chore(deps): update dependency jscpd to v5.2.0 - #8961
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
requested review from
Kurt-von-Laven,
bdovaz,
echoix and
nvuillam
as code owners
September 16, 2026 21:35
Contributor
✅
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.1.2→5.2.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
kucherenko/jscpd (jscpd)
v5.2.0Compare Source
New Features
--ignore-identifiers,--ignore-literals,--ignore-annotations— three opt-in flags (config keysignoreIdentifiers,ignoreLiterals,ignoreAnnotations, GitHub Action inputs of the same names) normalize token classes before hashing, so blocks that differ only in names, literal values or annotations are found. Identifiers hash as one class while keywords keep their value, strings and numbers stay distinct classes, and@Name(...)runs are dropped in Java, Kotlin, Scala, Groovy, Python, Dart, Swift, JavaScript and TypeScript (@interfacedeclarations are kept). Every clone now carries akind:exactorrenamed. A run without the flags is unchanged apart from the additive"kind": "exact"JSON field. Seefixtures/type2-demo. (#998, #1019)--max-gap-lines N— a copy with a line inserted, removed or changed in the middle used to show up as two shorter clones. With--max-gap-lines N(configmaxGapLines, Action inputmax-gap-lines, default0= off) clones of one file pair whose fragments follow each other in both files with at mostNunmatched lines between them are merged into one clone of kindsimilarwith asimilarityvalue (matched tokens over the merged span). A merge whose similarity would fall below0.5is refused, duplicated-line statistics count only the matched lines, and a merge of renamed halves is reported assimilar. Seefixtures/type3-demo. (#999, #1020, #1030)--similarity RATIO— edits spread through a function rather than concentrated in one gap still escape a token window.--similarity(configsimilarity, Action inputsimilarity, a number in(0, 1]; the default1means exact matches only, so nothing runs until you lower it) compares every function, method and arrow function by the bag of 4-grams over its syntax-tree node types, indexed with MinHash, and reports pairs at or above the ratio assimilarclones spanning the whole functions. Names and literals do not take part: a renamed copy scores1.0, one inserted line about0.9, two inserted statements plus renames about0.75. Everysimilarclone records itsmethod(gaporast) because the two scores are not on the same scale. The MCPcheck_duplicationtool accepts the samesimilarityargument. (#999, #727, #1021)Clone found (javascript, renamed)andClone found (javascript, similar (gap) ~0.91),aiappends(renamed)/[~0.91 gap], JSON addskind,similarityandmethodto each duplicate andrenamedClones/similarClonesto the statistics, XML adds the same attributes, HTML shows a badge, Xcode a suffix, and SARIF and Code Climate use the rulesjscpd/renamed-codeandjscpd/similar-codenext tojscpd/duplicate-code. (#1019, #1021, #1030)JSCPD_NO_TIPSjoinsCIas an environment switch and--no-tipsstays the explicit one;NO_COLORonly removes the colours. (#1008, #1029, thanks @7487)Bug Fixes
ignorePatternentries without*or?silently did nothing — such entries were treated as relative paths and joined onto the config directory, so"ignorePattern": ["Copyright 2026 Example Authors"]matched nothing while the same string via--ignore-patternworked. Config entries are now applied verbatim, and an invalid regex prints aWarning:line instead of being dropped silently. Seefixtures/ignore-demo. (#997)/*(a glob likedocs/**) or//(any URL) in prose opened a comment that swallowed the rest of the file, so two files sharing a paragraph after such a line were never reported. Markdown now has no comment syntax. (#1026, thanks @kwesolowski)<template>,<script>,<style>and their closing tags) are left out of it altogether, so a template clone is reported with the template's own line range and the script and style bodies are not counted as duplicated html. Seefixtures/sfc-demo. (#1031, thanks @zero-stroke)Other
fixtures/— every feature and fix above ships a demo directory (ignore-demo,type2-demo,type3-demo,parse-errors-demo,sfc-demo) whose README lists each command with its expected output, and the same files feed the smoke scan that runs on every pull request.--ignore-pattern/ignorePatternsource-region filtering and thejscpd:ignore-start/jscpd:ignore-endmarkers are documented in the v5 reference, with license-header recipes and a note on the Rust regex syntax. (#993, #996, thanks @w3lld1)ignore-identifiers,ignore-literals,ignore-annotations,max-gap-linesandsimilarityfor the features above.Dependencies
regex1 to thejscpdcrate for--ignore-patternvalidation (#997)taiki-e/install-actionfrom 2.87.2 to 2.87.3 in/.github/workflows(#995)Thank You ❤️
Published Packages
cpd-core@0.1.12on crates.iocpd-finder@0.1.15on crates.iocpd-reporter@0.1.13on crates.iocpd-tokenizer@0.1.14on crates.iojscpd@5.2.0on crates.iocpd@5.2.0on npmjscpd@5.2.0on npmjscpd-darwin-arm64@5.2.0on npmjscpd-darwin-x64@5.2.0on npmjscpd-linux-x64-gnu@5.2.0on npmjscpd-linux-arm64-gnu@5.2.0on npmjscpd-linux-x64-musl@5.2.0on npmjscpd-linux-arm64-musl@5.2.0on npmjscpd-windows-x64-msvc@5.2.0on npmjscpd-windows-arm64-msvc@5.2.0on npmVerify
Archives are signed with Sigstore (keyless,
<asset>.sigstore.json)and carry SLSA build provenance. Replace
jscpd-linux-x64-gnu.tar.gzwith your asset:cosign verify-blob \ --bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \ --certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ jscpd-linux-x64-gnu.tar.gz gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd sha256sum --check --ignore-missing checksums.txtConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.