chore(deps): bump the minor-and-patch group with 5 updates

[dependabot]

Bumps the minor-and-patch group with 5 updates:

Package	From	To
fallow	3.9.1	3.10.0
react-doctor	0.9.1	0.9.2
@types/node	26.1.1	26.1.2
shadcn	4.15.0	4.16.0
motion	12.42.2	12.43.0

Updates fallow from 3.9.1 to 3.10.0

Release notes

Sourced from fallow's releases.

v3.10.0: stable type-aware TypeScript analysis

Stable type-aware TypeScript analysis

--type-aware opts into a bounded TypeScript-Go semantic pass that runs after Fallow's normal project analysis. It landed in 3.8.0 as an explicit, repository-only proof; it is now a stable optional contract with a versioned wire protocol and a packaged companion. Default analysis stays fast, syntactic, and independent of Node.js and TypeScript.

npm install --save-dev fallow
npx fallow dead-code --unused-class-members --type-aware

npm installs receive the exact matching fallow-type-aware companion as an optional dependency, so there is nothing else to wire up. See the type-aware analysis guide.

The pass covers five project-wide capabilities:

• exact symbol-use, TypeScript contract, and validated framework-contract decisions for existing dead-code candidates
• symbol traces across namespaces, aliases, and re-export hops
• package API surfaces and cross-file private type leaks
• exact-symbol impact paths and targeted-test suggestions
• advisory public-signature type coupling

Fallow only changes a finding when the checker resolves an exact declaration identity. Name-only matches are never enough, so dynamic computed access, decorators, dependency injection, and runtime registration keep their findings.

Cross-project confirmation

Explicit TypeScript projects are now scanned together, so a use in an application project can confirm a declaration in a referenced library project. String-literal element access is recognized as a use. Explicit solution configs without source files fail closed with per-candidate abstention instead of emitting invalid project metadata.

Checker-backed API and project metadata

Public API analysis no longer treats parameter names or generic type parameters as private types, complete semantic results drop unmatched syntactic leak guesses, and overlapping TypeScript projects no longer duplicate API entries or coupling edges. Per-project candidate, confirmed, unresolved, and abstained counts are populated instead of staying zero, including in the programmatic API.

Unavailable API queries keep their syntactic leak findings, a missing entry point keeps mixed-entry results partial, requests above the private-leak candidate cap retain the unrequested tail and report partial capacity, and

... (truncated)

Changelog

Sourced from fallow's changelog.

[3.10.0] - 2026-07-27

Changed

• Type-aware class-member refinement now covers string-literal element access and cross-project consumers. Explicit TypeScript projects are scanned together, so a use in an application project can confirm a declaration in a referenced library project. Dynamic computed access, decorators, dependency injection, and runtime registration still retain the finding when exact symbol evidence is unavailable. Explicit solution configs without source files now fail closed with per-candidate abstention instead of invalid project metadata. The release corpus enforces pinned clean sources, repeated deterministic output, independent source review, and accuracy, resource, and abstention limits. Corpus evidence is now produced by the exact hashed sidecar artifact recorded during discovery instead of importing workspace implementation modules.

Fixed

• Type-aware API and project metadata now reflect checker-backed facts. Public API analysis no longer treats parameter names or generic type parameters as private types, complete semantic API results remove unmatched syntactic leak guesses, and overlapping TypeScript projects no longer duplicate API entries or coupling edges. Per-project candidate, confirmed, unresolved, and abstained counts are populated instead of remaining zero, including in the programmatic API. Unavailable API queries retain syntactic leak findings, and a missing entry point keeps mixed-entry results partial. Corpus artifacts now record and verify the approved ancestor dependency environment, including its lockfile and installed type-declaration tree, rather than claiming that fixtures resolve with no dependencies. The semantic protocol is now version 6, the first stable type-aware wire contract. A canonical manifest now keeps Rust, the sidecar, corpus tooling, and editor packaging aligned. Pre-stable protocol variants are rejected. Private leak confirmation is request-scoped and bounded, incomplete entry-point coverage retains syntactic candidates, and unexpected checker failures surface as errors instead of being mislabeled as unsupported syntax. Requests above the private-leak candidate cap retain the unrequested tail and report partial capacity instead of failing or pruning it. The Rust semantic client and reconciliation logic now have one owner in fallow-api; CLI, editor, runtime, and programmatic paths share it. Cross-platform child-process lifecycle behavior is shared through fallow-process.

