fallow 3.29.0 → 3.31.0

package/issue-registry.json

@@ -746,6 +746,45 @@
       "license_note": null,
       "docs_url": "https://docs.fallow.tools/explanations/dead-code#re-export-cycles"
     },
+    {
+      "id": "package-cycle",
+      "rule_id": "fallow/package-cycle",
+      "command": "dead-code",
+      "category": "Architecture",
+      "description": "Two or more workspace packages import each other in a loop",
+      "label": "Package Cycles",
+      "config_key": "package-cycle",
+      "registry_index": 20,
+      "aliases": [
+        "package-cycles"
+      ],
+      "lsp": true,
+      "filter_flag": "--package-cycles",
+      "result_key": "package_cycles",
+      "summary_label": "Package cycles",
+      "summary_docs_anchor": "package-cycles",
+      "sarif_rule_ids": [
+        "fallow/package-cycle"
+      ],
+      "codeclimate_check_names": [
+        "fallow/package-cycle"
+      ],
+      "ts_alias": {
+        "name": "PackageCycle",
+        "parent": "PackageCycleFinding"
+      },
+      "counts_in_total": true,
+      "fixable": false,
+      "suppressible": true,
+      "suppress_comment": "// fallow-ignore-next-line package-cycle",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
+      "note": "Requires a workspace with two or more packages",
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://docs.fallow.tools/explanations/dead-code#package-cycles"
+    },
     {
       "id": "boundary-violation",
       "rule_id": "fallow/boundary-violation",
@@ -754,7 +793,7 @@
       "description": "Import crosses a configured architecture boundary",
       "label": "Boundary Violations",
       "config_key": "boundary-violation",
-      "registry_index": 20,
+      "registry_index": 21,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--boundary-violations",
@@ -791,7 +830,7 @@
       "description": "Source file matches no configured architecture boundary zone",
       "label": "Boundary Coverage",
       "config_key": "boundary-violation",
-      "registry_index": 21,
+      "registry_index": 22,
       "aliases": [
         "boundary-coverage-violations"
       ],
@@ -827,7 +866,7 @@
       "description": "Zoned file calls a callee its zone forbids",
       "label": "Boundary Call Violations",
       "config_key": "boundary-violation",
-      "registry_index": 22,
+      "registry_index": 23,
       "aliases": [
         "boundary-calls",
         "boundary-call-violations"
@@ -864,7 +903,7 @@
       "description": "Banned usage matched a rule-pack rule",
       "label": "Policy Violations",
       "config_key": "policy-violation",
-      "registry_index": 23,
+      "registry_index": 24,
       "aliases": [
         "policy-violations"
       ],
@@ -900,7 +939,7 @@
       "description": "\"use client\" file exports a server-only / route-config name",
       "label": "Invalid Client Exports",
       "config_key": "invalid-client-export",
-      "registry_index": 24,
+      "registry_index": 25,
       "aliases": [
         "invalid-client-exports"
       ],
@@ -938,7 +977,7 @@
       "description": "Barrel re-exports both a \"use client\" module and a server-only module",
       "label": "Mixed Client/Server Barrels",
       "config_key": "mixed-client-server-barrel",
-      "registry_index": 25,
+      "registry_index": 26,
       "aliases": [
         "mixed-client-server-barrels"
       ],
@@ -974,7 +1013,7 @@
       "description": "\"use client\" / \"use server\" directive is not in the leading position and is ignored",
       "label": "Misplaced Directives",
       "config_key": "misplaced-directive",
-      "registry_index": 26,
+      "registry_index": 27,
       "aliases": [
         "misplaced-directives"
       ],
@@ -1010,7 +1049,7 @@
       "description": "inject() / getContext() reads a key that no provide() / setContext() supplies",
       "label": "Unprovided Injects",
       "config_key": "unprovided-injects",
-      "registry_index": 27,
+      "registry_index": 28,
       "aliases": [
         "unprovided-injects"
       ],
@@ -1046,7 +1085,7 @@
       "description": "A Vue / Svelte component is reachable through a barrel but rendered nowhere",
       "label": "Unrendered Components",
       "config_key": "unrendered-components",
-      "registry_index": 28,
+      "registry_index": 29,
       "aliases": [
         "unrendered-components"
       ],
@@ -1082,7 +1121,7 @@
       "description": "A Vue, Svelte, or React component prop is referenced nowhere in its own component",
