chore(deps): bump jscpd from 5.0.16 to 5.1.0

[dependabot]

Bumps jscpd from 5.0.16 to 5.1.0.

Release notes

Sourced from jscpd's releases.

Release v5.1.0

New Features

• Windows on ARM support — npm installs now select a native aarch64-pc-windows-msvc binary from the jscpd-windows-arm64-msvc platform package on Windows ARM64.

• Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only. A committed baseline file (e.g. .jscpd-baseline.json) records content-hash fingerprints of accepted clones (the same hash the SARIF reporter emits as partialFingerprints["jscpdCloneHash/v1"], with a multiplicity count per fingerprint); clones absent from it are reported as new, and --fail-on-new-clones[=N] exits 1 when more than N (default 0) new clones are found — independently of --threshold, so legacy duplication is tolerated while regressions fail the build. --update-baseline rewrites the file from the current run (creating it if missing) and prints added/removed fingerprint counts so baseline growth stays visible in CI logs and PR review. The baseline file is versioned, sorted one fingerprint per line for reviewable diffs and trivial merges, and configurable via the baseline / failOnNewClones config keys. New-clone info flows through the reporters: [NEW] markers and a "(N new)" found-count in console/console-full, per-clone isNew plus the newClones / newDuplicatedLines statistics in json, level error in sarif, and jscpd_new_clones / jscpd_new_duplicated_lines gauges in openmetrics. (#944)

• Ephemeral baseline from a git ref (--baseline-from-ref) — stateless variant of the clone baseline for PR gates without a committed file: cpd --baseline-from-ref origin/main --fail-on-new-clones . checks the base ref's tree out into a temporary detached git worktree (removed afterwards; shells out to git like blame does), scans it with the same detection configuration, and compares the current run against that in-memory fingerprint set — clones absent from the base ref are new. Costs a second scan of the corpus, where the committed --baseline file needs only one. When the ref is missing (shallow CI checkout) it fails with a clear hint to git fetch origin main or use fetch-depth: 0. Config key baselineFromRef; conflicts with --baseline / --update-baseline. (#944)

• OpenMetrics reporter (--reporters openmetrics) — writes jscpd-metrics.txt in the OpenMetrics text exposition format, ready to be declared as a GitLab CI artifacts:reports:metrics artifact so merge requests show duplication metric changes against the target branch. Exposes gauges for files/lines/tokens analyzed, clones found, duplicated lines/tokens with percentages (project total plus a format-labeled sample per format), and detection duration in seconds. (#422)

• CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — writes gl-code-quality-report.json (the filename GitLab's docs use) in the CodeClimate issue format, restricted to the subset GitLab defines as its Code Quality report format, ready to be declared as an artifacts:reports:codequality artifact so duplicates appear as code quality issues in merge requests — unlike the SARIF reporter, which GitLab ingests as security vulnerability findings. Each clone yields an issue per fragment (each describing the other location, plus the CodeClimate other_locations field), with a deterministic fingerprint derived from the clone's content hash so GitLab can tell new issues from pre-existing ones across pipeline runs. Severity is minor, escalating to major for clones absent from a configured baseline or when the run exceeds --threshold. (#958)

• Config discovery in .config/ (dot-config convention) — auto-discovery now also checks .config/jscpd.json (and .config/.jscpd.json) per the dot-config convention, between the root .jscpd.json and the package.json jscpd key. A root .jscpd.json still wins, so existing setups are unaffected; paths inside the config resolve against the working directory, as with other auto-discovered sources. (#979)

Bug Fixes

• Unknown --format values warn instead of silently matching nothing — a typo like --format cs (instead of csharp) used to scan 0 files and exit 0, indistinguishable from a clean codebase in CI. The CLI now prints a stderr warning naming the unsupported value and pointing to --list; custom formats declared via --formats-exts stay accepted. (#964)
• Nix flake builds again — the flake pinned the hash of the mutable channel-rust-1.97.toml manifest, which broke with a fixed-output hash mismatch when Rust 1.97.1 was published. The toolchain is now pinned to the exact patch version (immutable manifest), so the hash can no longer drift. (#976)
• Windows: --baseline-from-ref no longer reports every clone as new — the format-suffix stripper treated the drive colon in Windows verbatim paths (\\?\C:\..., the form canonicalize returns) as a :format suffix and truncated the base scan's source ids to \\?\C, so every snippet read behind the fingerprint computation failed silently and the ephemeral baseline never matched. A colon followed by a path separator is now recognized as structural. Clone fingerprints are also line-ending agnostic now (CR stripped before hashing), so committed baselines survive CRLF/LF differences between platforms.

