `--unresolved-catalog-references` | Package references to missing pnpm catalog entries |
+| `--unused-dependency-overrides` | Unused pnpm dependency overrides |
+| `--misconfigured-dependency-overrides` | Malformed pnpm dependency overrides |
 
 ### Examples
 
@@ -432,7 +437,7 @@ fallow health --format json --quiet --trend
 ```json
 {
   "schema_version": 3,
-  "version": "2.73.0",
+  "version": "2.74.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -818,7 +823,7 @@ fallow audit \
 ```json
 {
   "schema_version": 3,
-  "version": "2.73.0",
+  "version": "2.74.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -891,7 +896,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 3,
-  "version": "2.73.0",
+  "version": "2.74.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1310,7 +1315,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 ```json
 {
   "schema_version": 3,
-  "version": "2.73.0",
+  "version": "2.74.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1457,7 +1462,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 ```json
 {
   "schema_version": 3,
-  "version": "2.73.0",
+  "version": "2.74.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -1501,7 +1506,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "check": {
     "schema_version": 3,
-    "version": "2.73.0",
+    "version": "2.74.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],
@@ -1523,7 +1528,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
   },
   "dupes": {
     "schema_version": 3,
-    "version": "2.73.0",
+    "version": "2.74.0",
     "elapsed_ms": 82,
     "total_clones": 15,
     "total_lines_duplicated": 230,
@@ -1532,7 +1537,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
   },
   "health": {
     "schema_version": 3,
-    "version": "2.73.0",
+    "version": "2.74.0",
     "elapsed_ms": 32,
     "summary": {},
     "findings": [],
@@ -1614,10 +1619,20 @@ Config files are searched in priority order: `.fallowrc.json` > `.fallowrc.jsonc
     "ignorePatterns": ["**/*.generated.ts"]
   },
 
-  // Architecture boundaries (preset or custom zones/rules)
+  // Architecture boundaries (preset, custom zones/rules, or auto-discovered feature zones)
   // Presets: "layered", "hexagonal", "feature-sliced", "bulletproof"
   "boundaries": {
     "preset": "bulletproof"
+    // Or:
+    // "zones": [
+    //   { "name": "app", "patterns": ["src/app/**"] },
+    //   { "name": "features", "autoDiscover": ["src/features"] },
+    //   { "name": "shared", "patterns": ["src/shared/**"] }
+    // ],
+    // "rules": [
+    //   { "from": "app", "allow": ["features", "shared"] },
+    //   { "from": "features", "allow": ["shared"] }
+    // ]
   },
 
   // Production mode