       "label": "Unused Component Props",
       "config_key": "unused-component-props",
-      "registry_index": 29,
+      "registry_index": 30,
       "aliases": [
         "unused-component-props"
       ],
@@ -1118,7 +1157,7 @@
       "description": "A Vue <script setup> defineEmits event is emitted nowhere in its own component",
       "label": "Unused Component Emits",
       "config_key": "unused-component-emits",
-      "registry_index": 30,
+      "registry_index": 31,
       "aliases": [
         "unused-component-emits"
       ],
@@ -1154,7 +1193,7 @@
       "description": "An Angular @Input() / signal input() / model() input is read nowhere in its own component",
       "label": "Unused Component Inputs",
       "config_key": "unused-component-inputs",
-      "registry_index": 31,
+      "registry_index": 32,
       "aliases": [
         "unused-component-inputs"
       ],
@@ -1190,7 +1229,7 @@
       "description": "An Angular @Output() / signal output() output is emitted nowhere in its own component",
       "label": "Unused Component Outputs",
       "config_key": "unused-component-outputs",
-      "registry_index": 32,
+      "registry_index": 33,
       "aliases": [
         "unused-component-outputs"
       ],
@@ -1226,7 +1265,7 @@
       "description": "A Svelte component dispatches a createEventDispatcher event whose name is listened to nowhere in the project",
       "label": "Unused Svelte Events",
       "config_key": "unused-svelte-events",
-      "registry_index": 33,
+      "registry_index": 34,
       "aliases": [
         "unused-svelte-events"
       ],
@@ -1262,7 +1301,7 @@
       "description": "A Next.js Server Action exported from a \"use server\" file is referenced by no code in the project",
       "label": "Unused Server Actions",
       "config_key": "unused-server-actions",
-      "registry_index": 34,
+      "registry_index": 35,
       "aliases": [
         "unused-server-actions"
       ],
@@ -1298,7 +1337,7 @@
       "description": "A SvelteKit load() return-object key is read by no consumer",
       "label": "Unused Load Data Keys",
       "config_key": "unused-load-data-keys",
-      "registry_index": 35,
+      "registry_index": 36,
       "aliases": [
         "unused-load-data-keys"
       ],
@@ -1334,7 +1373,7 @@
       "description": "Two or more Next.js App Router route files resolve to the same URL",
       "label": "Route Collisions",
       "config_key": "route-collision",
-      "registry_index": 36,
+      "registry_index": 37,
       "aliases": [
         "route-collisions"
       ],
@@ -1372,7 +1411,7 @@
       "description": "Sibling Next.js dynamic route segments use different slug names at the same position",
       "label": "Dynamic Segment Conflicts",
       "config_key": "dynamic-segment-name-conflict",
-      "registry_index": 37,
+      "registry_index": 38,
       "aliases": [
         "dynamic-segment-name-conflicts"
       ],
@@ -1410,7 +1449,7 @@
       "description": "Suppression comment or tag no longer matches any issue",
       "label": "Stale Suppressions",
       "config_key": "stale-suppressions",
-      "registry_index": 38,
+      "registry_index": 39,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--stale-suppressions",
@@ -1446,7 +1485,7 @@
       "description": "Suppression comment omits a required reason",
       "label": "Missing Suppression Reasons",
       "config_key": "require-suppression-reason",
-      "registry_index": 39,
+      "registry_index": 40,
       "aliases": [
         "missing-suppression-reasons"
       ],
@@ -1478,7 +1517,7 @@
       "description": "Catalog entry not referenced by any workspace package",
       "label": "Unused Catalog Entries",
       "config_key": "unused-catalog-entries",
-      "registry_index": 40,
+      "registry_index": 41,
       "aliases": [
         "catalog",
         "unused-catalog-entries"
@@ -1518,7 +1557,7 @@
       "description": "Named catalog group has no entries",
       "label": "Empty Catalog Groups",
       "config_key": "empty-catalog-groups",
-      "registry_index": 41,
+      "registry_index": 42,
       "aliases": [
         "empty-catalog",
         "empty-catalog-groups"
@@ -1558,7 +1597,7 @@
       "description": "package.json references a catalog that does not declare the package",
       "label": "Unresolved Catalog References",
       "config_key": "unresolved-catalog-references",
-      "registry_index": 42,
+      "registry_index": 43,
       "aliases": [