Other

• Glama MCP listing — the repository now ships a glama.json maintainer manifest and a Dockerfile that runs the stdio MCP server (jscpd --mcp), used by Glama to build and score the server listing
• Signed releases — release artifacts are signed with SLSA provenance, and piped downloads in workflows are pinned (OpenSSF Scorecard)

Dependencies

• Bump Rust toolchain to 1.97.1 and oxc crates to 0.147 in /rust
• Bump thiserror to 2.0.20, globset to 0.4.20, ignore to 0.4.33, log to 0.4.34 in /rust

Thank You ❤️

• @​luchsamapparat for contributing Windows on ARM support (#963)
• @​dmromanov for proposing the OpenMetrics reporter (#422)
• @​beanaroo for proposing the GitLab / CodeClimate Code Quality report format (#958)
• @​MRDGH2821 for proposing config discovery from the .config/ subfolder (#979)
• @​zbcoding for reporting the silent unknown---format behavior (#964)
• @​eaves-dropper for reporting the Nix build failure (#976)

Published Packages

• cpd-core@0.1.10 on crates.io
• cpd-finder@0.1.12 on crates.io
• cpd-reporter@0.1.10 on crates.io
• cpd-tokenizer@0.1.11 on crates.io
• jscpd@5.1.0 on crates.io
• cpd@5.1.0 on npm
• jscpd@5.1.0 on npm
• jscpd-darwin-arm64@5.1.0 on npm
• jscpd-darwin-x64@5.1.0 on npm
• jscpd-linux-x64-gnu@5.1.0 on npm

... (truncated)

Changelog

Sourced from jscpd's changelog.

5.1.0

New Features

• Clone baseline (--baseline, --update-baseline, --fail-on-new-clones) — gate CI on new duplication only: a committed baseline file records fingerprints of accepted clones, and only clones absent from it fail the build, so legacy duplication is tolerated while regressions are caught. (#944)
• Ephemeral baseline from a git ref (--baseline-from-ref) — stateless PR gating without a committed file: scans the base ref in a temporary worktree and reports clones that don't exist there. (#944)
• OpenMetrics reporter (--reporters openmetrics) — duplication gauges in the OpenMetrics text format, ready for GitLab CI artifacts:reports:metrics. (#422)
• CodeClimate / GitLab Code Quality reporter (--reporters codeclimate, alias gitlab) — gl-code-quality-report.json for GitLab's artifacts:reports:codequality, so duplicates appear as code quality issues in merge requests. (#958)
• Windows on ARM support — npm installs pick a native aarch64-pc-windows-msvc binary on Windows ARM64. (#963)
• Config discovery in .config/ — jscpd also finds its config at .config/jscpd.json per the dot-config convention; a root .jscpd.json still wins. (#979)

Bug Fixes

• Unknown --format values warn instead of silently scanning 0 files — --format cs (or any typo) no longer looks identical to a clean scan in CI. (#964)
• Nix flake builds again — the Rust toolchain is pinned to an exact patch version, so the manifest hash can no longer drift when a new patch release ships. (#976)
• Windows: --baseline-from-ref no longer reports every clone as new — Windows verbatim paths (\\?\C:\...) were truncated by the :format-suffix stripper, silently breaking every snippet read behind the base scan's fingerprints. Clone fingerprints are also line-ending agnostic now, so committed baselines survive CRLF/LF differences between platforms.

Thank You ❤️

• @​luchsamapparat for contributing Windows on ARM support (#963)
• @​dmromanov for proposing the OpenMetrics reporter (#422)
• @​beanaroo for proposing the GitLab / CodeClimate Code Quality report format (#958)
• @​MRDGH2821 for proposing config discovery from the .config/ subfolder (#979)
• @​zbcoding for reporting the silent unknown---format behavior (#964)
• @​eaves-dropper for reporting the Nix build failure (#976)

---

Commits

• a2f4827 release: resume cpd-v5.1.0 with line-ending-agnostic fingerprints
• 892810a release: cpd-v5.1.1
• 74ea908 release: cpd-v5.1.0
• b01910d feat: add support for Windows on ARM
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #735.