build(deps): Bump jscpd from 4.2.4 to 5.0.4

[dependabot]

Bumps jscpd from 4.2.4 to 5.0.4.

Release notes

Sourced from jscpd's releases.

Release v5.0.4

New Features

• CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
• Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
• Side-by-side blame comparison in console-full reporter
• Clone list display in console reporter

Bug Fixes

• HTML reporter now outputs jscpd-report.html at the output_dir root
• Resolved all clippy warnings across workspace
• Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())

Release v4.2.5

Bug Fixes

• JSON reporter duplicate token counts — was always reported as in JSON output; now computed from token positions () (#801).
• Gitignore parent-directory walk — files in parent directories up to the repo root are now read and combined with scan-directory files. Also reads and the global for full parity with Git's ignore resolution (#741).
• Commander v15 migration — CLI option parsing migrated from direct property access (, etc.) to the API required by Commander v8+. The / flag handling was rewritten to use Commander's native negation support instead of inspection.
• Vitest 4.1.0 — bumped from 3.2.4 to address CVE-2026-47429.
• Commander v15 — bumped from v5 to v15, enabling modern Node.js compatibility.
• Pug 3.0.4, node-sarif-builder 4.1.0, nodemon 3.1.14 — dependency bumps for security and compatibility.

Changelog

Sourced from jscpd's changelog.

5.0.4

New Features

• CLI alignment with jscpd v4: new --absolute, --ignore-case, --formats-exts, --formats-names flags; fixed --threshold, improved --max-size
• Detection and statistics aligned with jscpd for consistent output across Rust and TypeScript versions
• Side-by-side blame comparison in console-full reporter
• Clone list display in console reporter

Bug Fixes

• HTML reporter now outputs jscpd-report.html at the output_dir root
• Resolved all clippy warnings across workspace
• Fixed unique temp dir generation in tests (use as_nanos() instead of subsec_nanos())

---

5.0.3

New Features

• Rust-based cpd CLI with full feature parity to TypeScript jscpd
• Cross-platform binary distribution via npm platform packages (linux-x64-gnu, linux-arm64-gnu, linux-x64-musl, darwin-arm64, darwin-x64, windows-x64-msvc)
• 13 reporters: json, console, xml, csv, html, markdown, sarif, ai, badge, xcode, threshold, silent, console-full
• Time reporter for execution timing
• CLI short-form aliases matching TypeScript jscpd conventions
• ReportContext data structure for extensible reporter signatures
• Trusted Publishing support for crates.io via OIDC

---

5.0.2

Bug Fixes

• Fixed Vue SFC tokenization to dispatch each block to its own sub-format
• Fixed entire-file duplicates silently dropped by RabinKarp store flush logic
• Fixed ReDoS hang on Lisp/Elisp files
• Fixed crash on malformed package.json when reading config

---

5.0.1

New Features

• Initial Rust workspace with cpd-core, cpd-tokenizer, cpd-finder, cpd-reporter, and jscpd crates
• Cross-format detection for Vue SFC, Svelte, Astro, and Markdown files
• Shebang detection for extensionless scripts

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

@dependabot merge

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR upgrades jscpd to version 5.0.4. While the update meets the primary requirement, it is a major version bump involving a complete rewrite of the core engine in Rust. This introduces potential environmental dependencies, such as glibc requirements, which may impact CI/CD or development environments.

Two breaking changes require immediate attention: the migration to Commander v15 for CLI parsing and the relocation of the HTML report output. There are currently no tests or CI configuration updates in this PR to verify that existing scripts or artifact collection pipelines remain functional. Additionally, a minor structural improvement is recommended to move jscpd to devDependencies, as it is a static analysis tool.

About this PR

• The HTML reporter now outputs files at the root of the output directory instead of a sub-path. Ensure that CI/CD artifact collection or documentation site generation paths are updated accordingly.
• Moving from v4 to v5 involves a core rewrite in Rust. Please verify that the development and CI environments meet the necessary system requirements (e.g., glibc) for the new binary.

Test suggestions

• Verify that code duplication detection still functions correctly with the new Rust-based core engine.
• Validate that existing CLI flags and configuration files are compatible with the v5 CLI parser (Commander v15 migration).
• Confirm that CI/CD pipelines correctly locate the HTML report, as the output path for 'jscpd-report.html' has moved to the root of the output directory.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that code duplication detection still functions correctly with the new Rust-based core engine.
2. Validate that existing CLI flags and configuration files are compatible with the v5 CLI parser (Commander v15 migration).
3. Confirm that CI/CD pipelines correctly locate the HTML report, as the output path for 'jscpd-report.html' has moved to the root of the output directory.

Low confidence findings

• The v5 CLI parser change may break scripts using specific flag patterns (e.g., --no- flags). Verify all automated usages of jscpd against the new version.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{⚪ LOW RISK}

Suggestion: jscpd is a development-time tool and should be moved to devDependencies to optimize the production build and follow standard practices for development utilities. Try running the following prompt in your coding agent: > Move the 'jscpd' dependency from 'dependencies' to 'devDependencies' in package.json.