[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
cypress (source)	16.1.* → 16.2.*
dotenv	18.0.5 → 18.0.8
jscpd (source)	5.4.0 → 5.4.2
release-it	21.1.0 → 21.1.1

---

Release Notes

cypress-io/cypress (cypress)

v16.2.0

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#16-2-0

motdotla/dotenv (dotenv)

v18.0.8

Compare Source

Changed

• Fast parser should strip appended extra quotes (#​1073)
• Type detail improvement (#​1074)

v18.0.7

Compare Source

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#​1070)
• CLI should honor DOTENV_QUIET setting in .env file (#​1071)

v18.0.6

Compare Source

Changed

• Use smarter parseBoolean not Boolean() to fix override (#​1069)

kucherenko/jscpd (jscpd)

v5.4.2

Compare Source

The post What's new in jscpd 5.4.2 shows the new features with commands and real output.

New Features

• Boundaries keep the code of a module inside it. The new boundaries key of the config file lists rules. A rule names the code it protects (code: a folder, a file, a glob, or a method as path#name), where copies of it must not show up (notIn, or every file outside code when it is left out) and where they may after all (allow). Every clone run checks the rules, and a copy of protected code outside its boundary fails the run with exit code 1. Import linters miss such copies, because a copied function imports nothing.

  • jscpd looks for copies three ways, and a rule can set its own bars in thresholds. Token clones find copy-paste, the structure comparison of --similarity finds an edited copy, and the --semantic model finds the same logic written again, often in another language. disable turns kinds off by their --kind names. Without a downloaded model, jscpd prints a warning and checks the rules without the semantic search.
  • A mistake in a rule, such as an unknown key or a glob that doesn't compile, stops the run with an error that names the rule. A rule that checks nothing in a run, after a typo in a path or a method name for example, gets a warning.
  • The console, console-full, ai and json reporters show the violations, the json one under boundaries. Baselines and --changed don't apply to violations yet, and SARIF, the language server and the MCP server don't report them.
  • fixtures/boundaries-demo is a small shop whose web app copies the backend's pricing and loan code. (#​1225, #​1227)

• --ignore-identifiers pairs a name with one name. Every name used to match every other name, so x = x + x * x was a clone of d = a + b * c, although its data flows another way. Now a name on one side has to stand for the same name on the other side every time, and two names can't stand for one, as in Baker's parameterized matching and NiCad's consistent renaming. On 24 projects in 11 languages, 6,942 of the 14,501 renamed clones that the old matching reported had no such mapping.

  • jscpd cuts a clone where a name starts to stand for two and still reports every part of --min-tokens tokens or more.
  • A name reached as a member, after . or ?., and after -> in C, C++, PHP and Perl, is another name than a local of the same text. A constructor that sets this.url = url still matches its copy that sets this.url = link (#​1220).
  • --ignore-identifiers and --ignore-identifiers=consistent give the new matching, --ignore-identifiers=blind the old one. The config takes "ignoreIdentifiers": true, "consistent" or "blind", and the Action input takes consistent or blind. The value goes after = only, so --ignore-identifiers src/ still scans src/.
  • fixtures/type2-demo has the consistent and members examples. (#​1217, #​1218)

• --similarity pairs a name with one name too. The fingerprint of a subtree now records how its names repeat, so x = x + x * x no longer scores 1.0 against d = a + b * c, and a renamed copy still does. Members, labels such as keyword arguments and object keys, and types each have names of their own, so self.url = url still matches self.url = link. A function's own name matches any name. Kotlin's true, false and null and Clojure's true, false and nil are literals now. On the same 24 projects, 15 of 23,530 pairs fell below 0.8, and runs take 2 to 9% longer. --ignore-identifiers=blind brings back the old scores and also turns on renamed token clones. fixtures/similarity-demo/names scores a renamed copy at 1.00 and a mirrored function at 0.74. (#​1219)

• --history tracks the health score, and a bare --history walks the last 30 commits. Every commit of the series gets the score that jscpd --health gives its tree. The console draws a health chart under the duplication chart and adds HEALTH and CHANGE columns, and every point of the JSON report has health. --health and --dashboard take --history now: the badge or the dashboard comes first, then the series, in the markdown and html reports too.