Commits

• 2881013 test: scope process lint expectation to Unix
• 55d72c0 feat(config): add ignoreFindings to hide findings without removing files from...
• d3b7350 fix(deps): credit dependencies referenced by config callbacks and CLI flags
• cca693b test: avoid global sidecar environment mutation
• d73cee9 fix(graph): preserve TypeScript path aliases excluded by ignorePatterns
• 7667b6a test: share type-aware sidecar launcher
• 11bf96c fix: increase standalone icon safe area
• 7f3aee3 fix: normalize type-aware Windows paths
• 1142d22 test: expose type-aware CLI failure output
• c151c4e fix: make type-aware release validation portable
• Additional commits viewable in compare view

Updates react-doctor from 0.9.1 to 0.9.2

Release notes

Sourced from react-doctor's releases.

react-doctor@0.9.2

Patch Changes

• #1451 4fbab2d Thanks @​aidenybai! - Detect TanStack Start root documents that omit client scripts and unsafe filesystem containment checks that compare resolved paths with a bare string prefix.

• #1454 4ebd0a0 Thanks @​aidenybai! - Add opt-in diagnostics for auto-scrolling content, decorative radial effects, pulsing status dots, repeated container copy, and shape-assembled illustrations. Improve existing design and copy diagnostics with stricter visibility, cascade, motion, contrast, and structural analysis.

• #1450 7ee59d3 Thanks @​aidenybai! - Detect active React Compiler transforms referenced through Node require.resolve.

• #1461 80e89c5 Thanks @​skoshx! - Fix a stack overflow in React Compiler project discovery when nested configuration helpers forward same-named parameters or config bindings resolve cyclically.

• #1445 b1b62db Thanks @​aidenybai! - Avoid jsx-no-undef false positives for identifiers confirmed by an active unplugin-auto-import configuration and its current generated ESLint globals.

• #1458 1aa6b12 Thanks @​aidenybai! - Detect active React Compiler transforms imported recursively from dependency packages.

• #1443 8534d86 Thanks @​aidenybai! - Scan JavaScript in standard inline HTML script blocks, including Three.js code, while preserving HTML file paths and source locations in diagnostics.

• #1427 5d2f66d Thanks @​aidenybai! - Add React Native diagnostics for Reanimated 4 migrations, Gorhom Bottom Sheet integration, Expo platform tree shaking, Babel plugin order, and Android release shrinking. Expand recycler support to current Legend List and animated FlashList entrypoints, follow proven same-file renderer indirection, tighten heterogeneous recycler detection, and refresh outdated React Native recommendations.

• Updated dependencies [4fbab2d, 4ebd0a0, 49c5c1e, 846c2df, b1b62db, 5d2f66d]:

  • oxlint-plugin-react-doctor@0.9.2
  • deslop-js@0.9.2

Changelog

Sourced from react-doctor's changelog.

0.9.2

Patch Changes

• #1451 4fbab2d Thanks @​aidenybai! - Detect TanStack Start root documents that omit client scripts and unsafe filesystem containment checks that compare resolved paths with a bare string prefix.

• #1454 4ebd0a0 Thanks @​aidenybai! - Add opt-in diagnostics for auto-scrolling content, decorative radial effects, pulsing status dots, repeated container copy, and shape-assembled illustrations. Improve existing design and copy diagnostics with stricter visibility, cascade, motion, contrast, and structural analysis.

• #1450 7ee59d3 Thanks @​aidenybai! - Detect active React Compiler transforms referenced through Node require.resolve.