         "unresolved-catalog",
         "unresolved-catalog-references"
@@ -1598,7 +1637,7 @@
       "description": "Package-manager override target is not declared or resolved",
       "label": "Unused Dependency Overrides",
       "config_key": "unused-dependency-overrides",
-      "registry_index": 43,
+      "registry_index": 44,
       "aliases": [
         "unused-dependency-overrides",
         "unused-override",
@@ -1639,7 +1678,7 @@
       "description": "Package-manager override has an unparsable key or value",
       "label": "Misconfigured Dependency Overrides",
       "config_key": "misconfigured-dependency-overrides",
-      "registry_index": 44,
+      "registry_index": 45,
       "aliases": [
         "misconfigured-dependency-overrides",
         "misconfigured-override",
@@ -1680,7 +1719,7 @@
       "description": "Detected feature flag pattern",
       "label": "Feature Flags",
       "config_key": "feature-flags",
-      "registry_index": 48,
+      "registry_index": 49,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1710,9 +1749,9 @@
       "description": "A React/Preact prop is forwarded unchanged through 3+ pass-through components to a distant consumer",
       "label": "Prop Drilling",
       "config_key": "prop-drilling",
-      "registry_index": 50,
+      "registry_index": 51,
       "aliases": [],
-      "lsp": false,
+      "lsp": true,
       "filter_flag": null,
       "result_key": "prop_drilling_chains",
       "summary_label": "Prop drilling",
@@ -1742,11 +1781,11 @@
       "description": "A React/Preact component whose whole body is a single spread-forwarded child render (a candidate for inlining)",
       "label": "Thin Wrappers",
       "config_key": "thin-wrapper",
-      "registry_index": 51,
+      "registry_index": 52,
       "aliases": [
         "thin-wrappers"
       ],
-      "lsp": false,
+      "lsp": true,
       "filter_flag": null,
       "result_key": "thin_wrappers",
       "summary_label": "Thin wrappers",
@@ -1776,11 +1815,11 @@
       "description": "Three or more React/Preact components across two or more files declare an identical prop-name set (a missing shared Props type)",
       "label": "Duplicate Prop Shapes",
       "config_key": "duplicate-prop-shape",
-      "registry_index": 52,
+      "registry_index": 53,
       "aliases": [
         "duplicate-prop-shapes"
       ],
-      "lsp": false,
+      "lsp": true,
       "filter_flag": null,
       "result_key": "duplicate_prop_shapes",
       "summary_label": "Duplicate prop shapes",
@@ -1810,7 +1849,7 @@
       "description": "CSS or CSS-in-JS hardcoded styling value bypasses the design token system",
       "label": "CSS Token Drift",
       "config_key": "css-token-drift",
-      "registry_index": 53,
+      "registry_index": 54,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1840,7 +1879,7 @@
       "description": "CSS or CSS-in-JS declaration block is duplicated across rules",
       "label": "CSS Duplicate Block",
       "config_key": "css-duplicate-block",
-      "registry_index": 54,
+      "registry_index": 55,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1870,7 +1909,7 @@
       "description": "CSS selector, nesting, or important usage is structurally complex",
       "label": "CSS Selector Complexity",
       "config_key": "css-selector-complexity",
-      "registry_index": 55,
+      "registry_index": 56,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1900,7 +1939,7 @@
       "description": "CSS or CSS-in-JS surface appears unused",
       "label": "CSS Dead Surface",
       "config_key": "css-dead-surface",
-      "registry_index": 56,
+      "registry_index": 57,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -1930,7 +1969,7 @@
       "description": "CSS or CSS-in-JS reference resolves to no stylesheet definition",
       "label": "CSS Broken Reference",
       "config_key": "css-broken-reference",
-      "registry_index": 57,
+      "registry_index": 58,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -2402,6 +2441,36 @@
       "license_note": null,
       "docs_url": "https://docs.fallow.tools/cli/security"
     },
+    {
+      "id": "flag-retirement-candidate",
+      "rule_id": "fallow/flag-retirement-candidate",
+      "command": "flags",
+      "category": "Flags",
+      "description": "Feature flag is a retirement candidate",
+      "label": null,
+      "config_key": null,
+      "registry_index": null,
+      "aliases": [],
+      "lsp": false,
+      "filter_flag": null,
