chore(deps): update dependency jscpd to v5 - #519

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/jscpd-5.x
Open

chore(deps): update dependency jscpd to v5#519
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/jscpd-5.x

Conversation

@renovate

@renovaterenovateBot commented Jun 8, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeConfidence
jscpd (source)^4.0.5 → ^5.0.0ageconfidence

Release Notes

kucherenko/jscpd (jscpd)

v5.1.2

Compare Source

New Features
  • Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#​988)
  • cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#​988)
  • Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#​988)
Bug Fixes
  • jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#​988)
  • Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#​988)
  • pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#​989)
  • Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#​988)
Other
  • Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#​989, #​990)
  • Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#​988)
  • crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#​988)
  • Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#​988)
  • CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#​988, #​989)
Dependencies
  • Bump quick-xml to 0.42.0 in /rust (#​991)

Published Packages

  • cpd-core@0.1.11 on crates.io
  • cpd-finder@0.1.14 on crates.io
  • cpd-reporter@0.1.12 on crates.io
  • cpd-tokenizer@0.1.13 on crates.io
  • jscpd@5.1.2 on crates.io
  • cpd@5.1.2 on npm
  • jscpd@5.1.2 on npm
  • jscpd-darwin-arm64@5.1.2 on npm
  • jscpd-darwin-x64@5.1.2 on npm
  • jscpd-linux-x64-gnu@5.1.2 on npm
  • jscpd-linux-arm64-gnu@5.1.2 on npm
  • jscpd-linux-x64-musl@5.1.2 on npm
  • jscpd-linux-arm64-musl@5.1.2 on npm
  • jscpd-windows-x64-msvc@5.1.2 on npm
  • jscpd-windows-arm64-msvc@5.1.2 on npm

Verify

Archives are signed with Sigstore (keyless, <asset>.sigstore.json)
and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:

cosign verify-blob \
--bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
--certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt

v5.1.1

Compare Source

Bug Fixes

  • jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.

    The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.

Other
  • Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.

Published Packages

  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.13 on crates.io
  • cpd-reporter@0.1.11 on crates.io
  • cpd-tokenizer@0.1.12 on crates.io
  • jscpd@5.1.1 on crates.io
  • cpd@5.1.1 on npm
  • jscpd@5.1.1 on npm
  • jscpd-darwin-arm64@5.1.1 on npm
  • jscpd-darwin-x64@5.1.1 on npm
  • jscpd-linux-x64-gnu@5.1.1 on npm
  • jscpd-linux-arm64-gnu@5.1.1 on npm
  • jscpd-linux-x64-musl@5.1.1 on npm
  • jscpd-windows-x64-msvc@5.1.1 on npm
  • jscpd-windows-arm64-msvc@5.1.1 on npm

v5.1.0

Compare Source

New Features

  • Windows on ARM support — npm installs now select a native aarch64-pc-windows-msvc binary from the jscpd-windows-arm64-msvc platform package on Windows ARM64.

  • Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only. A committed baseline file (e.g. .jscpd-baseline.json) records content-hash fingerprints of accepted clones (the same hash the SARIF reporter emits as partialFingerprints["jscpdCloneHash/v1"], with a multiplicity count per fingerprint); clones absent from it are reported as new, and --fail-on-new-clones[=N] exits 1 when more than N (default 0) new clones are found — independently of --threshold, so legacy duplication is tolerated while regressions fail the build. --update-baseline rewrites the file from the current run (creating it if missing) and prints added/removed fingerprint counts so baseline growth stays visible in CI logs and PR review. The baseline file is versioned, sorted one fingerprint per line for reviewable diffs and trivial merges, and configurable via the baseline / failOnNewClones config keys. New-clone info flows through the reporters: [NEW] markers and a "(N new)" found-count in console/console-full, per-clone isNew plus the newClones / newDuplicatedLines statistics in json, level error in sarif, and jscpd_new_clones / jscpd_new_duplicated_lines gauges in openmetrics. (#​944)

  • Ephemeral baseline from a git ref (--baseline-from-ref) — stateless variant of the clone baseline for PR gates without a committed file: cpd --baseline-from-ref origin/main --fail-on-new-clones . checks the base ref's tree out into a temporary detached git worktree (removed afterwards; shells out to git like blame does), scans it with the same detection configuration, and compares the current run against that in-memory fingerprint set — clones absent from the base ref are new. Costs a second scan of the corpus, where the committed --baseline file needs only one. When the ref is missing (shallow CI checkout) it fails with a clear hint to git fetch origin main or use fetch-depth: 0. Config key baselineFromRef; conflicts with --baseline / --update-baseline. (#​944)

  • OpenMetrics reporter (--reporters openmetrics) — writes jscpd-metrics.txt in the OpenMetrics text exposition format, ready to be declared as a GitLab CI artifacts:reports:metrics artifact so merge requests show duplication metric changes against the target branch. Exposes gauges for files/lines/tokens analyzed, clones found, duplicated lines/tokens with percentages (project total plus a format-labeled sample per format), and detection duration in seconds. (#​422)

  • CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — writes gl-code-quality-report.json (the filename GitLab's docs use) in the CodeClimate issue format, restricted to the subset GitLab defines as its Code Quality report format, ready to be declared as an artifacts:reports:codequality artifact so duplicates appear as code quality issues in merge requests — unlike the SARIF reporter, which GitLab ingests as security vulnerability findings. Each clone yields an issue per fragment (each describing the other location, plus the CodeClimate other_locations field), with a deterministic fingerprint derived from the clone's content hash so GitLab can tell new issues from pre-existing ones across pipeline runs. Severity is minor, escalating to major for clones absent from a configured baseline or when the run exceeds --threshold. (#​958)

  • Config discovery in .config/ (dot-config convention) — auto-discovery now also checks .config/jscpd.json (and .config/.jscpd.json) per the dot-config convention, between the root .jscpd.json and the package.jsonjscpd key. A root .jscpd.json still wins, so existing setups are unaffected; paths inside the config resolve against the working directory, as with other auto-discovered sources. (#​979)

Bug Fixes
  • Unknown --format values warn instead of silently matching nothing — a typo like --format cs (instead of csharp) used to scan 0 files and exit 0, indistinguishable from a clean codebase in CI. The CLI now prints a stderr warning naming the unsupported value and pointing to --list; custom formats declared via --formats-exts stay accepted. (#​964)
  • Nix flake builds again — the flake pinned the hash of the mutable channel-rust-1.97.toml manifest, which broke with a fixed-output hash mismatch when Rust 1.97.1 was published. The toolchain is now pinned to the exact patch version (immutable manifest), so the hash can no longer drift. (#​976)
  • Windows: --baseline-from-ref no longer reports every clone as new — the format-suffix stripper treated the drive colon in Windows verbatim paths (\\?\C:\..., the form canonicalize returns) as a :format suffix and truncated the base scan's source ids to \\?\C, so every snippet read behind the fingerprint computation failed silently and the ephemeral baseline never matched. A colon followed by a path separator is now recognized as structural. Clone fingerprints are also line-ending agnostic now (CR stripped before hashing), so committed baselines survive CRLF/LF differences between platforms.
Other
  • Glama MCP listing — the repository now ships a glama.json maintainer manifest and a Dockerfile that runs the stdio MCP server (jscpd --mcp), used by Glama to build and score the server listing
  • Signed releases — release artifacts are signed with SLSA provenance, and piped downloads in workflows are pinned (OpenSSF Scorecard)
Dependencies
  • Bump Rust toolchain to 1.97.1 and oxc crates to 0.147 in /rust
  • Bump thiserror to 2.0.20, globset to 0.4.20, ignore to 0.4.33, log to 0.4.34 in /rust
Thank You ❤️

Published Packages

  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.12 on crates.io
  • cpd-reporter@0.1.10 on crates.io
  • cpd-tokenizer@0.1.11 on crates.io
  • jscpd@5.1.0 on crates.io
  • cpd@5.1.0 on npm
  • jscpd@5.1.0 on npm
  • jscpd-darwin-arm64@5.1.0 on npm
  • jscpd-darwin-x64@5.1.0 on npm
  • jscpd-linux-x64-gnu@5.1.0 on npm
  • jscpd-linux-arm64-gnu@5.1.0 on npm
  • jscpd-linux-x64-musl@5.1.0 on npm
  • jscpd-windows-x64-msvc@5.1.0 on npm
  • jscpd-windows-arm64-msvc@5.1.0 on npm

v5.0.16

Compare Source

New Features
  • MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)
Security
  • Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch
Bug Fixes
  • GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line
Thank You ❤️
  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine

v5.0.15

Compare Source

New Features
  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
  • SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)
Bug Fixes
  • Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
  • Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
  • Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
  • Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root
Thank You ❤️

v5.0.14

Compare Source

New Features
  • --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)
Bug Fixes
  • Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)

v5.0.12

Compare Source

Dependencies
  • Rust dependency updates (askama 0.16.0, log 0.4.33, env_logger 0.11.11, rustc-hash 2.1.3)

v5.0.11

Compare Source

New Features
Dependencies
  • cpd-core bumped to 0.1.6, cpd-tokenizer bumped to 0.1.7

v5.0.10

Compare Source

Bug Fixes
  • Emit scan-root-relative paths in all reporters when absolute: false. Fixes #​827
  • Fix --skip-local to match jscpd v4 TypeScript semantics
Refactoring
  • DRY duplication in reporters: extract shared helpers into cpd-reporter/src/shared.rs
  • Move blame enrichment from gitoxide to git blame --porcelain

v5.0.9

Compare Source

New Features
  • GitHub Action for jscpd (Rust v5) — jscpd-copy-paste-detector action for GitHub Actions Marketplace. Scan your repo for copy/paste in CI with uses: kucherenko/jscpd/.github/workflows/action.yml@v5
Bug Fixes
  • Resolve platform binary resolution when cpd is installed as a nested dependency (e.g. in a project's node_modules via a parent package). The runner now correctly locates the platform-specific binary relative to the installed package rather than assuming a top-level install. Fixes #​816

v5.0.8

Compare Source

Bug Fixes
  • Prevent mmap exhaustion crashes when scanning repositories with more files than vm.max_map_count (default 131 072 on Linux). The walker previously held a live Mmap per discovered file; each rayon worker now opens and drops its mapping within the processing closure, capping concurrent mappings to the thread-pool size (typically 8–32). Fixes #​813
  • Fix --pattern not matching relative paths when the scan root is absolute (e.g. CWD). Patterns like src/**/*.ts now match correctly by comparing against both the relative path and the full absolute path, and bare patterns like *.ts gain a **/ prefix to match at any depth. Fixes #​811
  • Fix trailing-newline off-by-one in line-count filter: files not ending with \n now count the final line correctly

v5.0.7

Compare Source

Bug Fixes
  • Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's test/bundler with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon ThreadPool with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
  • Default --max-size to 1mb — files exceeding the limit are skipped at walk time, consistent with jscpd v4's maxSize behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
  • --workers N now correctly takes effect on every run() call (previously build_global() silently no-op'd after the first invocation)

v5.0.6

Compare Source

New Features
  • v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
  • ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
  • .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
  • jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
  • --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
  • Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #​808)
Bug Fixes
  • Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
  • Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)

v5.0.5

Compare Source

v5.0.4

Compare Source

New Features
  • CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
  • Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
  • Side-by-side blame comparison in console-full reporter
  • Clone list display in console reporter
Bug Fixes
  • HTML reporter now outputs jscpd-report.html at the output_dir root
  • Resolved all clippy warnings across workspace
  • Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@w3nl

w3nl commented Jun 8, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

✅ Snyk checks have passed. No issues have been found so far.

StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch 7 times, most recently from 93c7fbf to 9d888ecCompareJune 13, 2026 08:57
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch 5 times, most recently from edf3e6e to 7c1f436CompareJune 23, 2026 19:31
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch 2 times, most recently from cf3fc18 to 988d6eeCompareJuly 3, 2026 14:44
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch 4 times, most recently from a5854a1 to 1252eecCompareJuly 14, 2026 10:14
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch from 1252eec to a7cac6dCompareJuly 15, 2026 19:26
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch 3 times, most recently from eed0d8c to d3798c3CompareJuly 27, 2026 10:50
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch 2 times, most recently from 4316976 to b54b9a7CompareAugust 8, 2026 01:56
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch 5 times, most recently from c2cead5 to 5fee554CompareAugust 18, 2026 14:39
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch 2 times, most recently from 2b801f8 to d5247b6CompareAugust 26, 2026 00:09
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch 3 times, most recently from 0fb9993 to 544c792CompareSeptember 1, 2026 19:44
@renovate
renovateBotforce-pushed the renovate/jscpd-5.x branch from 544c792 to 6065709CompareSeptember 3, 2026 09:33
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@w3nl
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(deps): update dependency jscpd to v5 - #519
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Open
chore(deps): update dependency jscpd to v5#519
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
jscpd (source)^4.0.5 → ^5.0.0ageconfidence
Release Notes
kucherenko/jscpd (jscpd)
v5.1.2
Compare Source
New Features
  • Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#​988)
  • cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#​988)
  • Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#​988)
Bug Fixes
  • jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#​988)
  • Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#​988)
  • pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#​989)
  • Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#​988)
Other
  • Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#​989, #​990)
  • Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#​988)
  • crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#​988)
  • Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#​988)
  • CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#​988, #​989)
Dependencies
  • Bump quick-xml to 0.42.0 in /rust (#​991)
Published Packages
  • cpd-core@0.1.11 on crates.io
  • cpd-finder@0.1.14 on crates.io
  • cpd-reporter@0.1.12 on crates.io
  • cpd-tokenizer@0.1.13 on crates.io
  • jscpd@5.1.2 on crates.io
  • cpd@5.1.2 on npm
  • jscpd@5.1.2 on npm
  • jscpd-darwin-arm64@5.1.2 on npm
  • jscpd-darwin-x64@5.1.2 on npm
  • jscpd-linux-x64-gnu@5.1.2 on npm
  • jscpd-linux-arm64-gnu@5.1.2 on npm
  • jscpd-linux-x64-musl@5.1.2 on npm
  • jscpd-linux-arm64-musl@5.1.2 on npm
  • jscpd-windows-x64-msvc@5.1.2 on npm
  • jscpd-windows-arm64-msvc@5.1.2 on npm
Verify
Archives are signed with Sigstore (keyless, <asset>.sigstore.json)

and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:
cosign verify-blob \
--bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
--certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt
v5.1.1
Compare Source
Bug Fixes
  • jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.
    The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.
Other
  • Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.13 on crates.io
  • cpd-reporter@0.1.11 on crates.io
  • cpd-tokenizer@0.1.12 on crates.io
  • jscpd@5.1.1 on crates.io
  • cpd@5.1.1 on npm
  • jscpd@5.1.1 on npm
  • jscpd-darwin-arm64@5.1.1 on npm
  • jscpd-darwin-x64@5.1.1 on npm
  • jscpd-linux-x64-gnu@5.1.1 on npm
  • jscpd-linux-arm64-gnu@5.1.1 on npm
  • jscpd-linux-x64-musl@5.1.1 on npm
  • jscpd-windows-x64-msvc@5.1.1 on npm
  • jscpd-windows-arm64-msvc@5.1.1 on npm
v5.1.0
Compare Source
New Features
  • Windows on ARM support — npm installs now select a native aarch64-pc-windows-msvc binary from the jscpd-windows-arm64-msvc platform package on Windows ARM64.
  • Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only. A committed baseline file (e.g. .jscpd-baseline.json) records content-hash fingerprints of accepted clones (the same hash the SARIF reporter emits as partialFingerprints["jscpdCloneHash/v1"], with a multiplicity count per fingerprint); clones absent from it are reported as new, and --fail-on-new-clones[=N] exits 1 when more than N (default 0) new clones are found — independently of --threshold, so legacy duplication is tolerated while regressions fail the build. --update-baseline rewrites the file from the current run (creating it if missing) and prints added/removed fingerprint counts so baseline growth stays visible in CI logs and PR review. The baseline file is versioned, sorted one fingerprint per line for reviewable diffs and trivial merges, and configurable via the baseline / failOnNewClones config keys. New-clone info flows through the reporters: [NEW] markers and a "(N new)" found-count in console/console-full, per-clone isNew plus the newClones / newDuplicatedLines statistics in json, level error in sarif, and jscpd_new_clones / jscpd_new_duplicated_lines gauges in openmetrics. (#​944)
  • Ephemeral baseline from a git ref (--baseline-from-ref) — stateless variant of the clone baseline for PR gates without a committed file: cpd --baseline-from-ref origin/main --fail-on-new-clones . checks the base ref's tree out into a temporary detached git worktree (removed afterwards; shells out to git like blame does), scans it with the same detection configuration, and compares the current run against that in-memory fingerprint set — clones absent from the base ref are new. Costs a second scan of the corpus, where the committed --baseline file needs only one. When the ref is missing (shallow CI checkout) it fails with a clear hint to git fetch origin main or use fetch-depth: 0. Config key baselineFromRef; conflicts with --baseline / --update-baseline. (#​944)
  • OpenMetrics reporter (--reporters openmetrics) — writes jscpd-metrics.txt in the OpenMetrics text exposition format, ready to be declared as a GitLab CI artifacts:reports:metrics artifact so merge requests show duplication metric changes against the target branch. Exposes gauges for files/lines/tokens analyzed, clones found, duplicated lines/tokens with percentages (project total plus a format-labeled sample per format), and detection duration in seconds. (#​422)
  • CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — writes gl-code-quality-report.json (the filename GitLab's docs use) in the CodeClimate issue format, restricted to the subset GitLab defines as its Code Quality report format, ready to be declared as an artifacts:reports:codequality artifact so duplicates appear as code quality issues in merge requests — unlike the SARIF reporter, which GitLab ingests as security vulnerability findings. Each clone yields an issue per fragment (each describing the other location, plus the CodeClimate other_locations field), with a deterministic fingerprint derived from the clone's content hash so GitLab can tell new issues from pre-existing ones across pipeline runs. Severity is minor, escalating to major for clones absent from a configured baseline or when the run exceeds --threshold. (#​958)
  • Config discovery in .config/ (dot-config convention) — auto-discovery now also checks .config/jscpd.json (and .config/.jscpd.json) per the dot-config convention, between the root .jscpd.json and the package.jsonjscpd key. A root .jscpd.json still wins, so existing setups are unaffected; paths inside the config resolve against the working directory, as with other auto-discovered sources. (#​979)
Bug Fixes
  • Unknown --format values warn instead of silently matching nothing — a typo like --format cs (instead of csharp) used to scan 0 files and exit 0, indistinguishable from a clean codebase in CI. The CLI now prints a stderr warning naming the unsupported value and pointing to --list; custom formats declared via --formats-exts stay accepted. (#​964)
  • Nix flake builds again — the flake pinned the hash of the mutable channel-rust-1.97.toml manifest, which broke with a fixed-output hash mismatch when Rust 1.97.1 was published. The toolchain is now pinned to the exact patch version (immutable manifest), so the hash can no longer drift. (#​976)
  • Windows: --baseline-from-ref no longer reports every clone as new — the format-suffix stripper treated the drive colon in Windows verbatim paths (\\?\C:\..., the form canonicalize returns) as a :format suffix and truncated the base scan's source ids to \\?\C, so every snippet read behind the fingerprint computation failed silently and the ephemeral baseline never matched. A colon followed by a path separator is now recognized as structural. Clone fingerprints are also line-ending agnostic now (CR stripped before hashing), so committed baselines survive CRLF/LF differences between platforms.
Other
  • Glama MCP listing — the repository now ships a glama.json maintainer manifest and a Dockerfile that runs the stdio MCP server (jscpd --mcp), used by Glama to build and score the server listing
  • Signed releases — release artifacts are signed with SLSA provenance, and piped downloads in workflows are pinned (OpenSSF Scorecard)
Dependencies
  • Bump Rust toolchain to 1.97.1 and oxc crates to 0.147 in /rust
  • Bump thiserror to 2.0.20, globset to 0.4.20, ignore to 0.4.33, log to 0.4.34 in /rust
Thank You ❤️
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.12 on crates.io
  • cpd-reporter@0.1.10 on crates.io
  • cpd-tokenizer@0.1.11 on crates.io
  • jscpd@5.1.0 on crates.io
  • cpd@5.1.0 on npm
  • jscpd@5.1.0 on npm
  • jscpd-darwin-arm64@5.1.0 on npm
  • jscpd-darwin-x64@5.1.0 on npm
  • jscpd-linux-x64-gnu@5.1.0 on npm
  • jscpd-linux-arm64-gnu@5.1.0 on npm
  • jscpd-linux-x64-musl@5.1.0 on npm
  • jscpd-windows-x64-msvc@5.1.0 on npm
  • jscpd-windows-arm64-msvc@5.1.0 on npm
v5.0.16
Compare Source
New Features
  • MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)
Security
  • Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch
Bug Fixes
  • GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line
Thank You ❤️
  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine
v5.0.15
Compare Source
New Features
  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
  • SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)
Bug Fixes
  • Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
  • Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
  • Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
  • Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root
Thank You ❤️
v5.0.14
Compare Source
New Features
  • --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)
Bug Fixes
  • Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)
v5.0.12
Compare Source
Dependencies
  • Rust dependency updates (askama 0.16.0, log 0.4.33, env_logger 0.11.11, rustc-hash 2.1.3)
v5.0.11
Compare Source
New Features
Dependencies
  • cpd-core bumped to 0.1.6, cpd-tokenizer bumped to 0.1.7
v5.0.10
Compare Source
Bug Fixes
  • Emit scan-root-relative paths in all reporters when absolute: false. Fixes #​827
  • Fix --skip-local to match jscpd v4 TypeScript semantics
Refactoring
  • DRY duplication in reporters: extract shared helpers into cpd-reporter/src/shared.rs
  • Move blame enrichment from gitoxide to git blame --porcelain
v5.0.9
Compare Source
New Features
  • GitHub Action for jscpd (Rust v5) — jscpd-copy-paste-detector action for GitHub Actions Marketplace. Scan your repo for copy/paste in CI with uses: kucherenko/jscpd/.github/workflows/action.yml@v5
Bug Fixes
  • Resolve platform binary resolution when cpd is installed as a nested dependency (e.g. in a project's node_modules via a parent package). The runner now correctly locates the platform-specific binary relative to the installed package rather than assuming a top-level install. Fixes #​816
v5.0.8
Compare Source
Bug Fixes
  • Prevent mmap exhaustion crashes when scanning repositories with more files than vm.max_map_count (default 131 072 on Linux). The walker previously held a live Mmap per discovered file; each rayon worker now opens and drops its mapping within the processing closure, capping concurrent mappings to the thread-pool size (typically 8–32). Fixes #​813
  • Fix --pattern not matching relative paths when the scan root is absolute (e.g. CWD). Patterns like src/**/*.ts now match correctly by comparing against both the relative path and the full absolute path, and bare patterns like *.ts gain a **/ prefix to match at any depth. Fixes #​811
  • Fix trailing-newline off-by-one in line-count filter: files not ending with \n now count the final line correctly
v5.0.7
Compare Source
Bug Fixes
  • Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's test/bundler with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon ThreadPool with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
  • Default --max-size to 1mb — files exceeding the limit are skipped at walk time, consistent with jscpd v4's maxSize behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
  • --workers N now correctly takes effect on every run() call (previously build_global() silently no-op'd after the first invocation)
v5.0.6
Compare Source
New Features
  • v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
  • ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
  • .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
  • jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
  • --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
  • Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #​808)
Bug Fixes
  • Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
  • Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)
v5.0.5
Compare Source
v5.0.4
Compare Source
New Features
  • CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
  • Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
  • Side-by-side blame comparison in console-full reporter
  • Clone list display in console reporter
Bug Fixes
  • HTML reporter now outputs jscpd-report.html at the output_dir root
  • Resolved all clippy warnings across workspace
  • Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@w3nl
w3nl
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
7 times, most recently
from
93c7fbf to
9d888ecCompareJune 13, 2026 08:57
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
edf3e6e to
7c1f436CompareJune 23, 2026 19:31
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
cf3fc18 to
988d6eeCompareJuly 3, 2026 14:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
4 times, most recently
from
a5854a1 to
1252eecCompareJuly 14, 2026 10:14
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
1252eec to
a7cac6dCompareJuly 15, 2026 19:26
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
eed0d8c to
d3798c3CompareJuly 27, 2026 10:50
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
4316976 to
b54b9a7CompareAugust 8, 2026 01:56
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
c2cead5 to
5fee554CompareAugust 18, 2026 14:39
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
2b801f8 to
d5247b6CompareAugust 26, 2026 00:09
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
0fb9993 to
544c792CompareSeptember 1, 2026 19:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
544c792 to
6065709CompareSeptember 3, 2026 09:33
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@w3nl