  • jscpd --history used to fail with "a value is required". Without a value the flag takes the config's history, or else the newest 30 commits of HEAD (--history-limit). --history-every N spaces them N commits apart, and the Action's history input takes true.
  • jscpd scans a commit the way it scans the working tree: --ignore and --pattern see its files at their working-tree paths, and the checkout runs none of the repository's hooks. A walk that stops at the edge of a shallow clone prints a warning that names the commit.
  • The last 30 commits of axios take about 5.4 seconds, against 4.9 without the health score. (#​1199)

• jscpd knows 73 more formats by extension, and files by name. 94 of 224 formats had no built-in extension, a gap that came from v4, so jscpd . skipped Dockerfiles, Makefiles, go.mod, Elixir and Nix files unless you mapped them. The new extensions come from GitHub Linguist, and a table of file names maps Dockerfile, Containerfile, Makefile, go.mod, CMakeLists.txt, Gemfile, Jenkinsfile and others. Existing formats got more suffixes, such as .zsh, .jsonc, .tfvars and .sbt. A Markdown fence such as ```dockerfile takes its format from the same table, and --formats-exts and --formats-names still win over every built-in mapping. FORMATS.md lists the file names too. (#​1174, #​1192)

Changes

• jscpd . scans more files. On 22 repositories the new file associations picked up 1 to 5 more files each, mostly Dockerfiles, .editorconfig, .jsonc, Makefiles and go.mod, and jscpd scans the .rst files of Sphinx docs like Markdown. The duplication percentage can move, and a --threshold gate can fail. (#​1192)

• --ignore-identifiers reports fewer renamed clones, and some of them are shorter. A baseline that 5.4 made with --ignore-identifiers is a blind one. Keep --ignore-identifiers=blind with it or update the baseline, or --fail-on-new-clones reports the cut clones as new. (#​1218)

• --history walks first parents. A merged branch counts as its merge commit, so a range across merged branches gives fewer points than before. jscpd builds a series only when a reporter shows it (console, console-full, ai or json, and markdown or html with --health or --dashboard), so a badge-only --health job no longer walks the range. The ai lines read 37be780 2026-08-08 2/1/47.6 +47.6 health 72 -2 now, and a wrong health or dead-code option no longer fails a clone run. (#​1199)

Bug Fixes

• jscpd aborted on a Markdown page whose front matter ran into a code fence. A page that opens with a horizontal rule and later shows a Python stub had front matter from the rule down to the stub's ..., across the fence, and the scan panicked: jscpd exited with 134, and jscpd --mcp and jscpd --lsp died. A --- on the first line now opens front matter only when the next line isn't blank, as Pandoc reads it, and only a --- or ... line before the first code fence closes it. The frontmatter of an Astro component follows the same rule. A page of code fences that never close used to take quadratic time, 3.9 seconds for 100 KB, and takes 0.04 seconds now. (#​1223, #​1226)

• A Razor view was read out of order. jscpd tokenized the HTML of a whole view and then the C# of its blocks, so a clone across that seam ended before it started: release builds printed ranges such as [48:48 - 5:35], and debug builds panicked. A view is now one stream in the order of its text. Two identical views count as duplicated from the first line to the last, and markup in an @if or @foreach block matches the same markup outside one. (#​1221, #​1222)

• The MCP server's check_duplication never matched a Vue, Svelte or Astro snippet. It tokenized a snippet as one stream, while a scan splits a component into its blocks and a Markdown file into its prose and fences. A component snippet met only the components inside Markdown fences, by meaning it found nothing, and the fences of a Markdown snippet matched nothing either. The server now splits a snippet the way a scan splits a file of its format. Each match has format and lines, and the note names every block too short to match. #​1228 also fixed how jscpd counts the duplicated lines of a clone whose two fragments swap places, so the statistics of a --cross-formats run can change a little. (#​1224, #​1228, #​1229)

• --history failed when git's log.showSignature was on. git printed the signature check of each signed commit before the commit, and jscpd took that line for a commit hash. jscpd now passes --no-show-signature and reads only lines that start with a commit hash. Reported with an exact reproduction by @​vitorcsbrito. (#​1195, #​1196)

• --compare paired a function with every near-best lookalike. It took the rule of --semantic, where a group of near-equal functions all pair with each other, but in a port a function has one counterpart. A pair now stays only when it is the best match of one of its two functions, and a near tie goes to the partner in a file of the same name. On the analysis modules of Lucene and Lucene.NET the pairs went from 2,219 to 1,392, and the share of pairs between files of the same name from 46% to 73%. Analysis and numbers by @​MysterionRise. (#​1162, #​1194)

• --semantic reported a page and the component it renders as a clone. It skips a pair when one function calls the other, but it didn't count a JSX element such as <EditUserForm /> as a call. It does now, and so does the call graph of --compare. Reported by @​Rosenblad, fixed by @​cristianchiriac. (#​1210, #​1211)