+      "result_key": null,
+      "summary_label": null,
+      "summary_docs_anchor": null,
+      "sarif_rule_ids": null,
+      "codeclimate_check_names": null,
+      "ts_alias": null,
+      "counts_in_total": false,
+      "fixable": false,
+      "suppressible": false,
+      "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
+      "note": null,
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://docs.fallow.tools/cli/flags#retirement-report"
+    },
     {
       "id": "hardcoded-secret",
       "rule_id": "security/hardcoded-secret",

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "fallow",
-  "version": "3.29.0",
+  "version": "3.31.0",
   "mcpName": "io.github.fallow-rs/fallow",
-  "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
+  "description": "Codebase intelligence for TypeScript and JavaScript: health, complexity, duplication, architecture, styling drift, and unused code from one graph. CLI, LSP, and MCP server. Zero config for over 100 frameworks.",
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fallow-rs/fallow.git"
   },
   "homepage": "https://docs.fallow.tools",
+  "funding": "https://github.com/sponsors/fallow-rs",
   "bugs": {
     "url": "https://github.com/fallow-rs/fallow/issues"
   },
@@ -88,14 +89,14 @@
     "@tanstack/intent": "0.4.0"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.29.0",
-    "@fallow-cli/darwin-x64": "3.29.0",
-    "@fallow-cli/linux-x64-gnu": "3.29.0",
-    "@fallow-cli/linux-arm64-gnu": "3.29.0",
-    "@fallow-cli/linux-x64-musl": "3.29.0",
-    "@fallow-cli/linux-arm64-musl": "3.29.0",
-    "@fallow-cli/win32-arm64-msvc": "3.29.0",
-    "@fallow-cli/win32-x64-msvc": "3.29.0",
-    "fallow-type-aware": "3.29.0"
+    "@fallow-cli/darwin-arm64": "3.31.0",
+    "@fallow-cli/darwin-x64": "3.31.0",
+    "@fallow-cli/linux-x64-gnu": "3.31.0",
+    "@fallow-cli/linux-arm64-gnu": "3.31.0",
+    "@fallow-cli/linux-x64-musl": "3.31.0",
+    "@fallow-cli/linux-arm64-musl": "3.31.0",
+    "@fallow-cli/win32-arm64-msvc": "3.31.0",
+    "@fallow-cli/win32-x64-msvc": "3.31.0",
+    "fallow-type-aware": "3.31.0"
   }
 }

package/schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "title": "FallowConfig",
-  "description": "The user-facing fallow configuration as authored in `.fallowrc.json` /\n`.fallowrc.jsonc` / `fallow.toml` (or the `fallow` key of `package.json`).\n\nEvery field documents its serialized meaning, default, and precedence\nagainst CLI flags and environment variables where they exist.\n`FallowConfig::resolve` compiles the loaded config (globs, regexes,\nplugin and rule-pack discovery) into a [`ResolvedConfig`] for analysis.\nUnknown keys are rejected at load so typos fail loud.",
+  "description": "The user-facing fallow configuration as authored in `.fallowrc.json` /\n`.fallowrc.jsonc` / `fallow.toml` / `.fallow.toml`.\n\nEvery field documents its serialized meaning, default, and precedence\nagainst CLI flags and environment variables where they exist.\n`FallowConfig::resolve` compiles the loaded config (globs, regexes,\nplugin and rule-pack discovery) into a [`ResolvedConfig`] for analysis.\nUnknown keys are rejected at load so typos fail loud.",
   "type": "object",
   "properties": {
     "$schema": {
@@ -36,7 +36,7 @@
       "default": []
     },
     "ignorePatterns": {
-      "description": "An array of project-root-relative glob patterns for files to exclude from analysis entirely; entries are unioned with fallow's built-in defaults (**/node_modules/**, **/dist/**, **/build/**, **/.git/**, **/coverage/**, **/*.min.js, **/*.min.mjs, **/*.min.cjs, **/*.bundle.js), so custom globs add to rather than replace them. Set it (e.g. `[\"generated/**\"]`) to drop generated or vendored trees from every detector; patterns are validated at load.",
+      "description": "An array of project-root-relative glob patterns for files to exclude from analysis entirely; entries are unioned with fallow's built-in defaults (**/node_modules/**, **/dist/**, **/build/**, **/.git/**, **/coverage/**, **/*.min.js, **/*.min.mjs, **/*.min.cjs, **/*.bundle.js), so custom globs add to rather than replace them. Set it (e.g. `[\"generated/**\"]`) to drop generated or vendored trees from every detector; patterns are validated at load. A `!`-prefixed entry is an exception that applies after the defaults and the positive patterns: `\"!src/policy/coverage/**\"` brings back hand-written source under a built-in default such as `**/coverage/**`, and `\"!.config/**\"` adds a hidden directory to discovery. Paths under `node_modules` or `.git` can not be lifted, and a `!` entry that names one of these segments is a config error.",