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency jscpd to v5 - #519
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Open
chore(deps): update dependency jscpd to v5#519
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
jscpd (source)^4.0.5 → ^5.0.0ageconfidence
Release Notes
kucherenko/jscpd (jscpd)
v5.1.2
Compare Source
New Features
  • Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#​988)
  • cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#​988)
  • Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#​988)
Bug Fixes
  • jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#​988)
  • Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#​988)
  • pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#​989)
  • Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#​988)
Other
  • Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#​989, #​990)
  • Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#​988)
  • crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#​988)
  • Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#​988)
  • CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#​988, #​989)
Dependencies
  • Bump quick-xml to 0.42.0 in /rust (#​991)
Published Packages
  • cpd-core@0.1.11 on crates.io
  • cpd-finder@0.1.14 on crates.io
  • cpd-reporter@0.1.12 on crates.io
  • cpd-tokenizer@0.1.13 on crates.io
  • jscpd@5.1.2 on crates.io
  • cpd@5.1.2 on npm
  • jscpd@5.1.2 on npm
  • jscpd-darwin-arm64@5.1.2 on npm
  • jscpd-darwin-x64@5.1.2 on npm
  • jscpd-linux-x64-gnu@5.1.2 on npm
  • jscpd-linux-arm64-gnu@5.1.2 on npm
  • jscpd-linux-x64-musl@5.1.2 on npm
  • jscpd-linux-arm64-musl@5.1.2 on npm
  • jscpd-windows-x64-msvc@5.1.2 on npm
  • jscpd-windows-arm64-msvc@5.1.2 on npm
Verify
Archives are signed with Sigstore (keyless, <asset>.sigstore.json)

and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:
cosign verify-blob \
--bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
--certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt
v5.1.1
Compare Source
Bug Fixes
  • jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.
    The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.
Other
  • Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.13 on crates.io
  • cpd-reporter@0.1.11 on crates.io
  • cpd-tokenizer@0.1.12 on crates.io
  • jscpd@5.1.1 on crates.io
  • cpd@5.1.1 on npm
  • jscpd@5.1.1 on npm
  • jscpd-darwin-arm64@5.1.1 on npm
  • jscpd-darwin-x64@5.1.1 on npm
  • jscpd-linux-x64-gnu@5.1.1 on npm
  • jscpd-linux-arm64-gnu@5.1.1 on npm
  • jscpd-linux-x64-musl@5.1.1 on npm
  • jscpd-windows-x64-msvc@5.1.1 on npm
  • jscpd-windows-arm64-msvc@5.1.1 on npm
v5.1.0
Compare Source
New Features
  • Windows on ARM support — npm installs now select a native aarch64-pc-windows-msvc binary from the jscpd-windows-arm64-msvc platform package on Windows ARM64.
  • Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only. A committed baseline file (e.g. .jscpd-baseline.json) records content-hash fingerprints of accepted clones (the same hash the SARIF reporter emits as partialFingerprints["jscpdCloneHash/v1"], with a multiplicity count per fingerprint); clones absent from it are reported as new, and --fail-on-new-clones[=N] exits 1 when more than N (default 0) new clones are found — independently of --threshold, so legacy duplication is tolerated while regressions fail the build. --update-baseline rewrites the file from the current run (creating it if missing) and prints added/removed fingerprint counts so baseline growth stays visible in CI logs and PR review. The baseline file is versioned, sorted one fingerprint per line for reviewable diffs and trivial merges, and configurable via the baseline / failOnNewClones config keys. New-clone info flows through the reporters: [NEW] markers and a "(N new)" found-count in console/console-full, per-clone isNew plus the newClones / newDuplicatedLines statistics in json, level error in sarif, and jscpd_new_clones / jscpd_new_duplicated_lines gauges in openmetrics. (#​944)
  • Ephemeral baseline from a git ref (--baseline-from-ref) — stateless variant of the clone baseline for PR gates without a committed file: cpd --baseline-from-ref origin/main --fail-on-new-clones . checks the base ref's tree out into a temporary detached git worktree (removed afterwards; shells out to git like blame does), scans it with the same detection configuration, and compares the current run against that in-memory fingerprint set — clones absent from the base ref are new. Costs a second scan of the corpus, where the committed --baseline file needs only one. When the ref is missing (shallow CI checkout) it fails with a clear hint to git fetch origin main or use fetch-depth: 0. Config key baselineFromRef; conflicts with --baseline / --update-baseline. (#​944)
  • OpenMetrics reporter (--reporters openmetrics) — writes jscpd-metrics.txt in the OpenMetrics text exposition format, ready to be declared as a GitLab CI artifacts:reports:metrics artifact so merge requests show duplication metric changes against the target branch. Exposes gauges for files/lines/tokens analyzed, clones found, duplicated lines/tokens with percentages (project total plus a format-labeled sample per format), and detection duration in seconds. (#​422)
  • CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — writes gl-code-quality-report.json (the filename GitLab's docs use) in the CodeClimate issue format, restricted to the subset GitLab defines as its Code Quality report format, ready to be declared as an artifacts:reports:codequality artifact so duplicates appear as code quality issues in merge requests — unlike the SARIF reporter, which GitLab ingests as security vulnerability findings. Each clone yields an issue per fragment (each describing the other location, plus the CodeClimate other_locations field), with a deterministic fingerprint derived from the clone's content hash so GitLab can tell new issues from pre-existing ones across pipeline runs. Severity is minor, escalating to major for clones absent from a configured baseline or when the run exceeds --threshold. (#​958)
  • Config discovery in .config/ (dot-config convention) — auto-discovery now also checks .config/jscpd.json (and .config/.jscpd.json) per the dot-config convention, between the root .jscpd.json and the package.jsonjscpd key. A root .jscpd.json still wins, so existing setups are unaffected; paths inside the config resolve against the working directory, as with other auto-discovered sources. (#​979)
Bug Fixes
  • Unknown --format values warn instead of silently matching nothing — a typo like --format cs (instead of csharp) used to scan 0 files and exit 0, indistinguishable from a clean codebase in CI. The CLI now prints a stderr warning naming the unsupported value and pointing to --list; custom formats declared via --formats-exts stay accepted. (#​964)
  • Nix flake builds again — the flake pinned the hash of the mutable channel-rust-1.97.toml manifest, which broke with a fixed-output hash mismatch when Rust 1.97.1 was published. The toolchain is now pinned to the exact patch version (immutable manifest), so the hash can no longer drift. (#​976)
  • Windows: --baseline-from-ref no longer reports every clone as new — the format-suffix stripper treated the drive colon in Windows verbatim paths (\\?\C:\..., the form canonicalize returns) as a :format suffix and truncated the base scan's source ids to \\?\C, so every snippet read behind the fingerprint computation failed silently and the ephemeral baseline never matched. A colon followed by a path separator is now recognized as structural. Clone fingerprints are also line-ending agnostic now (CR stripped before hashing), so committed baselines survive CRLF/LF differences between platforms.
Other
  • Glama MCP listing — the repository now ships a glama.json maintainer manifest and a Dockerfile that runs the stdio MCP server (jscpd --mcp), used by Glama to build and score the server listing
  • Signed releases — release artifacts are signed with SLSA provenance, and piped downloads in workflows are pinned (OpenSSF Scorecard)
Dependencies
  • Bump Rust toolchain to 1.97.1 and oxc crates to 0.147 in /rust
  • Bump thiserror to 2.0.20, globset to 0.4.20, ignore to 0.4.33, log to 0.4.34 in /rust
Thank You ❤️
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.12 on crates.io
  • cpd-reporter@0.1.10 on crates.io
  • cpd-tokenizer@0.1.11 on crates.io
  • jscpd@5.1.0 on crates.io
  • cpd@5.1.0 on npm
  • jscpd@5.1.0 on npm
  • jscpd-darwin-arm64@5.1.0 on npm
  • jscpd-darwin-x64@5.1.0 on npm
  • jscpd-linux-x64-gnu@5.1.0 on npm
  • jscpd-linux-arm64-gnu@5.1.0 on npm
  • jscpd-linux-x64-musl@5.1.0 on npm
  • jscpd-windows-x64-msvc@5.1.0 on npm
  • jscpd-windows-arm64-msvc@5.1.0 on npm
v5.0.16
Compare Source
New Features
  • MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)
Security
  • Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch
Bug Fixes
  • GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line
Thank You ❤️
  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine
v5.0.15
Compare Source
New Features
  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
  • SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)
Bug Fixes
  • Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
  • Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
  • Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
  • Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root
Thank You ❤️
v5.0.14
Compare Source
New Features
  • --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)
Bug Fixes
  • Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)
v5.0.12
Compare Source
Dependencies
  • Rust dependency updates (askama 0.16.0, log 0.4.33, env_logger 0.11.11, rustc-hash 2.1.3)
v5.0.11
Compare Source
New Features
Dependencies
  • cpd-core bumped to 0.1.6, cpd-tokenizer bumped to 0.1.7
v5.0.10
Compare Source
Bug Fixes
  • Emit scan-root-relative paths in all reporters when absolute: false. Fixes #​827
  • Fix --skip-local to match jscpd v4 TypeScript semantics
Refactoring
  • DRY duplication in reporters: extract shared helpers into cpd-reporter/src/shared.rs
  • Move blame enrichment from gitoxide to git blame --porcelain
v5.0.9
Compare Source
New Features
  • GitHub Action for jscpd (Rust v5) — jscpd-copy-paste-detector action for GitHub Actions Marketplace. Scan your repo for copy/paste in CI with uses: kucherenko/jscpd/.github/workflows/action.yml@v5
Bug Fixes
  • Resolve platform binary resolution when cpd is installed as a nested dependency (e.g. in a project's node_modules via a parent package). The runner now correctly locates the platform-specific binary relative to the installed package rather than assuming a top-level install. Fixes #​816
v5.0.8
Compare Source
Bug Fixes
  • Prevent mmap exhaustion crashes when scanning repositories with more files than vm.max_map_count (default 131 072 on Linux). The walker previously held a live Mmap per discovered file; each rayon worker now opens and drops its mapping within the processing closure, capping concurrent mappings to the thread-pool size (typically 8–32). Fixes #​813
  • Fix --pattern not matching relative paths when the scan root is absolute (e.g. CWD). Patterns like src/**/*.ts now match correctly by comparing against both the relative path and the full absolute path, and bare patterns like *.ts gain a **/ prefix to match at any depth. Fixes #​811
  • Fix trailing-newline off-by-one in line-count filter: files not ending with \n now count the final line correctly
v5.0.7
Compare Source
Bug Fixes
  • Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's test/bundler with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon ThreadPool with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
  • Default --max-size to 1mb — files exceeding the limit are skipped at walk time, consistent with jscpd v4's maxSize behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
  • --workers N now correctly takes effect on every run() call (previously build_global() silently no-op'd after the first invocation)
v5.0.6
Compare Source
New Features
  • v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
  • ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
  • .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
  • jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
  • --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
  • Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #​808)
Bug Fixes
  • Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
  • Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)
v5.0.5
Compare Source
v5.0.4
Compare Source
New Features
  • CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
  • Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
  • Side-by-side blame comparison in console-full reporter
  • Clone list display in console reporter
Bug Fixes
  • HTML reporter now outputs jscpd-report.html at the output_dir root
  • Resolved all clippy warnings across workspace
  • Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@w3nl
w3nl
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
7 times, most recently
from
93c7fbf to
9d888ecCompareJune 13, 2026 08:57
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
edf3e6e to
7c1f436CompareJune 23, 2026 19:31
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
cf3fc18 to
988d6eeCompareJuly 3, 2026 14:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
4 times, most recently
from
a5854a1 to
1252eecCompareJuly 14, 2026 10:14
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
1252eec to
a7cac6dCompareJuly 15, 2026 19:26
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
eed0d8c to
d3798c3CompareJuly 27, 2026 10:50
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
4316976 to
b54b9a7CompareAugust 8, 2026 01:56
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
c2cead5 to
5fee554CompareAugust 18, 2026 14:39
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
2b801f8 to
d5247b6CompareAugust 26, 2026 00:09
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
0fb9993 to
544c792CompareSeptember 1, 2026 19:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
544c792 to
6065709CompareSeptember 3, 2026 09:33
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@w3nl

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency jscpd to v5 - #519
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Open
chore(deps): update dependency jscpd to v5#519
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
jscpd (source)^4.0.5 → ^5.0.0ageconfidence
Release Notes
kucherenko/jscpd (jscpd)
v5.1.2
Compare Source
New Features
  • Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#​988)
  • cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#​988)
  • Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#​988)
Bug Fixes
  • jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#​988)
  • Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#​988)
  • pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#​989)
  • Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#​988)
Other
  • Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#​989, #​990)
  • Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#​988)
  • crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#​988)
  • Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#​988)
  • CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#​988, #​989)
Dependencies
  • Bump quick-xml to 0.42.0 in /rust (#​991)
Published Packages
  • cpd-core@0.1.11 on crates.io
  • cpd-finder@0.1.14 on crates.io
  • cpd-reporter@0.1.12 on crates.io
  • cpd-tokenizer@0.1.13 on crates.io
  • jscpd@5.1.2 on crates.io
  • cpd@5.1.2 on npm
  • jscpd@5.1.2 on npm
  • jscpd-darwin-arm64@5.1.2 on npm
  • jscpd-darwin-x64@5.1.2 on npm
  • jscpd-linux-x64-gnu@5.1.2 on npm
  • jscpd-linux-arm64-gnu@5.1.2 on npm
  • jscpd-linux-x64-musl@5.1.2 on npm
  • jscpd-linux-arm64-musl@5.1.2 on npm
  • jscpd-windows-x64-msvc@5.1.2 on npm
  • jscpd-windows-arm64-msvc@5.1.2 on npm
Verify
Archives are signed with Sigstore (keyless, <asset>.sigstore.json)

and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:
cosign verify-blob \
--bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
--certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt
v5.1.1
Compare Source
Bug Fixes
  • jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.
    The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.
Other
  • Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.13 on crates.io
  • cpd-reporter@0.1.11 on crates.io
  • cpd-tokenizer@0.1.12 on crates.io
  • jscpd@5.1.1 on crates.io
  • cpd@5.1.1 on npm
  • jscpd@5.1.1 on npm
  • jscpd-darwin-arm64@5.1.1 on npm
  • jscpd-darwin-x64@5.1.1 on npm
  • jscpd-linux-x64-gnu@5.1.1 on npm
  • jscpd-linux-arm64-gnu@5.1.1 on npm
  • jscpd-linux-x64-musl@5.1.1 on npm
  • jscpd-windows-x64-msvc@5.1.1 on npm
  • jscpd-windows-arm64-msvc@5.1.1 on npm
v5.1.0
Compare Source
New Features
  • Windows on ARM support — npm installs now select a native aarch64-pc-windows-msvc binary from the jscpd-windows-arm64-msvc platform package on Windows ARM64.
  • Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only. A committed baseline file (e.g. .jscpd-baseline.json) records content-hash fingerprints of accepted clones (the same hash the SARIF reporter emits as partialFingerprints["jscpdCloneHash/v1"], with a multiplicity count per fingerprint); clones absent from it are reported as new, and --fail-on-new-clones[=N] exits 1 when more than N (default 0) new clones are found — independently of --threshold, so legacy duplication is tolerated while regressions fail the build. --update-baseline rewrites the file from the current run (creating it if missing) and prints added/removed fingerprint counts so baseline growth stays visible in CI logs and PR review. The baseline file is versioned, sorted one fingerprint per line for reviewable diffs and trivial merges, and configurable via the baseline / failOnNewClones config keys. New-clone info flows through the reporters: [NEW] markers and a "(N new)" found-count in console/console-full, per-clone isNew plus the newClones / newDuplicatedLines statistics in json, level error in sarif, and jscpd_new_clones / jscpd_new_duplicated_lines gauges in openmetrics. (#​944)
  • Ephemeral baseline from a git ref (--baseline-from-ref) — stateless variant of the clone baseline for PR gates without a committed file: cpd --baseline-from-ref origin/main --fail-on-new-clones . checks the base ref's tree out into a temporary detached git worktree (removed afterwards; shells out to git like blame does), scans it with the same detection configuration, and compares the current run against that in-memory fingerprint set — clones absent from the base ref are new. Costs a second scan of the corpus, where the committed --baseline file needs only one. When the ref is missing (shallow CI checkout) it fails with a clear hint to git fetch origin main or use fetch-depth: 0. Config key baselineFromRef; conflicts with --baseline / --update-baseline. (#​944)
  • OpenMetrics reporter (--reporters openmetrics) — writes jscpd-metrics.txt in the OpenMetrics text exposition format, ready to be declared as a GitLab CI artifacts:reports:metrics artifact so merge requests show duplication metric changes against the target branch. Exposes gauges for files/lines/tokens analyzed, clones found, duplicated lines/tokens with percentages (project total plus a format-labeled sample per format), and detection duration in seconds. (#​422)
  • CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — writes gl-code-quality-report.json (the filename GitLab's docs use) in the CodeClimate issue format, restricted to the subset GitLab defines as its Code Quality report format, ready to be declared as an artifacts:reports:codequality artifact so duplicates appear as code quality issues in merge requests — unlike the SARIF reporter, which GitLab ingests as security vulnerability findings. Each clone yields an issue per fragment (each describing the other location, plus the CodeClimate other_locations field), with a deterministic fingerprint derived from the clone's content hash so GitLab can tell new issues from pre-existing ones across pipeline runs. Severity is minor, escalating to major for clones absent from a configured baseline or when the run exceeds --threshold. (#​958)
  • Config discovery in .config/ (dot-config convention) — auto-discovery now also checks .config/jscpd.json (and .config/.jscpd.json) per the dot-config convention, between the root .jscpd.json and the package.jsonjscpd key. A root .jscpd.json still wins, so existing setups are unaffected; paths inside the config resolve against the working directory, as with other auto-discovered sources. (#​979)
Bug Fixes
  • Unknown --format values warn instead of silently matching nothing — a typo like --format cs (instead of csharp) used to scan 0 files and exit 0, indistinguishable from a clean codebase in CI. The CLI now prints a stderr warning naming the unsupported value and pointing to --list; custom formats declared via --formats-exts stay accepted. (#​964)
  • Nix flake builds again — the flake pinned the hash of the mutable channel-rust-1.97.toml manifest, which broke with a fixed-output hash mismatch when Rust 1.97.1 was published. The toolchain is now pinned to the exact patch version (immutable manifest), so the hash can no longer drift. (#​976)
  • Windows: --baseline-from-ref no longer reports every clone as new — the format-suffix stripper treated the drive colon in Windows verbatim paths (\\?\C:\..., the form canonicalize returns) as a :format suffix and truncated the base scan's source ids to \\?\C, so every snippet read behind the fingerprint computation failed silently and the ephemeral baseline never matched. A colon followed by a path separator is now recognized as structural. Clone fingerprints are also line-ending agnostic now (CR stripped before hashing), so committed baselines survive CRLF/LF differences between platforms.
Other
  • Glama MCP listing — the repository now ships a glama.json maintainer manifest and a Dockerfile that runs the stdio MCP server (jscpd --mcp), used by Glama to build and score the server listing
  • Signed releases — release artifacts are signed with SLSA provenance, and piped downloads in workflows are pinned (OpenSSF Scorecard)
Dependencies
  • Bump Rust toolchain to 1.97.1 and oxc crates to 0.147 in /rust
  • Bump thiserror to 2.0.20, globset to 0.4.20, ignore to 0.4.33, log to 0.4.34 in /rust
Thank You ❤️
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.12 on crates.io
  • cpd-reporter@0.1.10 on crates.io
  • cpd-tokenizer@0.1.11 on crates.io
  • jscpd@5.1.0 on crates.io
  • cpd@5.1.0 on npm
  • jscpd@5.1.0 on npm
  • jscpd-darwin-arm64@5.1.0 on npm
  • jscpd-darwin-x64@5.1.0 on npm
  • jscpd-linux-x64-gnu@5.1.0 on npm
  • jscpd-linux-arm64-gnu@5.1.0 on npm
  • jscpd-linux-x64-musl@5.1.0 on npm
  • jscpd-windows-x64-msvc@5.1.0 on npm
  • jscpd-windows-arm64-msvc@5.1.0 on npm
v5.0.16
Compare Source
New Features
  • MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)
Security
  • Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch
Bug Fixes
  • GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line
Thank You ❤️
  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine
v5.0.15
Compare Source
New Features
  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
  • SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)
Bug Fixes
  • Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
  • Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
  • Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
  • Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root
Thank You ❤️
v5.0.14
Compare Source
New Features
  • --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)
Bug Fixes
  • Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)
v5.0.12
Compare Source
Dependencies
  • Rust dependency updates (askama 0.16.0, log 0.4.33, env_logger 0.11.11, rustc-hash 2.1.3)
v5.0.11
Compare Source
New Features
Dependencies
  • cpd-core bumped to 0.1.6, cpd-tokenizer bumped to 0.1.7
v5.0.10
Compare Source
Bug Fixes
  • Emit scan-root-relative paths in all reporters when absolute: false. Fixes #​827
  • Fix --skip-local to match jscpd v4 TypeScript semantics
Refactoring
  • DRY duplication in reporters: extract shared helpers into cpd-reporter/src/shared.rs
  • Move blame enrichment from gitoxide to git blame --porcelain
v5.0.9
Compare Source
New Features
  • GitHub Action for jscpd (Rust v5) — jscpd-copy-paste-detector action for GitHub Actions Marketplace. Scan your repo for copy/paste in CI with uses: kucherenko/jscpd/.github/workflows/action.yml@v5
Bug Fixes
  • Resolve platform binary resolution when cpd is installed as a nested dependency (e.g. in a project's node_modules via a parent package). The runner now correctly locates the platform-specific binary relative to the installed package rather than assuming a top-level install. Fixes #​816
v5.0.8
Compare Source
Bug Fixes
  • Prevent mmap exhaustion crashes when scanning repositories with more files than vm.max_map_count (default 131 072 on Linux). The walker previously held a live Mmap per discovered file; each rayon worker now opens and drops its mapping within the processing closure, capping concurrent mappings to the thread-pool size (typically 8–32). Fixes #​813
  • Fix --pattern not matching relative paths when the scan root is absolute (e.g. CWD). Patterns like src/**/*.ts now match correctly by comparing against both the relative path and the full absolute path, and bare patterns like *.ts gain a **/ prefix to match at any depth. Fixes #​811
  • Fix trailing-newline off-by-one in line-count filter: files not ending with \n now count the final line correctly
v5.0.7
Compare Source
Bug Fixes
  • Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's test/bundler with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon ThreadPool with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
  • Default --max-size to 1mb — files exceeding the limit are skipped at walk time, consistent with jscpd v4's maxSize behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
  • --workers N now correctly takes effect on every run() call (previously build_global() silently no-op'd after the first invocation)
v5.0.6
Compare Source
New Features
  • v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
  • ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
  • .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
  • jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
  • --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
  • Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #​808)
Bug Fixes
  • Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
  • Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)
v5.0.5
Compare Source
v5.0.4
Compare Source
New Features
  • CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
  • Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
  • Side-by-side blame comparison in console-full reporter
  • Clone list display in console reporter
Bug Fixes
  • HTML reporter now outputs jscpd-report.html at the output_dir root
  • Resolved all clippy warnings across workspace
  • Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@w3nl
w3nl
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
7 times, most recently
from
93c7fbf to
9d888ecCompareJune 13, 2026 08:57
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
edf3e6e to
7c1f436CompareJune 23, 2026 19:31
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
cf3fc18 to
988d6eeCompareJuly 3, 2026 14:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
4 times, most recently
from
a5854a1 to
1252eecCompareJuly 14, 2026 10:14
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
1252eec to
a7cac6dCompareJuly 15, 2026 19:26
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
eed0d8c to
d3798c3CompareJuly 27, 2026 10:50
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
4316976 to
b54b9a7CompareAugust 8, 2026 01:56
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
c2cead5 to
5fee554CompareAugust 18, 2026 14:39
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
2b801f8 to
d5247b6CompareAugust 26, 2026 00:09
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
0fb9993 to
544c792CompareSeptember 1, 2026 19:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
544c792 to
6065709CompareSeptember 3, 2026 09:33
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@w3nl

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(deps): update dependency jscpd to v5 - #519
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Open
chore(deps): update dependency jscpd to v5#519
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
jscpd (source)^4.0.5 → ^5.0.0ageconfidence
Release Notes
kucherenko/jscpd (jscpd)
v5.1.2
Compare Source
New Features
  • Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#​988)
  • cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#​988)
  • Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#​988)
Bug Fixes
  • jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#​988)
  • Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#​988)
  • pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#​989)
  • Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#​988)
Other
  • Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#​989, #​990)
  • Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#​988)
  • crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#​988)
  • Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#​988)
  • CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#​988, #​989)
Dependencies
  • Bump quick-xml to 0.42.0 in /rust (#​991)
Published Packages
  • cpd-core@0.1.11 on crates.io
  • cpd-finder@0.1.14 on crates.io
  • cpd-reporter@0.1.12 on crates.io
  • cpd-tokenizer@0.1.13 on crates.io
  • jscpd@5.1.2 on crates.io
  • cpd@5.1.2 on npm
  • jscpd@5.1.2 on npm
  • jscpd-darwin-arm64@5.1.2 on npm
  • jscpd-darwin-x64@5.1.2 on npm
  • jscpd-linux-x64-gnu@5.1.2 on npm
  • jscpd-linux-arm64-gnu@5.1.2 on npm
  • jscpd-linux-x64-musl@5.1.2 on npm
  • jscpd-linux-arm64-musl@5.1.2 on npm
  • jscpd-windows-x64-msvc@5.1.2 on npm
  • jscpd-windows-arm64-msvc@5.1.2 on npm
Verify
Archives are signed with Sigstore (keyless, <asset>.sigstore.json)

and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:
cosign verify-blob \
--bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
--certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt
v5.1.1
Compare Source
Bug Fixes
  • jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.
    The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.
Other
  • Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.13 on crates.io
  • cpd-reporter@0.1.11 on crates.io
  • cpd-tokenizer@0.1.12 on crates.io
  • jscpd@5.1.1 on crates.io
  • cpd@5.1.1 on npm
  • jscpd@5.1.1 on npm
  • jscpd-darwin-arm64@5.1.1 on npm
  • jscpd-darwin-x64@5.1.1 on npm
  • jscpd-linux-x64-gnu@5.1.1 on npm
  • jscpd-linux-arm64-gnu@5.1.1 on npm
  • jscpd-linux-x64-musl@5.1.1 on npm
  • jscpd-windows-x64-msvc@5.1.1 on npm
  • jscpd-windows-arm64-msvc@5.1.1 on npm
v5.1.0
Compare Source
New Features
  • Windows on ARM support — npm installs now select a native aarch64-pc-windows-msvc binary from the jscpd-windows-arm64-msvc platform package on Windows ARM64.
  • Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only. A committed baseline file (e.g. .jscpd-baseline.json) records content-hash fingerprints of accepted clones (the same hash the SARIF reporter emits as partialFingerprints["jscpdCloneHash/v1"], with a multiplicity count per fingerprint); clones absent from it are reported as new, and --fail-on-new-clones[=N] exits 1 when more than N (default 0) new clones are found — independently of --threshold, so legacy duplication is tolerated while regressions fail the build. --update-baseline rewrites the file from the current run (creating it if missing) and prints added/removed fingerprint counts so baseline growth stays visible in CI logs and PR review. The baseline file is versioned, sorted one fingerprint per line for reviewable diffs and trivial merges, and configurable via the baseline / failOnNewClones config keys. New-clone info flows through the reporters: [NEW] markers and a "(N new)" found-count in console/console-full, per-clone isNew plus the newClones / newDuplicatedLines statistics in json, level error in sarif, and jscpd_new_clones / jscpd_new_duplicated_lines gauges in openmetrics. (#​944)
  • Ephemeral baseline from a git ref (--baseline-from-ref) — stateless variant of the clone baseline for PR gates without a committed file: cpd --baseline-from-ref origin/main --fail-on-new-clones . checks the base ref's tree out into a temporary detached git worktree (removed afterwards; shells out to git like blame does), scans it with the same detection configuration, and compares the current run against that in-memory fingerprint set — clones absent from the base ref are new. Costs a second scan of the corpus, where the committed --baseline file needs only one. When the ref is missing (shallow CI checkout) it fails with a clear hint to git fetch origin main or use fetch-depth: 0. Config key baselineFromRef; conflicts with --baseline / --update-baseline. (#​944)
  • OpenMetrics reporter (--reporters openmetrics) — writes jscpd-metrics.txt in the OpenMetrics text exposition format, ready to be declared as a GitLab CI artifacts:reports:metrics artifact so merge requests show duplication metric changes against the target branch. Exposes gauges for files/lines/tokens analyzed, clones found, duplicated lines/tokens with percentages (project total plus a format-labeled sample per format), and detection duration in seconds. (#​422)
  • CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — writes gl-code-quality-report.json (the filename GitLab's docs use) in the CodeClimate issue format, restricted to the subset GitLab defines as its Code Quality report format, ready to be declared as an artifacts:reports:codequality artifact so duplicates appear as code quality issues in merge requests — unlike the SARIF reporter, which GitLab ingests as security vulnerability findings. Each clone yields an issue per fragment (each describing the other location, plus the CodeClimate other_locations field), with a deterministic fingerprint derived from the clone's content hash so GitLab can tell new issues from pre-existing ones across pipeline runs. Severity is minor, escalating to major for clones absent from a configured baseline or when the run exceeds --threshold. (#​958)
  • Config discovery in .config/ (dot-config convention) — auto-discovery now also checks .config/jscpd.json (and .config/.jscpd.json) per the dot-config convention, between the root .jscpd.json and the package.jsonjscpd key. A root .jscpd.json still wins, so existing setups are unaffected; paths inside the config resolve against the working directory, as with other auto-discovered sources. (#​979)
Bug Fixes
  • Unknown --format values warn instead of silently matching nothing — a typo like --format cs (instead of csharp) used to scan 0 files and exit 0, indistinguishable from a clean codebase in CI. The CLI now prints a stderr warning naming the unsupported value and pointing to --list; custom formats declared via --formats-exts stay accepted. (#​964)
  • Nix flake builds again — the flake pinned the hash of the mutable channel-rust-1.97.toml manifest, which broke with a fixed-output hash mismatch when Rust 1.97.1 was published. The toolchain is now pinned to the exact patch version (immutable manifest), so the hash can no longer drift. (#​976)
  • Windows: --baseline-from-ref no longer reports every clone as new — the format-suffix stripper treated the drive colon in Windows verbatim paths (\\?\C:\..., the form canonicalize returns) as a :format suffix and truncated the base scan's source ids to \\?\C, so every snippet read behind the fingerprint computation failed silently and the ephemeral baseline never matched. A colon followed by a path separator is now recognized as structural. Clone fingerprints are also line-ending agnostic now (CR stripped before hashing), so committed baselines survive CRLF/LF differences between platforms.
Other
  • Glama MCP listing — the repository now ships a glama.json maintainer manifest and a Dockerfile that runs the stdio MCP server (jscpd --mcp), used by Glama to build and score the server listing
  • Signed releases — release artifacts are signed with SLSA provenance, and piped downloads in workflows are pinned (OpenSSF Scorecard)
Dependencies
  • Bump Rust toolchain to 1.97.1 and oxc crates to 0.147 in /rust
  • Bump thiserror to 2.0.20, globset to 0.4.20, ignore to 0.4.33, log to 0.4.34 in /rust
Thank You ❤️
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.12 on crates.io
  • cpd-reporter@0.1.10 on crates.io
  • cpd-tokenizer@0.1.11 on crates.io
  • jscpd@5.1.0 on crates.io
  • cpd@5.1.0 on npm
  • jscpd@5.1.0 on npm
  • jscpd-darwin-arm64@5.1.0 on npm
  • jscpd-darwin-x64@5.1.0 on npm
  • jscpd-linux-x64-gnu@5.1.0 on npm
  • jscpd-linux-arm64-gnu@5.1.0 on npm
  • jscpd-linux-x64-musl@5.1.0 on npm
  • jscpd-windows-x64-msvc@5.1.0 on npm
  • jscpd-windows-arm64-msvc@5.1.0 on npm
v5.0.16
Compare Source
New Features
  • MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)
Security
  • Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch
Bug Fixes
  • GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line
Thank You ❤️
  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine
v5.0.15
Compare Source
New Features
  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
  • SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)
Bug Fixes
  • Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
  • Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
  • Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
  • Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root
Thank You ❤️
v5.0.14
Compare Source
New Features
  • --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)
Bug Fixes
  • Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)
v5.0.12
Compare Source
Dependencies
  • Rust dependency updates (askama 0.16.0, log 0.4.33, env_logger 0.11.11, rustc-hash 2.1.3)
v5.0.11
Compare Source
New Features
Dependencies
  • cpd-core bumped to 0.1.6, cpd-tokenizer bumped to 0.1.7
v5.0.10
Compare Source
Bug Fixes
  • Emit scan-root-relative paths in all reporters when absolute: false. Fixes #​827
  • Fix --skip-local to match jscpd v4 TypeScript semantics
Refactoring
  • DRY duplication in reporters: extract shared helpers into cpd-reporter/src/shared.rs
  • Move blame enrichment from gitoxide to git blame --porcelain
v5.0.9
Compare Source
New Features
  • GitHub Action for jscpd (Rust v5) — jscpd-copy-paste-detector action for GitHub Actions Marketplace. Scan your repo for copy/paste in CI with uses: kucherenko/jscpd/.github/workflows/action.yml@v5
Bug Fixes
  • Resolve platform binary resolution when cpd is installed as a nested dependency (e.g. in a project's node_modules via a parent package). The runner now correctly locates the platform-specific binary relative to the installed package rather than assuming a top-level install. Fixes #​816
v5.0.8
Compare Source
Bug Fixes
  • Prevent mmap exhaustion crashes when scanning repositories with more files than vm.max_map_count (default 131 072 on Linux). The walker previously held a live Mmap per discovered file; each rayon worker now opens and drops its mapping within the processing closure, capping concurrent mappings to the thread-pool size (typically 8–32). Fixes #​813
  • Fix --pattern not matching relative paths when the scan root is absolute (e.g. CWD). Patterns like src/**/*.ts now match correctly by comparing against both the relative path and the full absolute path, and bare patterns like *.ts gain a **/ prefix to match at any depth. Fixes #​811
  • Fix trailing-newline off-by-one in line-count filter: files not ending with \n now count the final line correctly
v5.0.7
Compare Source
Bug Fixes
  • Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's test/bundler with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon ThreadPool with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
  • Default --max-size to 1mb — files exceeding the limit are skipped at walk time, consistent with jscpd v4's maxSize behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
  • --workers N now correctly takes effect on every run() call (previously build_global() silently no-op'd after the first invocation)
v5.0.6
Compare Source
New Features
  • v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
  • ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
  • .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
  • jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
  • --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
  • Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #​808)
Bug Fixes
  • Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
  • Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)
v5.0.5
Compare Source
v5.0.4
Compare Source
New Features
  • CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
  • Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
  • Side-by-side blame comparison in console-full reporter
  • Clone list display in console reporter
Bug Fixes
  • HTML reporter now outputs jscpd-report.html at the output_dir root
  • Resolved all clippy warnings across workspace
  • Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@w3nl
w3nl
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
7 times, most recently
from
93c7fbf to
9d888ecCompareJune 13, 2026 08:57
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
edf3e6e to
7c1f436CompareJune 23, 2026 19:31
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
cf3fc18 to
988d6eeCompareJuly 3, 2026 14:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
4 times, most recently
from
a5854a1 to
1252eecCompareJuly 14, 2026 10:14
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
1252eec to
a7cac6dCompareJuly 15, 2026 19:26
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
eed0d8c to
d3798c3CompareJuly 27, 2026 10:50
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
4316976 to
b54b9a7CompareAugust 8, 2026 01:56
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
c2cead5 to
5fee554CompareAugust 18, 2026 14:39
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
2b801f8 to
d5247b6CompareAugust 26, 2026 00:09
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
0fb9993 to
544c792CompareSeptember 1, 2026 19:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
544c792 to
6065709CompareSeptember 3, 2026 09:33
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@w3nl

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency jscpd to v5 - #519
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Open
chore(deps): update dependency jscpd to v5#519
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
jscpd (source)^4.0.5 → ^5.0.0ageconfidence
Release Notes
kucherenko/jscpd (jscpd)
v5.1.2
Compare Source
New Features
  • Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#​988)
  • cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#​988)
  • Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#​988)
Bug Fixes
  • jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#​988)
  • Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#​988)
  • pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#​989)
  • Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#​988)
Other
  • Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#​989, #​990)
  • Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#​988)
  • crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#​988)
  • Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#​988)
  • CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#​988, #​989)
Dependencies
  • Bump quick-xml to 0.42.0 in /rust (#​991)
Published Packages
  • cpd-core@0.1.11 on crates.io
  • cpd-finder@0.1.14 on crates.io
  • cpd-reporter@0.1.12 on crates.io
  • cpd-tokenizer@0.1.13 on crates.io
  • jscpd@5.1.2 on crates.io
  • cpd@5.1.2 on npm
  • jscpd@5.1.2 on npm
  • jscpd-darwin-arm64@5.1.2 on npm
  • jscpd-darwin-x64@5.1.2 on npm
  • jscpd-linux-x64-gnu@5.1.2 on npm
  • jscpd-linux-arm64-gnu@5.1.2 on npm
  • jscpd-linux-x64-musl@5.1.2 on npm
  • jscpd-linux-arm64-musl@5.1.2 on npm
  • jscpd-windows-x64-msvc@5.1.2 on npm
  • jscpd-windows-arm64-msvc@5.1.2 on npm
Verify
Archives are signed with Sigstore (keyless, <asset>.sigstore.json)

and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:
cosign verify-blob \
--bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
--certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt
v5.1.1
Compare Source
Bug Fixes
  • jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.
    The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.
Other
  • Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.13 on crates.io
  • cpd-reporter@0.1.11 on crates.io
  • cpd-tokenizer@0.1.12 on crates.io
  • jscpd@5.1.1 on crates.io
  • cpd@5.1.1 on npm
  • jscpd@5.1.1 on npm
  • jscpd-darwin-arm64@5.1.1 on npm
  • jscpd-darwin-x64@5.1.1 on npm
  • jscpd-linux-x64-gnu@5.1.1 on npm
  • jscpd-linux-arm64-gnu@5.1.1 on npm
  • jscpd-linux-x64-musl@5.1.1 on npm
  • jscpd-windows-x64-msvc@5.1.1 on npm
  • jscpd-windows-arm64-msvc@5.1.1 on npm
v5.1.0
Compare Source
New Features
  • Windows on ARM support — npm installs now select a native aarch64-pc-windows-msvc binary from the jscpd-windows-arm64-msvc platform package on Windows ARM64.
  • Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only. A committed baseline file (e.g. .jscpd-baseline.json) records content-hash fingerprints of accepted clones (the same hash the SARIF reporter emits as partialFingerprints["jscpdCloneHash/v1"], with a multiplicity count per fingerprint); clones absent from it are reported as new, and --fail-on-new-clones[=N] exits 1 when more than N (default 0) new clones are found — independently of --threshold, so legacy duplication is tolerated while regressions fail the build. --update-baseline rewrites the file from the current run (creating it if missing) and prints added/removed fingerprint counts so baseline growth stays visible in CI logs and PR review. The baseline file is versioned, sorted one fingerprint per line for reviewable diffs and trivial merges, and configurable via the baseline / failOnNewClones config keys. New-clone info flows through the reporters: [NEW] markers and a "(N new)" found-count in console/console-full, per-clone isNew plus the newClones / newDuplicatedLines statistics in json, level error in sarif, and jscpd_new_clones / jscpd_new_duplicated_lines gauges in openmetrics. (#​944)
  • Ephemeral baseline from a git ref (--baseline-from-ref) — stateless variant of the clone baseline for PR gates without a committed file: cpd --baseline-from-ref origin/main --fail-on-new-clones . checks the base ref's tree out into a temporary detached git worktree (removed afterwards; shells out to git like blame does), scans it with the same detection configuration, and compares the current run against that in-memory fingerprint set — clones absent from the base ref are new. Costs a second scan of the corpus, where the committed --baseline file needs only one. When the ref is missing (shallow CI checkout) it fails with a clear hint to git fetch origin main or use fetch-depth: 0. Config key baselineFromRef; conflicts with --baseline / --update-baseline. (#​944)
  • OpenMetrics reporter (--reporters openmetrics) — writes jscpd-metrics.txt in the OpenMetrics text exposition format, ready to be declared as a GitLab CI artifacts:reports:metrics artifact so merge requests show duplication metric changes against the target branch. Exposes gauges for files/lines/tokens analyzed, clones found, duplicated lines/tokens with percentages (project total plus a format-labeled sample per format), and detection duration in seconds. (#​422)
  • CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — writes gl-code-quality-report.json (the filename GitLab's docs use) in the CodeClimate issue format, restricted to the subset GitLab defines as its Code Quality report format, ready to be declared as an artifacts:reports:codequality artifact so duplicates appear as code quality issues in merge requests — unlike the SARIF reporter, which GitLab ingests as security vulnerability findings. Each clone yields an issue per fragment (each describing the other location, plus the CodeClimate other_locations field), with a deterministic fingerprint derived from the clone's content hash so GitLab can tell new issues from pre-existing ones across pipeline runs. Severity is minor, escalating to major for clones absent from a configured baseline or when the run exceeds --threshold. (#​958)
  • Config discovery in .config/ (dot-config convention) — auto-discovery now also checks .config/jscpd.json (and .config/.jscpd.json) per the dot-config convention, between the root .jscpd.json and the package.jsonjscpd key. A root .jscpd.json still wins, so existing setups are unaffected; paths inside the config resolve against the working directory, as with other auto-discovered sources. (#​979)
Bug Fixes
  • Unknown --format values warn instead of silently matching nothing — a typo like --format cs (instead of csharp) used to scan 0 files and exit 0, indistinguishable from a clean codebase in CI. The CLI now prints a stderr warning naming the unsupported value and pointing to --list; custom formats declared via --formats-exts stay accepted. (#​964)
  • Nix flake builds again — the flake pinned the hash of the mutable channel-rust-1.97.toml manifest, which broke with a fixed-output hash mismatch when Rust 1.97.1 was published. The toolchain is now pinned to the exact patch version (immutable manifest), so the hash can no longer drift. (#​976)
  • Windows: --baseline-from-ref no longer reports every clone as new — the format-suffix stripper treated the drive colon in Windows verbatim paths (\\?\C:\..., the form canonicalize returns) as a :format suffix and truncated the base scan's source ids to \\?\C, so every snippet read behind the fingerprint computation failed silently and the ephemeral baseline never matched. A colon followed by a path separator is now recognized as structural. Clone fingerprints are also line-ending agnostic now (CR stripped before hashing), so committed baselines survive CRLF/LF differences between platforms.
Other
  • Glama MCP listing — the repository now ships a glama.json maintainer manifest and a Dockerfile that runs the stdio MCP server (jscpd --mcp), used by Glama to build and score the server listing
  • Signed releases — release artifacts are signed with SLSA provenance, and piped downloads in workflows are pinned (OpenSSF Scorecard)
Dependencies
  • Bump Rust toolchain to 1.97.1 and oxc crates to 0.147 in /rust
  • Bump thiserror to 2.0.20, globset to 0.4.20, ignore to 0.4.33, log to 0.4.34 in /rust
Thank You ❤️
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.12 on crates.io
  • cpd-reporter@0.1.10 on crates.io
  • cpd-tokenizer@0.1.11 on crates.io
  • jscpd@5.1.0 on crates.io
  • cpd@5.1.0 on npm
  • jscpd@5.1.0 on npm
  • jscpd-darwin-arm64@5.1.0 on npm
  • jscpd-darwin-x64@5.1.0 on npm
  • jscpd-linux-x64-gnu@5.1.0 on npm
  • jscpd-linux-arm64-gnu@5.1.0 on npm
  • jscpd-linux-x64-musl@5.1.0 on npm
  • jscpd-windows-x64-msvc@5.1.0 on npm
  • jscpd-windows-arm64-msvc@5.1.0 on npm
v5.0.16
Compare Source
New Features
  • MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)
Security
  • Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch
Bug Fixes
  • GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line
Thank You ❤️
  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine
v5.0.15
Compare Source
New Features
  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
  • SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)
Bug Fixes
  • Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
  • Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
  • Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
  • Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root
Thank You ❤️
v5.0.14
Compare Source
New Features
  • --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)
Bug Fixes
  • Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)
v5.0.12
Compare Source
Dependencies
  • Rust dependency updates (askama 0.16.0, log 0.4.33, env_logger 0.11.11, rustc-hash 2.1.3)
v5.0.11
Compare Source
New Features
Dependencies
  • cpd-core bumped to 0.1.6, cpd-tokenizer bumped to 0.1.7
v5.0.10
Compare Source
Bug Fixes
  • Emit scan-root-relative paths in all reporters when absolute: false. Fixes #​827
  • Fix --skip-local to match jscpd v4 TypeScript semantics
Refactoring
  • DRY duplication in reporters: extract shared helpers into cpd-reporter/src/shared.rs
  • Move blame enrichment from gitoxide to git blame --porcelain
v5.0.9
Compare Source
New Features
  • GitHub Action for jscpd (Rust v5) — jscpd-copy-paste-detector action for GitHub Actions Marketplace. Scan your repo for copy/paste in CI with uses: kucherenko/jscpd/.github/workflows/action.yml@v5
Bug Fixes
  • Resolve platform binary resolution when cpd is installed as a nested dependency (e.g. in a project's node_modules via a parent package). The runner now correctly locates the platform-specific binary relative to the installed package rather than assuming a top-level install. Fixes #​816
v5.0.8
Compare Source
Bug Fixes
  • Prevent mmap exhaustion crashes when scanning repositories with more files than vm.max_map_count (default 131 072 on Linux). The walker previously held a live Mmap per discovered file; each rayon worker now opens and drops its mapping within the processing closure, capping concurrent mappings to the thread-pool size (typically 8–32). Fixes #​813
  • Fix --pattern not matching relative paths when the scan root is absolute (e.g. CWD). Patterns like src/**/*.ts now match correctly by comparing against both the relative path and the full absolute path, and bare patterns like *.ts gain a **/ prefix to match at any depth. Fixes #​811
  • Fix trailing-newline off-by-one in line-count filter: files not ending with \n now count the final line correctly
v5.0.7
Compare Source
Bug Fixes
  • Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's test/bundler with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon ThreadPool with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
  • Default --max-size to 1mb — files exceeding the limit are skipped at walk time, consistent with jscpd v4's maxSize behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
  • --workers N now correctly takes effect on every run() call (previously build_global() silently no-op'd after the first invocation)
v5.0.6
Compare Source
New Features
  • v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
  • ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
  • .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
  • jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
  • --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
  • Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #​808)
Bug Fixes
  • Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
  • Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)
v5.0.5
Compare Source
v5.0.4
Compare Source
New Features
  • CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
  • Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
  • Side-by-side blame comparison in console-full reporter
  • Clone list display in console reporter
Bug Fixes
  • HTML reporter now outputs jscpd-report.html at the output_dir root
  • Resolved all clippy warnings across workspace
  • Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@w3nl
w3nl
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
7 times, most recently
from
93c7fbf to
9d888ecCompareJune 13, 2026 08:57
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
edf3e6e to
7c1f436CompareJune 23, 2026 19:31
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
cf3fc18 to
988d6eeCompareJuly 3, 2026 14:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
4 times, most recently
from
a5854a1 to
1252eecCompareJuly 14, 2026 10:14
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
1252eec to
a7cac6dCompareJuly 15, 2026 19:26
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
eed0d8c to
d3798c3CompareJuly 27, 2026 10:50
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
4316976 to
b54b9a7CompareAugust 8, 2026 01:56
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
c2cead5 to
5fee554CompareAugust 18, 2026 14:39
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
2b801f8 to
d5247b6CompareAugust 26, 2026 00:09
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
0fb9993 to
544c792CompareSeptember 1, 2026 19:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
544c792 to
6065709CompareSeptember 3, 2026 09:33
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@w3nl