• Reports named a clone in a Markdown block or a component like guide.md:markup. The VS Code extension opened that name as a file and failed. The JSON name, the language server's jscpd/clones and jscpd/semantic, the XML path and the xcode location now name the file, and the JSON keeps the block's language in format. The console, ai and HTML reports still name the block. (#​1200)

• Every repository counted the hook samples in .git/hooks. The walk takes hidden files, so it went into .git too, and the 9 bash files and 1 perl file that git init writes counted in the file count, the line totals and the health score. jscpd now skips .git folders. (#​1193)

Other

• jscpd depends on basta 0.3.2. basta reads YAML with serde-saphyr now, since its old parser, serde_yaml_ng, sits on the unmaintained unsafe-libyaml (RUSTSEC-2024-0449) (#​1198), and it gives --history the dead-code report without the compiler's Rust findings (#​1199).
• The README shows the duplication of jscpd's own Rust code and a badge to follow the author on X (#​1197).

Dependencies

• rustls moved to 0.23.46 for RUSTSEC-2026-0346 to 0349 (#​1201). cargo deny and cargo audit ignore three advisories about extracting zip archives, RUSTSEC-2026-0367 to 0369: jscpd extracts no archive, and candle-core 0.11 still needs zip 8 (#​1215, #​1216).
• ruff moved to 0.0.17 (#​1202), tree-sitter-php to 0.25.1 (#​1204), tree-sitter-language to 0.1.9 (#​1205), sha2 to 0.11.1 (#​1207) and serde_json to 1.0.154 (#​1208).
• In CI, actions/setup-node moved to 7.1.0 (#​1203), actions/download-artifact to 8.0.2 (#​1206) and taiki-e/install-action to 2.87.28 (#​1209).

Thank You ❤️

• @​soodoku for the issue behind the new --ignore-identifiers, with numbers from Django and scikit-learn (#​1217)
• @​MysterionRise for the analysis of --compare on Lucene and Lucene.NET (#​1162)
• @​cristianchiriac for the JSX fix in --semantic (#​1211), and @​Rosenblad for the report (#​1210)
• @​vitorcsbrito for the log.showSignature report and its reproduction (#​1195)
• @​pygarap for the file associations issue (#​1174)

Published Packages

• basta@0.3.2 on crates.io
• cpd-core@0.1.22 on crates.io
• cpd-finder@0.1.22 on crates.io
• cpd-reporter@0.1.23 on crates.io
• cpd-semantic@0.1.3 on crates.io
• cpd-similarity@0.1.1 on crates.io
• cpd-tokenizer@0.1.21 on crates.io
• jscpd@5.4.2 on crates.io
• cpd@5.4.2 on npm
• jscpd@5.4.2 on npm
• jscpd-darwin-arm64@5.4.2 on npm
• jscpd-darwin-x64@5.4.2 on npm
• jscpd-linux-x64-gnu@5.4.2 on npm
• jscpd-linux-arm64-gnu@5.4.2 on npm
• jscpd-linux-x64-musl@5.4.2 on npm
• jscpd-linux-arm64-musl@5.4.2 on npm
• jscpd-windows-x64-msvc@5.4.2 on npm
• jscpd-windows-arm64-msvc@5.4.2 on npm
• jscpd==5.4.2 on PyPI

Verify

Archives are signed with Sigstore (keyless, <asset>.sigstore.json)
and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:

cosign verify-blob \
  --bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt

v5.4.1

Compare Source

New Features

• --similarity compares the structure of functions in 15 languages. jscpd parses every function and method and normalizes its syntax tree: the names of the functions it calls and its operators stay, local names, field names and literals become markers, and comments and the parentheses around one expression drop out. Every subtree of that tree is a fingerprint, and two functions score the Jaccard index of their two fingerprint sets, so a renamed copy scores 1 and an edited statement lowers the score.

