Update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
archlinux	container	digest	4bf33b2 → b860afd
fallow-rs/fallow	action	minor	v3.17.0 → v3.18.0

---

Release Notes

fallow-rs/fallow (fallow-rs/fallow)

v3.18.0: : more accurate graphs, consistent diagnostics, leaner editor packages

Compare Source

Fallow 3.18.0 makes dead-code analysis more accurate across equivalent module shapes, aligns workspace and programmatic diagnostics with the CLI, and reduces normal VS Code extension downloads with platform-specific packages.

Highlights

• Equivalent module shapes now receive equivalent credit: default exports, static CommonJS maps, namespace and star chains, whole-module consumers, entry namespaces, dynamic and require imports, type namespaces, ambient modules, and framework handovers now retain the right reachability. Dotted member reads remain narrow, so unused siblings still report. #​2391, #​2397
• Workspace and programmatic diagnostics agree with the CLI: run-owned diagnostics are deterministic and project-relative, typed MCP routes apply supported CLI precedence, and listing routes no longer inherit analysis-stage diagnostics from earlier calls in the same process. Fresh MCP processes on Windows also return normally instead of stalling while next-step facts are assembled. #​2392, #​2396
• VS Code downloads are roughly 82 to 84 percent smaller: the extension now publishes universal and platform-specific packages for macOS, Linux, and Windows. Open VSX currently uses the universal package for win32-arm64 until that exact target becomes available; all other supported targets use their matching package.

Accuracy and reliability

• Trace, impact, and type-aware proof now agree: declaration lanes, reachability, declaration merges, and star collisions share the same verdict. Ambiguous exports return explicit ambiguity evidence instead of a misleading unused or not-found result. #​2390
• CSS Modules use one crediting model across supported extensions: CSS, SCSS, Sass, and Less modules now handle aliased default imports, whole-object handovers, and duplicate class names in separate files consistently. Precise member reads still leave unused classes reportable. #​2395
• Framework, ambient, and MDX extraction covers the remaining equivalent shapes: Astro, JSX member tags, module augmentations, local namespace members, import X = require(...), and ambient star exports now contribute the right evidence. MDX preserves multiline statements, JSX initializers, dynamic imports, comments, strings, and source locations while rejecting prose that merely looks like code. #​2393
• Convex custom function directories are supported: the integration now honors a safe functions directory from convex.json. Thanks @​pierre-H for reporting #​2387.
• Bun dependency overrides fail closed: resolutions and dependency-override selectors now use package-manager-aware parsing, accurate source locations, and safe handling for unreadable or shadowed lockfile state. Projects with legacy bun.lockb receive an actionable workspace diagnostic instead of unsafe removal advice. #​2358, #​2367, #​2394
• Capability contracts derive from the CLI: machine-readable output formats, aliases, and the public exit-code ladder now keep fallow schema, packaged adapters, and agent guidance synchronized.
• Audit coverage attribution is consistent: the base pass uses the same coverage data as the head pass, and custom coverage paths participate in cache invalidation correctly.
• Inline review findings follow explicit lifecycles: clean reruns no longer repeat resolution replies, while a genuine recurrence opens a fresh reviewable lifecycle. Thanks @​Jerc92 for #​2370.
• Windows launcher verification covers every production path: host-independent fixtures exercise lazy verification and sentinel cache behavior in regular CI and release validation. Thanks @​NgoQuocViet2001 for the groundwork in #​2288.

Performance

• Trace output avoids redundant evidence: trace JSON omits duplicate direct references when no second namespace carries evidence, while dual-namespace traces keep the full per-lane payload. The stable trace benchmark improved by roughly 46 percent in local WallTime and 31 percent in the matching CodSpeed simulation.

Compatibility

• No configuration migration or schema-version bump is required. The new trace ambiguity and namespace evidence, workspace diagnostics, and diagnostic kinds are additive. Consumers that exhaustively match diagnostic kinds should continue to treat unknown informational values defensively.
• Bare-specifier re-exports inside ambient module bodies are now classified as type-only package usage. In --production mode, a production dependency used only through such a declaration can now produce the existing type-only-dependency finding. Move it to devDependencies when appropriate, or add it to ignoreDependencies when the declaration intentionally describes a runtime package.

Full Changelog: fallow-rs/fallow@v3.17.0...v3.18.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.