v3.11.0: Deno workspaces, Server Action security fix, mock-aware coverage

Deno joins the workspace family, four community-reported false positives are gone, and parallel CI review jobs stop stepping on each other.

Features

Deno workspace support. A root deno.json / deno.jsonc now drives discovery natively: workspace member globs, member names and exports, and scoped import maps with exact-then-longest-prefix resolution. Deno workspace names count as listed dependencies, pure Deno roots no longer warn about a missing node_modules, and both the array and object ({"members": [...]}) forms of the workspace key are accepted. Thanks @shanepadgett for the contribution.

npm dependency overrides are analyzed. The top-level overrides object in package.json (npm's equivalent of pnpm.overrides) now runs through the same unused and misconfigured override analysis as pnpm, including nested objects, the "." self-pin key, and "$package" references. Thanks @VariableVince for the report.

Parallel inline-review jobs can be isolated. Set FALLOW_REVIEW_ID (GitHub Action input review-id) per job and GitHub/GitLab reconciliation only deduplicates and resolves comments from that scope, so package-per-job pipelines stop resolving each other's discussions. Thanks @Jerc92 for the report and the patch.

Identity-preserving health baselines. --baseline-mode identity matches baselines per function identity instead of per file-and-category counts, so a replacement hotspot is reported instead of silently consuming an old allowance.

ignoreFindings grows up. It now covers the remaining source-owned result families, reports patterns that match nothing, and fallow migrate maps root ignore patterns from migrated configs onto it.

Bug fixes

• Server Actions are no longer security false positives. A "use server" module imported from a client component is the framework's supported mutation pattern; the server-only-import rule now only flags modules that actually import server-only code. Every Server Action call site in an App Router project was previously reported as high severity. Thanks @DeLuke84 for the detailed report.
• React Native platform extensions. import "./UserMenu" now credits the whole Metro platform family (.ios, .android, .native, .web, and the base file) instead of reporting the base file as unused. Thanks @issacfriedman.
• Sass partials behind tsconfig aliases resolve. @use "@/styles/tokens" now probes _tokens.scss and friends after alias expansion. Thanks @Jerc92.
• Indexed-access getter types. A Playwright fixture typed as Factory["getter"] resolves through the getter's return type, so members called through it are credited. Thanks @vethman.
• Mocked modules no longer count as test coverage. A test that vi.mocks a module executes the mock, not the real module; static test reachability now masks those edges per test root, so coverage gaps stop hiding behind mocks. Health results shift on upgrade where mocks were the only coverage path; refresh saved health baselines if you gate on them. Thanks @M-Hassan-Raza for the implementation.
• CI workflow scanning keeps plain multi-line run: scalars intact, duplication baselines survive unrelated line shifts, fallow dupes honours the configured threshold again, and every command now exits explicitly on a malformed root manifest instead of analyzing an empty workspace list.

Documentation

The GitHub Action ref and the fallow CLI version are independent; the README now documents the resolution order (version input, then the package.json pin, then latest). Thanks @hckhanh.

Full Changelog: v3.10.0...v3.11.0