  • It reads JavaScript, TypeScript, Python, Java, Kotlin, Scala, C#, Go, Rust, C, C++, PHP, Ruby, Swift and Clojure, and the code blocks of Markdown files and the scripts of Vue, Svelte and Astro components. 5.4.0 compared JavaScript and TypeScript only.
  • The search is exact: it finds every pair at or above the ratio. A function nested in another is part of it, and test files and Rust mod tests are left out. Code between jscpd:ignore-start and jscpd:ignore-end, or matched by --ignore-pattern, adds nothing to a function (#​1144).
  • --similarity alone compares at 0.8. --min-nodes (config key minNodes, 20 by default) sets the smallest normalized tree that takes part, --min-lines applies as before and --min-tokens does not. The JSON report gives the node count of both functions as nodes.
  • While the method was built, a check on 100 open-source repositories against a brute-force implementation of it, which scores every pair, found the same 58,405 pairs with the same scores, and jscpd's runs took 64.8 seconds on one thread against 498.
  • fixtures/similarity-demo has a runnable example in every language. (#​1129, #​1132, #​1134, #​1136, #​1139, #​1147, #​1148, #​1149, #​1150, #​1152, #​1155, #​1138, #​1141, #​1142, #​1143, #​1145, #​1146, #​1156)

• An edn reporter. -r edn writes jscpd-report.edn with {:candidates [...] :clones [...]}. The candidates are every pair --similarity found, most similar first, with their score, language, both locations and node counts, also the pairs a token clone already reports. The clones are the ones the other passes found, with their kind, method and score. (#​1151, #​1153, #​1156)

• --changed reports the clones of the files you are working on. The changed files are the ones git status lists: staged, unstaged and untracked files, and a renamed file under its new name. jscpd still scans every file and reports a clone when one of its fragments is in a changed file, so a new file that copies an unchanged one shows up.

  • The first run saves the clones of HEAD to .jscpd-baseline.json at the repository root, or to the --baseline file, with the commit and a hash of the scan paths and options. Later runs read it and mark the clones HEAD did not have as [NEW], so --fail-on-new-clones works with it. jscpd builds the file again after a commit or for other paths or options. A baseline file without a commit, such as one --update-baseline wrote, is used as it is.
  • --changed-only scans the changed files alone, and they match only one another.
  • Both flags are command line only. fixtures/changed-demo walks through five steps. (#​1154, #​1172)

• --report-name sets the base name of the report files. Linter aggregators such as MegaLinter run several tools into one reports folder, and two jscpd runs there overwrote each other's jscpd-report.json. --report-name megalinter-jscpd (config key reportName) names the json, xml, csv, html, markdown, sarif and edn reports, and the GitHub Action takes it as the report-name input. The badge, OpenMetrics and CodeClimate files keep their names. The name must be a plain file name: a path, an extension or an empty name is an error. Contributed by @​MannXo. (#​1015, #​1058)

• The MCP server finds every type of clone and compares folders. Every tool takes kinds: exact, renamed, similar and semantic, or type1 to type4. Without it, a tool reports what jscpd reports with the server's options. compare_folders(left, right) returns the JSON report of --compare for two folders. The server speaks the MCP revision 2026-07-28, and clients of the older revisions keep working. check_duplication now finds every copy of a snippet, where it used to match one of two, and --mcp no longer ignores --semantic. (#​1135, #​1137)

Changes

• --similarity scores differ from 5.4.0. The method is new, so a pair that scored 0.85 before can score lower now. Refresh a --threshold or a baseline that was set on the old results. --similarity 1 now reports functions with the same structure; up to 5.4.0 a ratio of 1 turned the search off, and jscpd prints a warning that says so. The options that the method replaced never reached a release. (#​1156)

Bug Fixes

• --semantic and --compare found functions named if in C, C++ and C# code. Around #if and #ifdef, the grammars read else if (…) { } as a function named if, or while or await, and every if ( in the scan counted as a call to it, so in --compare one such branch could collect thousands of callers. jscpd now drops a function whose type is the keyword else. A word such as if, while or catch before a parenthesis counts as a call only as a member, as in promise.catch(f). Reported by @​MysterionRise, fixed by @​mvanhorn. (#​1163, #​1188)

• Three --compare fixes found on Apache Lucene and Lucene.NET, all by @​MysterionRise:

  • Test helpers now count toward the namesakes of a call. A private assertEquals in Lucene's benchmark code took all 6,127 calls to the name, 6,126 of them from tests. (#​1165)
  • The HTML map cuts a long folder label in its middle, so the folders of one module no longer read alike. (#​1166)
  • A .NET test project counts as tests wherever Tests sits in its dotted name, as in Lucene.Net.Tests.Analysis.Common. Before, 6,736 functions in 771 files of such projects counted as code. (#​1167)

• The --compare reports disagreed. The console and the HTML map now round a share the same way, so 60 of 147 functions read 41% in both. A Tests block appears only when a side has a test that counts, and a declaration without a body no longer counts as a function. (#​1130)

