v3.34.1: Oxlint config names, coverage maps, Vue templates and workspace globs

Bug fixes

• The Oxlint plugin reads .oxlintrc.jsonc and oxlint.config.mts. Oxlint finds these config files on its own, but fallow did not read them. Packages in their jsPlugins lists, at the top level and in overrides, showed as unused dependencies, and oxlint.config.mts showed as an unused file. Fallow now reads every config file name that Oxlint finds. Comments and trailing commas in .oxlintrc.jsonc parse correctly. Thanks @gwynnnplaine for the report and the analysis. (#3525)
• A coverage map with a negative hit count loads. Vitest coverage-v8 can write a negative branch count, for example [5, -1], for the implicit else of an if. Fallow rejected the whole map. When --coverage or FALLOW_COVERAGE named the map, fallow health and fallow audit stopped with exit 2. Fallow now reads a negative count in s, f, b or b_T as 0, which is a miss. An auto-detected map that fails to load now gives a note that says fallow ignored it. Before, the note said that fallow used it. Thanks @norvalbv for the report and the reproduction. (#3564)
• A < inside a nested Vue <template> keeps the references of the template. In <template v-if="W">{{ 1 < 2 }}</template>, fallow read the < as the start of a tag and lost each name that the template used. Fallow then reported a named import that only the template used as an unused export. Fallow now skips {{ }} interpolations when it looks for the closing </template>. When no letter, /, ! or ? follows a <, fallow reads it as text, as in HTML. The cache versions change, so a warm cache does not keep the old result. Thanks @BrocksiNet for the report and the minimal reproduction. (#3543)
• fallow health --type-aware --type-coupling passes --type-aware-require complete on large projects. The command failed --type-aware-require complete on projects with more than 40 coupling edges. The coupling report is one report for the whole project, and it now holds up to 10,000 evidence items. Fallow now reports a complete analysis as complete. Symbol, impact, and API-surface results keep the limit of 40 items. Above 10,000 items, the report stays partial with the evidence-limit reason. Thanks @samaluk for the report and the experiment. (#3563)

Security

• Workspace globs no longer read directories outside the project root. An absolute entry, or an entry such as ../*, in package.json workspaces, pnpm-workspace.yaml packages, deno.json workspace, or the workspaces.patterns config listed directories outside the root. Fallow added no package from them. But a directory without a package.json got a glob-matched-no-package-json diagnostic with its outside path. Fallow now skips such an entry before it reads the disk. A new workspace-glob-outside-root diagnostic names the entry and the file that declares it. The run does not exit with an error, because npm, pnpm, and yarn accept a ../ workspace entry. A .. that stays inside the root, as in packages/../libs/*, still works. The findings do not change. (#3574)

Full Changelog: v3.34.0...v3.34.1