Skip to content

chore(deps-dev): bump the development-dependencies group across 1 directory with 2 updates - #101

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/development-dependencies-ca3f364176
Open

chore(deps-dev): bump the development-dependencies group across 1 directory with 2 updates#101
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/development-dependencies-ca3f364176

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026

Copy link
Copy Markdown

Bumps the development-dependencies group with 2 updates in the / directory: eslint-plugin-jsdoc and jscpd.

Updates eslint-plugin-jsdoc from 63.3.3 to 64.2.1

Release notes

Sourced from eslint-plugin-jsdoc's releases.

v64.2.1

64.2.1 (2026-08-17)

Bug Fixes

v64.2.0

64.2.0 (2026-08-15)

Features

  • check-param-names: add order fixer and suggestions (#1732) (8a37bd2)

v64.1.0

64.1.0 (2026-08-10)

Features

  • update jsdoccomment, devDeps.; use nodenext for module properties in TS (7309d7d)

v64.0.2

64.0.2 (2026-08-09)

Bug Fixes

  • update jsdoccomment and devDep. (fbe2a2b)

v64.0.1

64.0.1 (2026-08-08)

Bug Fixes

  • resume support for CJS via require(esm) (343516a)

v64.0.0

64.0.0 (2026-08-07)

Features

BREAKING CHANGES

... (truncated)

Commits
  • dc99c3c fix: update jsdcoccomment, devDeps (#1746)
  • 8a37bd2 feat(check-param-names): add order fixer and suggestions (#1732)
  • 7309d7d feat: update jsdoccomment, devDeps.; use nodenext for module properties in TS
  • 4de1b19 chore: update jsdoccomment, devDep.
  • fbe2a2b fix: update jsdoccomment and devDep.
  • 343516a fix: resume support for CJS via require(esm)
  • 7e94c04 chore: update jsdoccomment, comment-parser, devDeps.
  • 9c9b723 feat: ESM only; fixes #1626
  • See full diff in compare view

Updates jscpd from 5.0.14 to 5.0.16

Release notes

Sourced from jscpd's releases.

Release v5.0.16

New Features

  • MCP server over stdio (--mcp)cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout, the transport MCP clients spawn and manage themselves (no port, no network policy). The project is scanned once at startup and kept in memory as detection-ready token hashes, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication (accepts format names or file extensions), get_file_clones (clones involving one file — new over the HTTP server), get_statistics, and check_current_directory (returns the clone list). All clone/match lists are sorted biggest-first and capped by an optional limit argument (default 100) with the untruncated total always reported. Implements protocol revision 2025-06-18 (accepting 2025-03-26 / 2024-11-05 clients); all standard detection options (--min-tokens, --format, --cross-formats, ...) apply to the scan and to snippet checks. (#891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview appended to the run output: top files and folders ranked by tokens, lines, size, or a token-based cyclomatic-complexity estimate, with each file's duplication share. --summary-top <n> sets the list length, --summary-by tokens|lines|size|complexity picks the ranking metric (config file: summary, summaryTop, summaryBy). Renders in console/console-full, as a compact one-line-per-entry block in the ai reporter, and as an additive summary key in the JSON report (absent when the flag is off, so the schema is unchanged for existing consumers). Computed after detection from data already in memory — runs without --summary are unaffected. (#934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams: declare isolation groups as comma-separated lists of pipe-separated folders (--skip-isolated "packages/team-a|packages/team-b,libs/a|libs/b"), and clones whose two fragments fall under two different folders of the same group are dropped. Duplication inside a single folder, against shared code, or across unrelated groups is still reported. The config file accepts the nested-array shape "skipIsolated": [["packages/a", "packages/b"]] (kebab-case skip-isolated works too), and the option applies to MCP project scans as well. Ports #628 to the Rust engine. (#942)

Security

  • Supply-chain hardening (OpenSSF Scorecard) — every GitHub Action in the release and CI pipelines is pinned to a full commit SHA (kept fresh by Dependabot), workflow tokens follow least privilege (top-level contents: read, write grants scoped to the jobs that need them), and the repository now has a SECURITY.md with private disclosure channels, private vulnerability reporting, and a protected master branch