• --dead-code reported an import used only in a TSDoc link as unused. {@link X}, {@linkcode X} and {@linkplain X} now count as uses of X, as TypeScript counts them, and in JavaScript files the JSDoc types of @param, @returns, @type and the like count too. A name in the docs credits the import only, so a function that only a link names is still reported. (#​1170, #​1171)

• --ignore-pattern dropped the wrong tokens in code blocks. jscpd computed the ranges on the host file but tokenized Markdown fences, component scripts and Razor blocks from the block's own offsets. The ranges now move to the block. (#​1144)

• git commands run from a hook acted on the hook's repository. jscpd's git subprocesses now drop the variables git exports to hooks, such as GIT_DIR and GIT_INDEX_FILE; before, --baseline-from-ref in a pre-commit hook wrote the base tree into the commit's index. A --history range or a --baseline-from-ref ref that starts with - is refused, so a scanned repository's config can no longer pass git an option such as --output=<file>. The worktree cleanup no longer prunes the user's other worktrees, and an API key that an embeddings API echoes in an error is redacted. (#​1169)

• The Nix flake warned about stdenv.isDarwin. It uses stdenv.hostPlatform.isDarwin now. Contributed by @​mlavrinenko. (#​1133)

Other

• The minimum Rust version is 1.97. oxc 0.153 and ruff 0.0.16 need it. (#​1187)
• jscpd depends on basta 0.3.1, which has the dead-code fixes above.
• The tests check behavior instead of implementation details, and CI measures line coverage (#​1168). The release retries cargo publish while the crates.io index catches up (#​1123), and the compare-codebases skill keeps vendored and build folders out of a comparison (#​1124).

Dependencies

• oxc moved to 0.153 (#​1125, #​1184), ruff to 0.0.16 (#​1185) and tree-sitter-swift to 0.7.4 (#​1186), together in #​1187. The new Swift grammar reads nil as a node of its own, and --similarity treats it as a literal.
• xxhash-rust moved to 0.8.19 (#​1126, #​1140), and yoke-derive to 0.8.4 because 0.8.3 was yanked.
• In CI, taiki-e/install-action moved to 2.87.26 (#​1127, #​1183) and dorny/test-reporter to 3.2.0 (#​1182).

Thank You ❤️

• @​pygarap for the issues that shaped the new --similarity, the edn reporter and --changed: #​1129, #​1131, #​1132, #​1134, #​1136, #​1139, #​1147, #​1148, #​1149, #​1150, #​1151, #​1152, #​1153, #​1154
• @​MannXo for --report-name (#​1058)
• @​mvanhorn for the fix of phantom C# functions (#​1188)
• @​MysterionRise for three --compare fixes (#​1165, #​1166, #​1167) and the report of phantom functions (#​1163)
• @​mlavrinenko for the Nix flake fix (#​1133)
• The readers of the DOU.ua discussion who reported the TSDoc false positive (#​1170)
• @​emanuelb (#​357), @​jonim8or (#​411, #​412), @​JiangWeixian (#​449) and @​umair2602 (#​519), whose older reports this cycle's triage closed

Published Packages

• basta@0.3.1 on crates.io
• cpd-core@0.1.21 on crates.io
• cpd-finder@0.1.21 on crates.io
• cpd-reporter@0.1.22 on crates.io
• cpd-semantic@0.1.2 on crates.io
• cpd-similarity@0.1.0 on crates.io
• cpd-tokenizer@0.1.20 on crates.io
• jscpd@5.4.1 on crates.io
• cpd@5.4.1 on npm
• jscpd@5.4.1 on npm
• jscpd-darwin-arm64@5.4.1 on npm
• jscpd-darwin-x64@5.4.1 on npm
• jscpd-linux-x64-gnu@5.4.1 on npm
• jscpd-linux-arm64-gnu@5.4.1 on npm
• jscpd-linux-x64-musl@5.4.1 on npm
• jscpd-linux-arm64-musl@5.4.1 on npm
• jscpd-windows-x64-msvc@5.4.1 on npm
• jscpd-windows-arm64-msvc@5.4.1 on npm
• jscpd==5.4.1 on PyPI

Verify

Archives are signed with Sigstore (keyless, <asset>.sigstore.json)
and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:

cosign verify-blob \
  --bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt

release-it/release-it (release-it)

v21.1.1

Compare Source

• docs: add release-it-git-cliff to plugins list (#​1334) (bf2a3d8) - thanks @​adamhl8!
• Update undici to 7.29.1 (resolve #​1335) (37898f1)
• Update more dependencies (7bd73af)
• Migrate verkit import (5336543)

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "before 8am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.