       "type": "array",
       "items": {
         "type": "string"
@@ -59,7 +59,7 @@
       "default": []
     },
     "workspaces": {
-      "description": "Monorepo workspace configuration whose sole sub-key patterns (array of globs) adds workspace package roots beyond those discovered from package.json workspaces, pnpm-workspace.yaml, and tsconfig references. Optional and absent by default (discovery uses the manifests alone); set it only when workspaces live in directories the standard manifests do not declare.",
+      "description": "Monorepo workspace configuration. `patterns` adds workspace package roots beyond manifest discovery; `changedSince` maps exact project-root-relative workspace roots to Git baseline refs. A global changed-since request overrides those per-package baselines.",
       "anyOf": [
         {
           "$ref": "#/$defs/WorkspaceConfig"
@@ -71,13 +71,20 @@
       "default": null
     },
     "ignoreDependencies": {
-      "description": "A list of exact package names excluded from BOTH unused-dependency and unlisted-dependency detection, so a runtime-provided or otherwise-untracked package (e.g. `bun:sqlite`, a peer supplied at deploy time) is never flagged as unused when declared nor as unlisted when imported. Set it for packages fallow cannot observe being used and cannot observe being declared; matching is exact string equality against the package name, not a glob.",
+      "description": "A list of package names or package-name globs excluded from BOTH unused-dependency and unlisted-dependency detection, so a runtime-provided or otherwise-untracked package (e.g. `bun:sqlite`, a peer supplied at deploy time) is never flagged as unused when declared nor as unlisted when imported. Set it for packages fallow cannot observe being used and cannot observe being declared. An entry without glob characters matches the package name exactly; an entry with `*`, `?`, `[` or `{` is a glob in the `ignorePatterns` syntax matched against the package name, so `@acme/*` covers every package in the `@acme` scope.",
       "type": "array",
       "items": {
         "type": "string"
       },
       "default": []
     },
+    "ignoreCommandEntries": {
+      "description": "A list of command names whose file arguments fallow does not make entry points. Fallow reads commands in package.json scripts (root and workspace packages), CI files (GitHub Actions and GitLab CI), Dockerfiles, Procfiles, and fly.toml files, and a file that a command names (such as `node scripts/seed.ts`) normally becomes an entry point. A listed command still counts as a used dependency, and its `--config` file is still tracked. Formatters and linters (ESLint, Prettier, Oxlint, Oxfmt, Biome, Stylelint, and similar tools) never make their targets entry points, so they do not need to be listed. Set it for a command whose file arguments are data, not code that runs (e.g. `[\"my-codegen\"]`), or use `[\"*\"]` to turn off entry points from all commands and declare real entries in `entry`. A name matches the command after environment, package-manager, and wrapper prefixes (`npx`, `pnpm exec`, `yarn run`, `varlock run --`), by exact file name; `*` is the only wildcard.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
     "ignoreUnresolvedImports": {
       "description": "A list of glob patterns that suppress only `unresolved-import` findings whose raw import specifier matches; it does not change dependency usage accounting or resolver behavior. Patterns match the import string as written (not a filesystem path), so list both `@example/icons` and `@example/icons/**` to cover a bare package and its subpaths; parent-relative generated specifiers like `../generated/**` are valid, and broad values like `**` can hide real missing modules.",
       "type": "array",
@@ -232,6 +239,7 @@
         "dev-dependencies-in-production": "warn",
         "circular-dependencies": "error",
         "re-export-cycle": "warn",
+        "package-cycle": "warn",
         "boundary-violation": "error",
         "coverage-gaps": "off",
         "feature-flags": "off",
@@ -256,6 +264,10 @@