Bug Fixes

  • GitHub "Latest" release badge stays on v5 — Rust v5 releases are created with --latest; legacy TypeScript v4 and cpd v* releases explicitly opt out, so a v4 maintenance release can no longer take the Latest badge from the v5 line

Other

  • npm package page polish — README links are absolute GitHub URLs so they resolve on npmjs.com, and the package description and keywords better describe what jscpd does

Dependencies

  • Bump Rust toolchain to 1.97 and oxc crates to 0.144 in /rust
  • Bump serde to 1.0.229 in /rust
  • Bump clap to 4.6.6 in /rust
  • Bump memchr to 2.8.3 in /rust
  • Bump xxhash-rust to 0.8.18 in /rust

Thank You ❤️

  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#628), which this release ports to the Rust engine

Published Packages

  • cpd-core@0.1.9 on crates.io
  • cpd-finder@0.1.11 on crates.io
  • cpd-reporter@0.1.9 on crates.io
  • cpd-tokenizer@0.1.10 on crates.io
  • jscpd@5.0.16 on crates.io
  • cpd@5.0.16 on npm
  • jscpd-darwin-arm64@5.0.16 on npm
  • jscpd-darwin-x64@5.0.16 on npm
  • jscpd-linux-x64-gnu@5.0.16 on npm
  • jscpd-linux-arm64-gnu@5.0.16 on npm
  • jscpd-linux-x64-musl@5.0.16 on npm
  • jscpd-windows-x64-msvc@5.0.16 on npm

Not Yet Published

... (truncated)

Changelog

Sourced from jscpd's changelog.

5.0.16

New Features

  • MCP server over stdio (--mcp)cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#891)
  • Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#934)
  • Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#628, #942)

Security

  • Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch

Bug Fixes

  • GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line

Thank You ❤️

  • @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#628), which this release ports to the Rust engine

5.0.15

New Features

  • SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#908)
  • SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#909)
  • SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#911)
  • SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#914)

Bug Fixes

  • Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#872, #892)
  • Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#915)
  • Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
  • Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root

Thank You ❤️


Commits
  • 2b08d13 release: cpd-v5.0.16
  • 7a01672 chore: pin GitHub 'Latest' badge to v5 releases, polish npm package page
  • b03abda release: cpd-v5.0.15
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Bumps dev tooling: eslint-plugin-jsdoc to 64.2.1 (ESM-only) and jscpd to 5.0.16 to pick up fixes/features. No runtime code changes, but lint behavior and tooling compatibility may shift.

  • Review/migration notes:
    • eslint-plugin-jsdoc@64 is ESM-only. If ESLint fails to load the plugin from a CJS config, migrate to an ESM config (eslint.config.js) or use dynamic import; verify ESLint runs locally and in CI.
    • Expect possible new or auto-fixable JSDoc diagnostics (e.g., parameter order suggestions); update baselines if needed.
    • jscpd@5.0.16 adds optional features; existing CLI usage should remain stable. No action required unless adopting new flags.

Written for commit 630c369. Summary will update on new commits.

Review in cubic

…ectory with 2 updates

Bumps the development-dependencies group with 2 updates in the / directory: [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) and [jscpd](https://github.com/kucherenko/jscpd/tree/HEAD/rust/jscpd).


Updates `eslint-plugin-jsdoc` from 63.3.3 to 64.2.1
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v63.3.3...v64.2.1)

Updates `jscpd` from 5.0.14 to 5.0.16
- [Release notes](https://github.com/kucherenko/jscpd/releases)
- [Changelog](https://github.com/kucherenko/jscpd/blob/master/CHANGELOG.md)
- [Commits](https://github.com/kucherenko/jscpd/commits/v5.0.16/rust/jscpd)

---
updated-dependencies:
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 64.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: jscpd
  dependency-version: 5.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 22, 2026

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @dependabot[bot], you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants