build(deps): Bump jscpd from 5.0.14 to 5.0.15

[dependabot]

Bumps jscpd from 5.0.14 to 5.0.15.

Release notes

Sourced from jscpd's releases.

Release v5.0.15

New Features

• SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error, matching the threshold check that fails the build. Default output is unchanged when neither option is set. (#908)
• SARIF: clone fingerprints — each result carries token_count and a clone_hash in its properties bag, plus a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. The hash is order-insensitive, so the same clone pair produces the same hash regardless of file discovery order. (#909)
• SARIF: related-location messages — the duplicate's counterpart location now has a message (Duplicated at <path>:<line>), and the primary message references it via a SARIF embedded link so GitHub code scanning displays it. (#911)
• SARIF: richer rule metadata — the jscpd/duplicate-code rule now includes a display name, full description, default configuration, and quality tags for better presentation in SARIF viewers and Azure DevOps. (#914)

Bug Fixes

• Scan-root-relative report paths — fragments store their scan root separately (source_root), so report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve and read source files; SARIF emits originalUriBaseIds with per-root base ids. Fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#872, #892)
• Report version stamping — the SARIF tool.driver.version (previously hardcoded 5.0.3) and the HTML report version now match cpd --version, bundled at build time. (#915)
• Multi-root blame attribution — with multiple scan roots containing the same relative path, git blame data is now keyed by resolved path, so the second root no longer inherits the first root's authors.
• Git root discovery — walking up from a relative scan path no longer terminates early before reaching the repository root.

Dependencies

• Bump serde_json to 1.0.151 in /rust
• Bump ignore to 0.4.32 in /rust
• Bump anyhow to 1.0.104 in /rust

Thank You ❤️

This release was shaped by community contributions — huge thanks to:

• @​chrisc-onaorg for the SARIF clone fingerprints (#910), related-location messages (#912), and richer rule metadata (#914), plus reporting #909, #911, and #915
• @​darronz for the scan-root-relative paths fix (#913)
• @​nvuillam for proposing size-based SARIF severity (#908)

Published Packages

• cpd-core@0.1.8 on crates.io
• cpd-finder@0.1.10 on crates.io
• cpd-reporter@0.1.8 on crates.io
• cpd-tokenizer@0.1.9 on crates.io
• jscpd@5.0.15 on crates.io
• cpd@5.0.15 on npm
• jscpd-darwin-arm64@5.0.15 on npm
• jscpd-darwin-x64@5.0.15 on npm
• jscpd-linux-x64-gnu@5.0.15 on npm
• jscpd-linux-arm64-gnu@5.0.15 on npm
• jscpd-linux-x64-musl@5.0.15 on npm
• jscpd-windows-x64-msvc@5.0.15 on npm
• jscpd@5.0.15 on npm

Changelog

Sourced from jscpd's changelog.

5.0.15

New Features

• SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error. (#908)
• SARIF: clone fingerprints — each result carries token_count, a clone_hash, and a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. (#909)
• SARIF: related-location messages — the duplicate's counterpart location now has a message linked from the primary message, so GitHub code scanning displays it. (#911)
• SARIF: richer rule metadata — display name, full description, default configuration, and quality tags on the jscpd/duplicate-code rule. (#914)

Bug Fixes

• Scan-root-relative report paths — report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve source files; fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#872, #892)
• Report version stamping — SARIF tool.driver.version and the HTML report version now match --version. (#915)
• Multi-root blame attribution — git blame data is keyed by resolved path, so a second scan root no longer inherits the first root's authors
• Git root discovery — walking up from a relative scan path no longer terminates before reaching the repository root

Thank You ❤️

• @​chrisc-onaorg for the SARIF fingerprints, related-location messages, and rule metadata (#910, #912, #914)
• @​darronz for the scan-root-relative paths fix (#913)
• @​nvuillam for proposing size-based SARIF severity (#908)

---

Commits

• b03abda release: cpd-v5.0.15
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

@dependabot merge

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The dependency update satisfies the acceptance criteria and is up to standards according to Codacy analysis. No high-risk files were impacted, and no security vulnerabilities or logic flaws were identified. There are no issues in this PR that should prevent merging.

Test suggestions

• Verify that the jscpd execution within the project's CI/CD or linting pipeline completes successfully with the new version.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the jscpd execution within the project's CI/CD or linting pipeline completes successfully with the new version.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[dependabot]

Superseded by #71.