build(deps): Bump jscpd from 4.2.4 to 5.0.6

[dependabot]

Bumps jscpd from 4.2.4 to 5.0.6.

Release notes

Sourced from jscpd's releases.

Release v5.0.6

New Features

• v4 config backward compatibility — fields , , , and are now read and applied, matching jscpd v4 behavior
• and are now distinct: matches file-level globs, matches code-level regex patterns (previously conflated)
• path config support — reads scan directories from the field, resolving relative paths against the config file's directory
• npm wrapper package — publishes the same Rust binary under the name on npm with v5.x versioning
• now matches v4 behavior: accepts optional integer value ( exits 1, exits 2); and are now independent
• Performance improvements: memory-mapped file I/O (via ) eliminates heap copies of file contents; SIMD-accelerated line counting (via ); parallel detection pipeline uses to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #808)

Bug Fixes

• Fixed to match jscpd v4's behavior (was boolean, now optional integer)
• Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)

Release v5.0.4

New Features

• CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
• Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
• Side-by-side blame comparison in console-full reporter
• Clone list display in console reporter

Bug Fixes

• HTML reporter now outputs jscpd-report.html at the output_dir root
• Resolved all clippy warnings across workspace
• Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())

Release v4.2.5

Bug Fixes

• JSON reporter duplicate token counts — was always reported as in JSON output; now computed from token positions () (#801).
• Gitignore parent-directory walk — files in parent directories up to the repo root are now read and combined with scan-directory files. Also reads and the global for full parity with Git's ignore resolution (#741).
• Commander v15 migration — CLI option parsing migrated from direct property access (, etc.) to the API required by Commander v8+. The / flag handling was rewritten to use Commander's native negation support instead of inspection.
• Vitest 4.1.0 — bumped from 3.2.4 to address CVE-2026-47429.
• Commander v15 — bumped from v5 to v15, enabling modern Node.js compatibility.
• Pug 3.0.4, node-sarif-builder 4.1.0, nodemon 3.1.14 — dependency bumps for security and compatibility.

Changelog

Sourced from jscpd's changelog.

5.0.6

New Features

• v4 config backward compatibility — .jscpd.json fields path, pattern, ignore, and ignorePattern are now read and applied, matching jscpd v4 behavior
• ignore and ignorePattern are now distinct: ignore matches file-level globs, ignorePattern matches code-level regex patterns (previously conflated)
• .jscpd.json path config support — reads scan directories from the path field, resolving relative paths against the config file's directory
• jscpd npm wrapper package — publishes the same Rust binary under the jscpd name on npm with v5.x versioning
• --exit-code now matches v4 behavior: accepts optional integer value (--exit-code exits 1, --exit-code 2 exits 2); --threshold and --exit-code are now independent
• Performance improvements: memory-mapped file I/O (via memmap2) eliminates heap copies of file contents; SIMD-accelerated line counting (via memchr); parallel detection pipeline uses flat_map to avoid intermediate allocations; JS tokenizer no longer clones source strings before parsing (thanks to @​auterium, #808)

Bug Fixes

• Fixed --exit-code to match jscpd v4's --exitCode behavior (was boolean, now optional integer)
• Fixed unique temp dir generation in reporter tests (added PID to prevent race conditions under parallel test runners)

---

5.0.4

New Features

• CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
• Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
• Side-by-side blame comparison in console-full reporter
• Clone list display in console reporter

Bug Fixes

• HTML reporter now outputs jscpd-report.html at the output_dir root
• Resolved all clippy warnings across workspace
• Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())

---

5.0.3

New Features

• Rust-based cpd CLI with full feature parity to TypeScript jscpd
• Cross-platform binary distribution via npm platform packages (linux-x64-gnu, linux-arm64-gnu, linux-x64-musl, darwin-arm64, darwin-x64, windows-x64-msvc)
• 13 reporters: json, console, xml, csv, html, markdown, sarif, ai, badge, xcode, threshold, silent, console-full
• Time reporter for execution timing
• CLI short-form aliases matching TypeScript jscpd conventions
• ReportContext data structure for extensible reporter signatures
• Trusted Publishing support for crates.io via OIDC

---

5.0.2

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

@dependabot merge

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR bumps 'jscpd' from v4.2.4 to v5.0.6, transitioning to its new Rust-based implementation. While Codacy reports the PR is up to standards, the upgrade to v5 introduces breaking changes in configuration (differentiation between 'ignore' and 'ignorePattern') and CLI behavior (modified '--exit-code' logic) that are not addressed in the current changes. These omissions could lead to silent linting regressions or CI/CD failures. Furthermore, the dependency should be pinned to an exact version to prevent non-deterministic builds.

About this PR

• The transition from v4 to v5 is a major upgrade. The release notes for jscpd v5 indicate that 'ignore' and 'ignorePattern' are now distinct and the '--exit-code' behavior has been modified. This PR lacks updates to configuration files or CI scripts, which may lead to regressions or pipeline failures.

Test suggestions

• Verify jscpd execution with existing project configuration (e.g., .jscpd.json) for compatibility with v5.x logic.
• Verify CI/CD pipeline scripts that rely on jscpd exit codes, as the --exit-code behavior has changed in v5.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify jscpd execution with existing project configuration (e.g., .jscpd.json) for compatibility with v5.x logic.
2. Verify CI/CD pipeline scripts that rely on jscpd exit codes, as the --exit-code behavior has changed in v5.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Specify the exact version for the 'jscpd' dependency to prevent potential dependency hijacking and ensure build reproducibility. Using '^' allows for automatic updates that could introduce unexpected behavior or security vulnerabilities.

Suggested change:

"jscpd": "5.0.6"

See Issue in Codacy

[dependabot]

Superseded by #61.