• #1461 80e89c5 Thanks @​skoshx! - Fix a stack overflow in React Compiler project discovery when nested configuration helpers forward same-named parameters or config bindings resolve cyclically.

• #1445 b1b62db Thanks @​aidenybai! - Avoid jsx-no-undef false positives for identifiers confirmed by an active unplugin-auto-import configuration and its current generated ESLint globals.

• #1458 1aa6b12 Thanks @​aidenybai! - Detect active React Compiler transforms imported recursively from dependency packages.

• #1443 8534d86 Thanks @​aidenybai! - Scan JavaScript in standard inline HTML script blocks, including Three.js code, while preserving HTML file paths and source locations in diagnostics.

• #1427 5d2f66d Thanks @​aidenybai! - Add React Native diagnostics for Reanimated 4 migrations, Gorhom Bottom Sheet integration, Expo platform tree shaking, Babel plugin order, and Android release shrinking. Expand recycler support to current Legend List and animated FlashList entrypoints, follow proven same-file renderer indirection, tighten heterogeneous recycler detection, and refresh outdated React Native recommendations.

• Updated dependencies [4fbab2d, 4ebd0a0, 49c5c1e, 846c2df, b1b62db, 5d2f66d]:

  • oxlint-plugin-react-doctor@0.9.2
  • deslop-js@0.9.2

Commits

• 201106e chore: version packages (#1442)
• 1aa6b12 fix: detect React Compiler through dependency configs (#1458)
• 4ebd0a0 feat: expand design quality rules (#1454)
• 7ee59d3 fix: detect React Compiler through require.resolve (#1450)
• b1b62db fix: recognize unplugin auto-import JSX globals (#1445)
• 8534d86 feat: scan inline scripts in HTML files (#1443)
• See full diff in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Updates shadcn from 4.15.0 to 4.16.0

Release notes

Sourced from shadcn's releases.

shadcn@4.16.0

Minor Changes

• #11307 431da7169cae753643e67e56e168b93ec31dfe90 Thanks @​shadcn! - make addRegistryItems accept explicit registry configuration instead of loading components.json

• #11304 bf906bb8aeebc64d374afb54497b822d587ac6d7 Thanks @​shadcn! - add getRegistriesConfig and registries in package.json support

Changelog

Sourced from shadcn's changelog.

4.16.0

Minor Changes

• #11307 431da7169cae753643e67e56e168b93ec31dfe90 Thanks @​shadcn! - make addRegistryItems accept explicit registry configuration instead of loading components.json

• #11304 bf906bb8aeebc64d374afb54497b822d587ac6d7 Thanks @​shadcn! - add getRegistriesConfig and registries in package.json support

Commits

• 2a2deaa chore(release): version packages (#11306)
• 431da71 feat(registry): accept config in addRegistryItems (#11307)
• bf906bb feat(registry): load registries from package.json (#11304)
• See full diff in compare view

Updates motion from 12.42.2 to 12.43.0

Changelog

Sourced from motion's changelog.

[12.43.0] 2026-07-27

Added

• Hardware acceleration for backgroundColor in supported browsers.
• Hardware acceleration for SVG elements.

Fixed

• AnimatePresence: Exiting children no longer interleave with entering children, which could reorder and remount children present in both renders.
• motion: Throw error when passing a custom motion component an incorrect ref type.

Commits

• a4ef40a v12.43.0
• 14f2d28 adding svg acceleration
• 1f5a27b Fixing merge
• 79f0353 Updating changelog
• 57f179b Updating changelog
• 695cb39 Merge pull request #3755 from motiondivision/fix-issue-2777
• 33a1820 Drop the production fallback for non-DOM refs
• ebe35f2 Throw an actionable invariant for non-DOM custom component refs
• a6ed094 Merge pull request #3754 from motiondivision/fix-3745-popchild-ref-warning
• 9f251f3 Merge pull request #3763 from motiondivision/advisor/003-color-waapi
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nativepi	Ready	Preview	Aug 1, 2026 5:47am

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.