chore(deps): update dependency jscpd to v5.1.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jscpd (source)	5.0.12 → 5.1.1

---

Release Notes

kucherenko/jscpd (jscpd)

v5.1.1

Compare Source

v5.1.0

Compare Source

New Features

• Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only: a committed baseline file records fingerprints of accepted clones, and only clones absent from it fail the build, so legacy duplication is tolerated while regressions are caught. (#​944)
• Ephemeral baseline from a git ref (--baseline-from-ref) — stateless PR gating without a committed file: scans the base ref in a temporary worktree and reports clones that don't exist there. (#​944)
• OpenMetrics reporter (--reporters openmetrics) — duplication gauges in the OpenMetrics text format, ready for GitLab CI artifacts:reports:metrics. (#​422)
• CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — gl-code-quality-report.json for GitLab's artifacts:reports:codequality, so duplicates appear as code quality issues in merge requests. (#​958)
• Windows on ARM support — npm installs pick a native aarch64-pc-windows-msvc binary on Windows ARM64. (#​963)
• Config discovery in .config/ — jscpd also finds its config at .config/jscpd.json per the dot-config convention; a root .jscpd.json still wins. (#​979)

Bug Fixes

• Unknown --format values warn instead of silently scanning 0 files — --format cs (or any typo) no longer looks identical to a clean scan in CI. (#​964)
• Nix flake builds again — the Rust toolchain is pinned to an exact patch version, so the manifest hash can no longer drift when a new patch release ships. (#​976)
• Windows: --baseline-from-ref no longer reports every clone as new — Windows verbatim paths (\\?\C:\...) were truncated by the :format-suffix stripper, silently breaking every snippet read behind the base scan's fingerprints. Clone fingerprints are also line-ending agnostic now, so committed baselines survive CRLF/LF differences between platforms.

Thank You ❤️

• @​luchsamapparat for contributing Windows on ARM support (#​963)
• @​dmromanov for proposing the OpenMetrics reporter (#​422)
• @​beanaroo for proposing the GitLab / CodeClimate Code Quality report format (#​958)
• @​MRDGH2821 for proposing config discovery from the .config/ subfolder (#​979)
• @​zbcoding for reporting the silent unknown---format behavior (#​964)
• @​eaves-dropper for reporting the Nix build failure (#​976)

---

v5.0.16

Compare Source

New Features

• MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
• Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
• Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)

Security

• Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch

Bug Fixes

• GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line

Thank You ❤️

• @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine

---

v5.0.15

Compare Source

New Features

• SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
• SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
• SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
• SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)

Bug Fixes

• Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
• Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
• Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
• Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root

Thank You ❤️

• @​chrisc-onaorg for the SARIF fingerprints, related-location messages, and rule metadata (#​910, #​912, #​914)
• @​darronz for the scan-root-relative paths fix (#​913)
• @​nvuillam for proposing size-based SARIF severity (#​908)

---

v5.0.14

Compare Source

New Features

• --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)

Bug Fixes

• Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[w3nl]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.