       "description": "Options for the `unused-component-props` rule, currently only `ignorePattern`: a regex matched against each declared prop's local destructure binding name (falling back to the public prop name when unaliased) to exempt intentionally-unused props such as the leading-underscore convention. Set `{ \"ignorePattern\": \"^_\" }` to skip props like `_stage`; matching is unanchored (substring, like ESLint's `RegExp.test`) so anchor with `^`, the pattern is validated at config load (invalid regex fails load), and it applies to Vue, Svelte, Astro, and React/Preact props (unset leaves the rule unchanged).",
       "$ref": "#/$defs/UnusedComponentPropsConfig"
     },
+    "circularDependencies": {
+      "description": "Options for the `circular-dependencies` rule, currently only `ignoreLazyImports`. Set `{ \"ignoreLazyImports\": true }` to skip import edges that load on demand or on another thread (an `import()` inside a function, a template `import()`, a lazy `import.meta.glob`, a worker URL, a webpack worker loader request such as `worker-loader!./work.js`) when fallow looks for cycles. A top-level `await import()`, `require()`, an eager glob, and an edge that also has a static import stay in the cycle graph. Default `false` leaves the rule unchanged.",
+      "$ref": "#/$defs/CircularDependenciesConfig"
+    },
     "boundaries": {
       "description": "Configures architecture boundary enforcement: which source directories belong to which named zone and which zones may import which others, reported as boundary-violation, boundary-coverage-violation, and boundary-call-violation findings (severity via rules.boundary-violation, default error). Set to enforce a layered/module architecture; the object holds `preset` (one of layered, hexagonal, feature-sliced, bulletproof, whose default zones/rules are merged in with the user-declared zones/rules taking precedence), `zones` (each with `name`, `patterns`, `autoDiscover`, optional `root`), `rules` (each with `from`, `allow`, `allowTypeOnly` target-zone lists), `coverage` (`requireAllFiles` plus `allowUnmatched` globs for files matching no zone), and `calls` (a `forbidden` list of `{from, callee}` banned-call rules per zone).",
       "$ref": "#/$defs/BoundaryConfig",
@@ -265,7 +277,7 @@
       }
     },
     "flags": {
-      "description": "Configures feature-flag detection: `sdkPatterns` (custom flag-evaluating call signatures, each `{ function, nameArg (zero-based arg index of the flag name, default 0), provider? }`, merged with built-ins for LaunchDarkly, Statsig, Unleash, GrowthBook, Split, PostHog, Vercel Flags, ConfigCat, Flagsmith, Optimizely, and Eppo), `envPrefixes` (env-var prefixes marking `process.env.*` accesses as flags, merged with built-ins), and `configObjectHeuristics` (default false; when true, property accesses on objects whose name contains `feature`/`flag`/`toggle` are reported as low-confidence flags). Set `sdkPatterns`/`envPrefixes` to teach fallow a proprietary flag SDK or naming convention, or enable `configObjectHeuristics` for projects that read flags off config objects (higher false-positive rate). Feature-flag findings surface only when the `feature-flags` rule is enabled (default `off`).",
+      "description": "Configures feature-flag detection: `sdkPatterns` (custom flag-evaluating call signatures, each `{ function, nameArg (zero-based arg index of the flag name, default 0), provider? }`, merged with built-ins for LaunchDarkly, Statsig, Unleash, GrowthBook, Split, PostHog, Vercel Flags, ConfigCat, Flagsmith, Optimizely, and Eppo), `envPrefixes` (env-var prefixes marking `process.env.*` and `import.meta.env.*` accesses as flags, merged with built-ins), and `configObjectHeuristics` (default false; when true, property accesses on objects whose name contains `feature`/`flag`/`toggle` are reported as low-confidence flags). Set `sdkPatterns`/`envPrefixes` to teach fallow a proprietary flag SDK or naming convention, or enable `configObjectHeuristics` for projects that read flags off config objects (higher false-positive rate). Feature-flag findings surface only when the `feature-flags` rule is enabled (default `off`).",
       "$ref": "#/$defs/FlagsConfig",
       "default": {
         "configObjectHeuristics": false
@@ -754,6 +766,13 @@
             "type": "string"
           },
           "default": []
+        },
+        "changedSince": {
+          "description": "Git baseline refs keyed by workspace roots, written relative to the project root as `fallow list --workspaces` prints them. Scopes `check`, `dead-code`, `dupes` and editor diagnostics; `health`, `security` and `audit` ignore it. A global changed-since request takes precedence. Unlisted workspaces and root files remain in full scope. A key that names no workspace, or a ref that Git cannot resolve, leaves every package in full scope with a warning.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
