chore(deps): update dependency jscpd to v5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jscpd (source)	^4.0.5 → ^5.0.0

---

Release Notes

kucherenko/jscpd (jscpd)

v5.1.1

Compare Source

Bug Fixes

• jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.

  The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.

Other

• Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.

Published Packages

• cpd-core@0.1.10 on crates.io
• cpd-finder@0.1.13 on crates.io
• cpd-reporter@0.1.11 on crates.io
• cpd-tokenizer@0.1.12 on crates.io
• jscpd@5.1.1 on crates.io
• cpd@5.1.1 on npm
• jscpd@5.1.1 on npm
• jscpd-darwin-arm64@5.1.1 on npm
• jscpd-darwin-x64@5.1.1 on npm
• jscpd-linux-x64-gnu@5.1.1 on npm
• jscpd-linux-arm64-gnu@5.1.1 on npm
• jscpd-linux-x64-musl@5.1.1 on npm
• jscpd-windows-x64-msvc@5.1.1 on npm
• jscpd-windows-arm64-msvc@5.1.1 on npm

v5.1.0

Compare Source

New Features

• Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only: a committed baseline file records fingerprints of accepted clones, and only clones absent from it fail the build, so legacy duplication is tolerated while regressions are caught. (#​944)
• Ephemeral baseline from a git ref (--baseline-from-ref) — stateless PR gating without a committed file: scans the base ref in a temporary worktree and reports clones that don't exist there. (#​944)
• OpenMetrics reporter (--reporters openmetrics) — duplication gauges in the OpenMetrics text format, ready for GitLab CI artifacts:reports:metrics. (#​422)
• CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — gl-code-quality-report.json for GitLab's artifacts:reports:codequality, so duplicates appear as code quality issues in merge requests. (#​958)
• Windows on ARM support — npm installs pick a native aarch64-pc-windows-msvc binary on Windows ARM64. (#​963)
• Config discovery in .config/ — jscpd also finds its config at .config/jscpd.json per the dot-config convention; a root .jscpd.json still wins. (#​979)

Bug Fixes

• Unknown --format values warn instead of silently scanning 0 files — --format cs (or any typo) no longer looks identical to a clean scan in CI. (#​964)
• Nix flake builds again — the Rust toolchain is pinned to an exact patch version, so the manifest hash can no longer drift when a new patch release ships. (#​976)
• Windows: --baseline-from-ref no longer reports every clone as new — Windows verbatim paths (\\?\C:\...) were truncated by the :format-suffix stripper, silently breaking every snippet read behind the base scan's fingerprints. Clone fingerprints are also line-ending agnostic now, so committed baselines survive CRLF/LF differences between platforms.

Thank You ❤️

• @​luchsamapparat for contributing Windows on ARM support (#​963)
• @​dmromanov for proposing the OpenMetrics reporter (#​422)
• @​beanaroo for proposing the GitLab / CodeClimate Code Quality report format (#​958)
• @​MRDGH2821 for proposing config discovery from the .config/ subfolder (#​979)
• @​zbcoding for reporting the silent unknown---format behavior (#​964)
• @​eaves-dropper for reporting the Nix build failure (#​976)

---

v5.0.16

Compare Source

New Features

• MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
• Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
• Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)

Security

• Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch

Bug Fixes

• GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line

Thank You ❤️

• @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine

---

v5.0.15

Compare Source

New Features

• SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
• SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
• SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
• SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)

Bug Fixes

• Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
• Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
• Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
• Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root

Thank You ❤️

• @​chrisc-onaorg for the SARIF fingerprints, related-location messages, and rule metadata (#​910, #​912, #​914)
• @​darronz for the scan-root-relative paths fix (#​913)
• @​nvuillam for proposing size-based SARIF severity (#​908)

---

v5.0.14

Compare Source

New Features

• --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)

Bug Fixes

• Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)

---

v5.0.12

Compare Source

Dependencies

• Rust dependency updates (askama 0.16.0, log 0.4.33, env_logger 0.11.11, rustc-hash 2.1.3)

---

v5.0.11

Compare Source

New Features

• Razor (.razor) support — new tokenizer for Razor files in the Rust backend (thanks to @​chrisc-onaorg in #​829)

Dependencies

• cpd-core bumped to 0.1.6, cpd-tokenizer bumped to 0.1.7

---

v5.0.10

Compare Source

Bug Fixes

• Emit scan-root-relative paths in all reporters when absolute: false. Fixes #​827
• Fix --skip-local to match jscpd v4 TypeScript semantics

Refactoring

• DRY duplication in reporters: extract shared helpers into cpd-reporter/src/shared.rs
• Move blame enrichment from gitoxide to git blame --porcelain

---

v5.0.9

Compare Source

New Features

• GitHub Action for jscpd (Rust v5) — jscpd-copy-paste-detector action for GitHub Actions Marketplace. Scan your repo for copy/paste in CI with uses: kucherenko/jscpd/.github/workflows/action.yml@v5

Bug Fixes

• Resolve platform binary resolution when cpd is installed as a nested dependency (e.g. in a project's node_modules via a parent package). The runner now correctly locates the platform-specific binary relative to the installed package rather than assuming a top-level install. Fixes #​816

---

v5.0.8

Compare Source

Bug Fixes

• Prevent mmap exhaustion crashes when scanning repositories with more files than vm.max_map_count (default 131 072 on Linux). The walker previously held a live Mmap per discovered file; each rayon worker now opens and drops its mapping within the processing closure, capping concurrent mappings to the thread-pool size (typically 8–32). Fixes #​813
• Fix --pattern not matching relative paths when the scan root is absolute (e.g. CWD). Patterns like src/**/*.ts now match correctly by comparing against both the relative path and the full absolute path, and bare patterns like *.ts gain a **/ prefix to match at any depth. Fixes #​811
• Fix trailing-newline off-by-one in line-count filter: files not ending with \n now count the final line correctly

---

v5.0.7

Compare Source

Bug Fixes

• Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's test/bundler with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon ThreadPool with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
• Default --max-size to 1mb — files exceeding the limit are skipped at walk time, consistent with jscpd v4's maxSize behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
• --workers N now correctly takes effect on every run() call (previously build_global() silently no-op'd after the first invocation)

---

v5.0.6

Compare Source

New Features

• v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
• ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
• .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
• jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
• --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
• Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #​808)

Bug Fixes

• Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
• Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)

---

v5.0.5

Compare Source

v5.0.4

Compare Source

New Features

• CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
• Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
• Side-by-side blame comparison in console-full reporter
• Clone list display in console reporter

Bug Fixes

• HTML reporter now outputs jscpd-report.html at the output_dir root
• Resolved all clippy warnings across workspace
• Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[w3nl]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}