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency jscpd to v5 - #519
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Open
chore(deps): update dependency jscpd to v5#519
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
jscpd (source)^4.0.5 → ^5.0.0ageconfidence
Release Notes
kucherenko/jscpd (jscpd)
v5.1.2
Compare Source
New Features
  • Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#​988)
  • cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#​988)
  • Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#​988)
Bug Fixes
  • jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#​988)
  • Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#​988)
  • pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#​989)
  • Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#​988)
Other
  • Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#​989, #​990)
  • Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#​988)
  • crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#​988)
  • Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#​988)
  • CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#​988, #​989)
Dependencies
  • Bump quick-xml to 0.42.0 in /rust (#​991)
Published Packages
  • cpd-core@0.1.11 on crates.io
  • cpd-finder@0.1.14 on crates.io
  • cpd-reporter@0.1.12 on crates.io
  • cpd-tokenizer@0.1.13 on crates.io
  • jscpd@5.1.2 on crates.io
  • cpd@5.1.2 on npm
  • jscpd@5.1.2 on npm
  • jscpd-darwin-arm64@5.1.2 on npm
  • jscpd-darwin-x64@5.1.2 on npm
  • jscpd-linux-x64-gnu@5.1.2 on npm
  • jscpd-linux-arm64-gnu@5.1.2 on npm
  • jscpd-linux-x64-musl@5.1.2 on npm
  • jscpd-linux-arm64-musl@5.1.2 on npm
  • jscpd-windows-x64-msvc@5.1.2 on npm
  • jscpd-windows-arm64-msvc@5.1.2 on npm
Verify
Archives are signed with Sigstore (keyless, <asset>.sigstore.json)

and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:
cosign verify-blob \
--bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
--certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt
v5.1.1
Compare Source
Bug Fixes
  • jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.
    The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.
Other
  • Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.13 on crates.io
  • cpd-reporter@0.1.11 on crates.io
  • cpd-tokenizer@0.1.12 on crates.io
  • jscpd@5.1.1 on crates.io
  • cpd@5.1.1 on npm
  • jscpd@5.1.1 on npm
  • jscpd-darwin-arm64@5.1.1 on npm
  • jscpd-darwin-x64@5.1.1 on npm
  • jscpd-linux-x64-gnu@5.1.1 on npm
  • jscpd-linux-arm64-gnu@5.1.1 on npm
  • jscpd-linux-x64-musl@5.1.1 on npm
  • jscpd-windows-x64-msvc@5.1.1 on npm
  • jscpd-windows-arm64-msvc@5.1.1 on npm
v5.1.0
Compare Source
New Features
  • Windows on ARM support — npm installs now select a native aarch64-pc-windows-msvc binary from the jscpd-windows-arm64-msvc platform package on Windows ARM64.
  • Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only. A committed baseline file (e.g. .jscpd-baseline.json) records content-hash fingerprints of accepted clones (the same hash the SARIF reporter emits as partialFingerprints["jscpdCloneHash/v1"], with a multiplicity count per fingerprint); clones absent from it are reported as new, and --fail-on-new-clones[=N] exits 1 when more than N (default 0) new clones are found — independently of --threshold, so legacy duplication is tolerated while regressions fail the build. --update-baseline rewrites the file from the current run (creating it if missing) and prints added/removed fingerprint counts so baseline growth stays visible in CI logs and PR review. The baseline file is versioned, sorted one fingerprint per line for reviewable diffs and trivial merges, and configurable via the baseline / failOnNewClones config keys. New-clone info flows through the reporters: [NEW] markers and a "(N new)" found-count in console/console-full, per-clone isNew plus the newClones / newDuplicatedLines statistics in json, level error in sarif, and jscpd_new_clones / jscpd_new_duplicated_lines gauges in openmetrics. (#​944)
  • Ephemeral baseline from a git ref (--baseline-from-ref) — stateless variant of the clone baseline for PR gates without a committed file: cpd --baseline-from-ref origin/main --fail-on-new-clones . checks the base ref's tree out into a temporary detached git worktree (removed afterwards; shells out to git like blame does), scans it with the same detection configuration, and compares the current run against that in-memory fingerprint set — clones absent from the base ref are new. Costs a second scan of the corpus, where the committed --baseline file needs only one. When the ref is missing (shallow CI checkout) it fails with a clear hint to git fetch origin main or use fetch-depth: 0. Config key baselineFromRef; conflicts with --baseline / --update-baseline. (#​944)
  • OpenMetrics reporter (--reporters openmetrics) — writes jscpd-metrics.txt in the OpenMetrics text exposition format, ready to be declared as a GitLab CI artifacts:reports:metrics artifact so merge requests show duplication metric changes against the target branch. Exposes gauges for files/lines/tokens analyzed, clones found, duplicated lines/tokens with percentages (project total plus a format-labeled sample per format), and detection duration in seconds. (#​422)
  • CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — writes gl-code-quality-report.json (the filename GitLab's docs use) in the CodeClimate issue format, restricted to the subset GitLab defines as its Code Quality report format, ready to be declared as an artifacts:reports:codequality artifact so duplicates appear as code quality issues in merge requests — unlike the SARIF reporter, which GitLab ingests as security vulnerability findings. Each clone yields an issue per fragment (each describing the other location, plus the CodeClimate other_locations field), with a deterministic fingerprint derived from the clone's content hash so GitLab can tell new issues from pre-existing ones across pipeline runs. Severity is minor, escalating to major for clones absent from a configured baseline or when the run exceeds --threshold. (#​958)
  • Config discovery in .config/ (dot-config convention) — auto-discovery now also checks .config/jscpd.json (and .config/.jscpd.json) per the dot-config convention, between the root .jscpd.json and the package.jsonjscpd key. A root .jscpd.json still wins, so existing setups are unaffected; paths inside the config resolve against the working directory, as with other auto-discovered sources. (#​979)
Bug Fixes
  • Unknown --format values warn instead of silently matching nothing — a typo like --format cs (instead of csharp) used to scan 0 files and exit 0, indistinguishable from a clean codebase in CI. The CLI now prints a stderr warning naming the unsupported value and pointing to --list; custom formats declared via --formats-exts stay accepted. (#​964)
  • Nix flake builds again — the flake pinned the hash of the mutable channel-rust-1.97.toml manifest, which broke with a fixed-output hash mismatch when Rust 1.97.1 was published. The toolchain is now pinned to the exact patch version (immutable manifest), so the hash can no longer drift. (#​976)
  • Windows: --baseline-from-ref no longer reports every clone as new — the format-suffix stripper treated the drive colon in Windows verbatim paths (\\?\C:\..., the form canonicalize returns) as a :format suffix and truncated the base scan's source ids to \\?\C, so every snippet read behind the fingerprint computation failed silently and the ephemeral baseline never matched. A colon followed by a path separator is now recognized as structural. Clone fingerprints are also line-ending agnostic now (CR stripped before hashing), so committed baselines survive CRLF/LF differences between platforms.
Other
  • Glama MCP listing — the repository now ships a glama.json maintainer manifest and a Dockerfile that runs the stdio MCP server (jscpd --mcp), used by Glama to build and score the server listing
  • Signed releases — release artifacts are signed with SLSA provenance, and piped downloads in workflows are pinned (OpenSSF Scorecard)
Dependencies
  • Bump Rust toolchain to 1.97.1 and oxc crates to 0.147 in /rust
  • Bump thiserror to 2.0.20, globset to 0.4.20, ignore to 0.4.33, log to 0.4.34 in /rust
Thank You ❤️
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.12 on crates.io
  • cpd-reporter@0.1.10 on crates.io
  • cpd-tokenizer@0.1.11 on crates.io
  • jscpd@5.1.0 on crates.io
  • cpd@5.1.0 on npm
  • jscpd@5.1.0 on npm
  • jscpd-darwin-arm64@5.1.0 on npm
  • jscpd-darwin-x64@5.1.0 on npm
  • jscpd-linux-x64-gnu@5.1.0 on npm
  • jscpd-linux-arm64-gnu@5.1.0 on npm
  • jscpd-linux-x64-musl@5.1.0 on npm
  • jscpd-windows-x64-msvc@5.1.0 on npm
  • jscpd-windows-arm64-msvc@5.1.0 on npm
v5.0.16
Compare Source
New Features
  • MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)
Security
  • Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch
Bug Fixes
  • GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line
Thank You ❤️
  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine
v5.0.15
Compare Source
New Features
  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
  • SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)
Bug Fixes
  • Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
  • Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
  • Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
  • Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root
Thank You ❤️
v5.0.14
Compare Source
New Features
  • --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)
Bug Fixes
  • Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)
v5.0.12
Compare Source
Dependencies
  • Rust dependency updates (askama 0.16.0, log 0.4.33, env_logger 0.11.11, rustc-hash 2.1.3)
v5.0.11
Compare Source
New Features
Dependencies
  • cpd-core bumped to 0.1.6, cpd-tokenizer bumped to 0.1.7
v5.0.10
Compare Source
Bug Fixes
  • Emit scan-root-relative paths in all reporters when absolute: false. Fixes #​827
  • Fix --skip-local to match jscpd v4 TypeScript semantics
Refactoring
  • DRY duplication in reporters: extract shared helpers into cpd-reporter/src/shared.rs
  • Move blame enrichment from gitoxide to git blame --porcelain
v5.0.9
Compare Source
New Features
  • GitHub Action for jscpd (Rust v5) — jscpd-copy-paste-detector action for GitHub Actions Marketplace. Scan your repo for copy/paste in CI with uses: kucherenko/jscpd/.github/workflows/action.yml@v5
Bug Fixes
  • Resolve platform binary resolution when cpd is installed as a nested dependency (e.g. in a project's node_modules via a parent package). The runner now correctly locates the platform-specific binary relative to the installed package rather than assuming a top-level install. Fixes #​816
v5.0.8
Compare Source
Bug Fixes
  • Prevent mmap exhaustion crashes when scanning repositories with more files than vm.max_map_count (default 131 072 on Linux). The walker previously held a live Mmap per discovered file; each rayon worker now opens and drops its mapping within the processing closure, capping concurrent mappings to the thread-pool size (typically 8–32). Fixes #​813
  • Fix --pattern not matching relative paths when the scan root is absolute (e.g. CWD). Patterns like src/**/*.ts now match correctly by comparing against both the relative path and the full absolute path, and bare patterns like *.ts gain a **/ prefix to match at any depth. Fixes #​811
  • Fix trailing-newline off-by-one in line-count filter: files not ending with \n now count the final line correctly
v5.0.7
Compare Source
Bug Fixes
  • Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's test/bundler with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon ThreadPool with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
  • Default --max-size to 1mb — files exceeding the limit are skipped at walk time, consistent with jscpd v4's maxSize behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
  • --workers N now correctly takes effect on every run() call (previously build_global() silently no-op'd after the first invocation)
v5.0.6
Compare Source
New Features
  • v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
  • ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
  • .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
  • jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
  • --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
  • Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #​808)
Bug Fixes
  • Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
  • Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)
v5.0.5
Compare Source
v5.0.4
Compare Source
New Features
  • CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
  • Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
  • Side-by-side blame comparison in console-full reporter
  • Clone list display in console reporter
Bug Fixes
  • HTML reporter now outputs jscpd-report.html at the output_dir root
  • Resolved all clippy warnings across workspace
  • Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@w3nl
w3nl
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
7 times, most recently
from
93c7fbf to
9d888ecCompareJune 13, 2026 08:57
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
edf3e6e to
7c1f436CompareJune 23, 2026 19:31
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
cf3fc18 to
988d6eeCompareJuly 3, 2026 14:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
4 times, most recently
from
a5854a1 to
1252eecCompareJuly 14, 2026 10:14
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
1252eec to
a7cac6dCompareJuly 15, 2026 19:26
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
eed0d8c to
d3798c3CompareJuly 27, 2026 10:50
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
4316976 to
b54b9a7CompareAugust 8, 2026 01:56
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
c2cead5 to
5fee554CompareAugust 18, 2026 14:39
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
2b801f8 to
d5247b6CompareAugust 26, 2026 00:09
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
0fb9993 to
544c792CompareSeptember 1, 2026 19:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
544c792 to
6065709CompareSeptember 3, 2026 09:33
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@w3nl

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(deps): update dependency jscpd to v5 - #519
Open
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Open
chore(deps): update dependency jscpd to v5#519
renovate[bot] wants to merge 1 commit into
masterfrom 
renovate/jscpd-5.x
Conversation
@renovate
@renovaterenovateBot
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
jscpd (source)^4.0.5 → ^5.0.0ageconfidence
Release Notes
kucherenko/jscpd (jscpd)
v5.1.2
Compare Source
New Features
  • Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#​988)
  • cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#​988)
  • Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#​988)
Bug Fixes
  • jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#​988)
  • Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#​988)
  • pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#​989)
  • Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#​988)
Other
  • Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#​989, #​990)
  • Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#​988)
  • crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#​988)
  • Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#​988)
  • CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#​988, #​989)
Dependencies
  • Bump quick-xml to 0.42.0 in /rust (#​991)
Published Packages
  • cpd-core@0.1.11 on crates.io
  • cpd-finder@0.1.14 on crates.io
  • cpd-reporter@0.1.12 on crates.io
  • cpd-tokenizer@0.1.13 on crates.io
  • jscpd@5.1.2 on crates.io
  • cpd@5.1.2 on npm
  • jscpd@5.1.2 on npm
  • jscpd-darwin-arm64@5.1.2 on npm
  • jscpd-darwin-x64@5.1.2 on npm
  • jscpd-linux-x64-gnu@5.1.2 on npm
  • jscpd-linux-arm64-gnu@5.1.2 on npm
  • jscpd-linux-x64-musl@5.1.2 on npm
  • jscpd-linux-arm64-musl@5.1.2 on npm
  • jscpd-windows-x64-msvc@5.1.2 on npm
  • jscpd-windows-arm64-msvc@5.1.2 on npm
Verify
Archives are signed with Sigstore (keyless, <asset>.sigstore.json)

and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:
cosign verify-blob \
--bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
--certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt
v5.1.1
Compare Source
Bug Fixes
  • jscpd on npm installed the 5.0.16 engine instead of 5.1.0 — the jscpd wrapper package published its optionalDependencies pinned to the 5.0.16 platform binaries, so npm i jscpd@5.1.0 resolved a native binary one release behind and jscpd --version reported cpd 5.0.16. Everything 5.1.0 fixed was therefore absent for jscpd users, including the Windows --baseline-from-ref fix. The cpd package was pinned correctly and is unaffected, as are the platform packages themselves — only the wrapper's pins were stale.
    The cause was in scripts/sync-version.mjs: the wrapper's version and its platform pins were updated together behind a single version !== npmVersion guard, so once anything set version before the script ran, the guard read "already up to date" and left the pins untouched. The two are now updated independently, and the script ends by verifying that every npm version and platform pin matches the release version, exiting non-zero if any disagree — the release workflow runs this script, so a repeat of this mismatch now fails the release instead of publishing. This is the same defect that produced the 5.0.13 republish; the earlier fix covered the cpd package but not the jscpd wrapper.
Other
  • Declared MSRV corrected to 1.96 — the workspace advertised rust-version = "1.87" on crates.io, a floor the crate could not build on: the oxc parser crates require 1.96.0, and ignore, globset and askama require 1.88. The value had been set when the Rust workspace was created and never revisited, and no CI job built at the declared MSRV, so the drift went unnoticed. CI now derives the toolchain from rust-version and checks against exactly that version.
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.13 on crates.io
  • cpd-reporter@0.1.11 on crates.io
  • cpd-tokenizer@0.1.12 on crates.io
  • jscpd@5.1.1 on crates.io
  • cpd@5.1.1 on npm
  • jscpd@5.1.1 on npm
  • jscpd-darwin-arm64@5.1.1 on npm
  • jscpd-darwin-x64@5.1.1 on npm
  • jscpd-linux-x64-gnu@5.1.1 on npm
  • jscpd-linux-arm64-gnu@5.1.1 on npm
  • jscpd-linux-x64-musl@5.1.1 on npm
  • jscpd-windows-x64-msvc@5.1.1 on npm
  • jscpd-windows-arm64-msvc@5.1.1 on npm
v5.1.0
Compare Source
New Features
  • Windows on ARM support — npm installs now select a native aarch64-pc-windows-msvc binary from the jscpd-windows-arm64-msvc platform package on Windows ARM64.
  • Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only. A committed baseline file (e.g. .jscpd-baseline.json) records content-hash fingerprints of accepted clones (the same hash the SARIF reporter emits as partialFingerprints["jscpdCloneHash/v1"], with a multiplicity count per fingerprint); clones absent from it are reported as new, and --fail-on-new-clones[=N] exits 1 when more than N (default 0) new clones are found — independently of --threshold, so legacy duplication is tolerated while regressions fail the build. --update-baseline rewrites the file from the current run (creating it if missing) and prints added/removed fingerprint counts so baseline growth stays visible in CI logs and PR review. The baseline file is versioned, sorted one fingerprint per line for reviewable diffs and trivial merges, and configurable via the baseline / failOnNewClones config keys. New-clone info flows through the reporters: [NEW] markers and a "(N new)" found-count in console/console-full, per-clone isNew plus the newClones / newDuplicatedLines statistics in json, level error in sarif, and jscpd_new_clones / jscpd_new_duplicated_lines gauges in openmetrics. (#​944)
  • Ephemeral baseline from a git ref (--baseline-from-ref) — stateless variant of the clone baseline for PR gates without a committed file: cpd --baseline-from-ref origin/main --fail-on-new-clones . checks the base ref's tree out into a temporary detached git worktree (removed afterwards; shells out to git like blame does), scans it with the same detection configuration, and compares the current run against that in-memory fingerprint set — clones absent from the base ref are new. Costs a second scan of the corpus, where the committed --baseline file needs only one. When the ref is missing (shallow CI checkout) it fails with a clear hint to git fetch origin main or use fetch-depth: 0. Config key baselineFromRef; conflicts with --baseline / --update-baseline. (#​944)
  • OpenMetrics reporter (--reporters openmetrics) — writes jscpd-metrics.txt in the OpenMetrics text exposition format, ready to be declared as a GitLab CI artifacts:reports:metrics artifact so merge requests show duplication metric changes against the target branch. Exposes gauges for files/lines/tokens analyzed, clones found, duplicated lines/tokens with percentages (project total plus a format-labeled sample per format), and detection duration in seconds. (#​422)
  • CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — writes gl-code-quality-report.json (the filename GitLab's docs use) in the CodeClimate issue format, restricted to the subset GitLab defines as its Code Quality report format, ready to be declared as an artifacts:reports:codequality artifact so duplicates appear as code quality issues in merge requests — unlike the SARIF reporter, which GitLab ingests as security vulnerability findings. Each clone yields an issue per fragment (each describing the other location, plus the CodeClimate other_locations field), with a deterministic fingerprint derived from the clone's content hash so GitLab can tell new issues from pre-existing ones across pipeline runs. Severity is minor, escalating to major for clones absent from a configured baseline or when the run exceeds --threshold. (#​958)
  • Config discovery in .config/ (dot-config convention) — auto-discovery now also checks .config/jscpd.json (and .config/.jscpd.json) per the dot-config convention, between the root .jscpd.json and the package.jsonjscpd key. A root .jscpd.json still wins, so existing setups are unaffected; paths inside the config resolve against the working directory, as with other auto-discovered sources. (#​979)
Bug Fixes
  • Unknown --format values warn instead of silently matching nothing — a typo like --format cs (instead of csharp) used to scan 0 files and exit 0, indistinguishable from a clean codebase in CI. The CLI now prints a stderr warning naming the unsupported value and pointing to --list; custom formats declared via --formats-exts stay accepted. (#​964)
  • Nix flake builds again — the flake pinned the hash of the mutable channel-rust-1.97.toml manifest, which broke with a fixed-output hash mismatch when Rust 1.97.1 was published. The toolchain is now pinned to the exact patch version (immutable manifest), so the hash can no longer drift. (#​976)
  • Windows: --baseline-from-ref no longer reports every clone as new — the format-suffix stripper treated the drive colon in Windows verbatim paths (\\?\C:\..., the form canonicalize returns) as a :format suffix and truncated the base scan's source ids to \\?\C, so every snippet read behind the fingerprint computation failed silently and the ephemeral baseline never matched. A colon followed by a path separator is now recognized as structural. Clone fingerprints are also line-ending agnostic now (CR stripped before hashing), so committed baselines survive CRLF/LF differences between platforms.
Other
  • Glama MCP listing — the repository now ships a glama.json maintainer manifest and a Dockerfile that runs the stdio MCP server (jscpd --mcp), used by Glama to build and score the server listing
  • Signed releases — release artifacts are signed with SLSA provenance, and piped downloads in workflows are pinned (OpenSSF Scorecard)
Dependencies
  • Bump Rust toolchain to 1.97.1 and oxc crates to 0.147 in /rust
  • Bump thiserror to 2.0.20, globset to 0.4.20, ignore to 0.4.33, log to 0.4.34 in /rust
Thank You ❤️
Published Packages
  • cpd-core@0.1.10 on crates.io
  • cpd-finder@0.1.12 on crates.io
  • cpd-reporter@0.1.10 on crates.io
  • cpd-tokenizer@0.1.11 on crates.io
  • jscpd@5.1.0 on crates.io
  • cpd@5.1.0 on npm
  • jscpd@5.1.0 on npm
  • jscpd-darwin-arm64@5.1.0 on npm
  • jscpd-darwin-x64@5.1.0 on npm
  • jscpd-linux-x64-gnu@5.1.0 on npm
  • jscpd-linux-arm64-gnu@5.1.0 on npm
  • jscpd-linux-x64-musl@5.1.0 on npm
  • jscpd-windows-x64-msvc@5.1.0 on npm
  • jscpd-windows-arm64-msvc@5.1.0 on npm
v5.0.16
Compare Source
New Features
  • MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#​891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#​934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#​628, #​942)
Security
  • Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch
Bug Fixes
  • GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line
Thank You ❤️
  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#​628), which this release ports to the Rust engine
v5.0.15
Compare Source
New Features
  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#​908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#​909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#​911)
  • SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#​914)
Bug Fixes
  • Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
  • Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#​915)
  • Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
  • Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root
Thank You ❤️
v5.0.14
Compare Source
New Features
  • --cross-formats — detect clones across related formats via format equivalence groups sharing one comparison pool, e.g. --cross-formats "javascript,typescript" or the js-ts preset. When a group mixes TypeScript with JavaScript, TS files are compared with erasable type syntax stripped. Also configurable as crossFormats in .jscpd.json / package.json. (#​810)
Bug Fixes
  • Prose-only Markdown files are now analyzed — .md files without code fences previously produced zero tokens and were silently skipped; prose is now tokenized, while embedded code fences keep their own sub-format pools. (#​883)
v5.0.12
Compare Source
Dependencies
  • Rust dependency updates (askama 0.16.0, log 0.4.33, env_logger 0.11.11, rustc-hash 2.1.3)
v5.0.11
Compare Source
New Features
Dependencies
  • cpd-core bumped to 0.1.6, cpd-tokenizer bumped to 0.1.7
v5.0.10
Compare Source
Bug Fixes
  • Emit scan-root-relative paths in all reporters when absolute: false. Fixes #​827
  • Fix --skip-local to match jscpd v4 TypeScript semantics
Refactoring
  • DRY duplication in reporters: extract shared helpers into cpd-reporter/src/shared.rs
  • Move blame enrichment from gitoxide to git blame --porcelain
v5.0.9
Compare Source
New Features
  • GitHub Action for jscpd (Rust v5) — jscpd-copy-paste-detector action for GitHub Actions Marketplace. Scan your repo for copy/paste in CI with uses: kucherenko/jscpd/.github/workflows/action.yml@v5
Bug Fixes
  • Resolve platform binary resolution when cpd is installed as a nested dependency (e.g. in a project's node_modules via a parent package). The runner now correctly locates the platform-specific binary relative to the installed package rather than assuming a top-level install. Fixes #​816
v5.0.8
Compare Source
Bug Fixes
  • Prevent mmap exhaustion crashes when scanning repositories with more files than vm.max_map_count (default 131 072 on Linux). The walker previously held a live Mmap per discovered file; each rayon worker now opens and drops its mapping within the processing closure, capping concurrent mappings to the thread-pool size (typically 8–32). Fixes #​813
  • Fix --pattern not matching relative paths when the scan root is absolute (e.g. CWD). Patterns like src/**/*.ts now match correctly by comparing against both the relative path and the full absolute path, and bare patterns like *.ts gain a **/ prefix to match at any depth. Fixes #​811
  • Fix trailing-newline off-by-one in line-count filter: files not ending with \n now count the final line correctly
v5.0.7
Compare Source
Bug Fixes
  • Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's test/bundler with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon ThreadPool with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
  • Default --max-size to 1mb — files exceeding the limit are skipped at walk time, consistent with jscpd v4's maxSize behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
  • --workers N now correctly takes effect on every run() call (previously build_global() silently no-op'd after the first invocation)
v5.0.6
Compare Source
New Features
  • v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
  • ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
  • .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
  • jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
  • --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
  • Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #​808)
Bug Fixes
  • Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
  • Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)
v5.0.5
Compare Source
v5.0.4
Compare Source
New Features
  • CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
  • Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
  • Side-by-side blame comparison in console-full reporter
  • Clone list display in console reporter
Bug Fixes
  • HTML reporter now outputs jscpd-report.html at the output_dir root
  • Resolved all clippy warnings across workspace
  • Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@w3nl
w3nl
commented
Jun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
7 times, most recently
from
93c7fbf to
9d888ecCompareJune 13, 2026 08:57
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
edf3e6e to
7c1f436CompareJune 23, 2026 19:31
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
cf3fc18 to
988d6eeCompareJuly 3, 2026 14:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
4 times, most recently
from
a5854a1 to
1252eecCompareJuly 14, 2026 10:14
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
1252eec to
a7cac6dCompareJuly 15, 2026 19:26
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
eed0d8c to
d3798c3CompareJuly 27, 2026 10:50
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
4316976 to
b54b9a7CompareAugust 8, 2026 01:56
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
5 times, most recently
from
c2cead5 to
5fee554CompareAugust 18, 2026 14:39
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
2 times, most recently
from
2b801f8 to
d5247b6CompareAugust 26, 2026 00:09
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
3 times, most recently
from
0fb9993 to
544c792CompareSeptember 1, 2026 19:44
@renovate
renovateBotforce-pushed
the
renovate/jscpd-5.x
branch
from
544c792 to
6065709CompareSeptember 3, 2026 09:33
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@w3nl