         }
       }
     },
@@ -1494,6 +1513,11 @@
           "$ref": "#/$defs/Severity",
           "default": "warn"
         },
+        "package-cycle": {
+          "description": "A dependency cycle between workspace packages, built from resolved\ncross-package imports. Defaults to `warn`.",
+          "$ref": "#/$defs/Severity",
+          "default": "warn"
+        },
         "boundary-violation": {
           "description": "An import crossing a forbidden architecture-boundary edge declared in\nthe `boundaries` config. Defaults to `error`.",
           "$ref": "#/$defs/Severity",
@@ -1620,6 +1644,17 @@
       },
       "additionalProperties": false
     },
+    "CircularDependenciesConfig": {
+      "description": "Options for the `circular-dependencies` rule.\n\nThe default leaves the rule unchanged: every runtime import edge takes\npart in cycle detection, and only type-only edges are skipped.",
+      "type": "object",
+      "properties": {
+        "ignoreLazyImports": {
+          "description": "Skip import edges that load their target on demand or on another\nthread when fallow looks for cycles. A literal `import()` inside a\nfunction, a template `import()`, a lazy `import.meta.glob`, a worker\nURL and a webpack worker loader request (`worker-loader!./work.js`)\nare lazy edges. A top-level `await import()`, `require()` and an\neager `import.meta.glob` load before the module finishes, so they stay.\nAn edge that also carries a static import stays. Default `false`.",
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    },
     "BoundaryConfig": {
       "description": "Architecture boundary configuration.",
       "type": "object",
@@ -1753,7 +1788,7 @@
       "type": "object",
       "properties": {
         "requireAllFiles": {
-          "description": "Report source files that do not match any boundary zone.",
+          "description": "Report every analyzed source file that does not match any boundary\nzone, also a file that no entry point reaches.",
           "type": "boolean"
         },
         "allowUnmatched": {
@@ -1824,7 +1859,7 @@
           }
         },
         "envPrefixes": {
-          "description": "Environment variable prefixes that indicate feature flags.\nMerged with built-in prefixes. Only `process.env.*` accesses matching\nthese prefixes are reported as feature flags.",
+          "description": "Environment variable prefixes that indicate feature flags.\nMerged with built-in prefixes. Only `process.env.*` and\n`import.meta.env.*` accesses matching these prefixes are reported as\nfeature flags.",
           "type": "array",
           "items": {
             "type": "string"
@@ -1834,6 +1869,13 @@
           "description": "Enable config object heuristic detection.\nWhen true, property accesses on objects whose name contains \"feature\",\n\"flag\", or \"toggle\" are reported as low-confidence feature flags.\nDefault: false (opt-in due to higher false positive rate).",
           "type": "boolean",
           "default": false
+        },
+        "vendorKeyPrefix": {
+          "description": "Prefix to remove from each key of a `--flag-state` vendor export\nbefore the key is compared with the flag names in the code. For\nexample, `\"web.\"` makes the vendor key `web.new-checkout` match the\ncode flag `new-checkout`. A key without the prefix is compared as it\nis.",
+          "type": [
+            "string",
+            "null"
+          ]
         }
       }
     },
@@ -2463,6 +2505,17 @@
             }
           ]
         },
+        "package-cycle": {
+          "description": "Optional override for [`RulesConfig::package_cycle`].",
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "boundary-violation": {
           "description": "Optional override for [`RulesConfig::boundary_violation`].",
           "anyOf": [
@@ -2794,6 +2847,13 @@
           "minimum": 0,
           "default": 0
         },
+        "packageCycles": {
+          "description": "Baseline count of `package-cycle` findings.",
+          "type": "integer",
+          "format": "uint",
+          "minimum": 0,
+          "default": 0
+        },
         "typeOnlyDependencies": {
           "description": "Baseline count of `type-only-dependencies` findings.",
           "type": "integer",