chore(deps-dev): bump jscpd from 5.0.16 to 5.1.2 in the npm-minor-patch group

[dependabot]

Bumps the npm-minor-patch group with 1 update: jscpd.

Updates jscpd from 5.0.16 to 5.1.2

Release notes

Sourced from jscpd's releases.

Release v5.1.2

New Features

• Linux ARM64 musl prebuilt binaries — npm installs on Alpine and other musl-based ARM64 Linux systems now select a native binary from the new jscpd-linux-arm64-musl platform package, bringing the prebuilt platform count to 8. The GitHub release ships the matching jscpd-linux-arm64-musl.tar.gz asset. (#988)
• cargo binstall jscpd — the crate now carries cargo-binstall metadata pointing at the release tarballs for every supported target, so cargo binstall jscpd downloads a prebuilt binary instead of compiling the oxc parser stack from source. (#988)
• Docker image ghcr.io/kucherenko/jscpd — a multi-arch (amd64/arm64) distroless image built from the release binaries is published with every release, tagged latest, 5, 5.1 and the exact version, with SLSA provenance and an SBOM attached. Run it as docker run --rm -v "$PWD:/src" ghcr.io/kucherenko/jscpd; see docs/ci-and-hooks.md. (#988)

Bug Fixes

• jscpd --version and jscpd --help now say jscpd — both binaries are built from the same source and the command name was the literal cpd, so jscpd --version printed cpd 5.1.1 and the usage line read Usage: cpd. The name is now taken from the invoked executable (jscpd or cpd). (#988)
• Windows: drive-anchored --pattern values are treated as absolute — the Windows-only check for patterns like C:\src\**\*.ts compared the first character against : and \ after already requiring it to be a letter, so it could never match and such patterns were also given the relative **/ variant. The check is now a platform-independent helper with a unit test that runs everywhere. (#988)
• pre-commit hook passed v4-only flags — .pre-commit-hooks.yaml still invoked --gitignore --exitCode '1', which the v5 CLI rejects, so repo: https://github.com/kucherenko/jscpd hooks failed on every run. The hook now passes --exit-code 1. (#989)
• Unsupported-platform error is actionable — when no prebuilt binary matches, the jscpd and cpd npm launchers now name the host (os/arch (libc)), list the supported platform keys and point to cargo install jscpd instead of printing a bare "Unsupported platform". (#988)

Other

• Repository split: master is v5-only — the TypeScript v4 engine (apps/, packages/, changesets, Node.js CI) moved to the long-lived master-v4 branch and releases from there under the latest-4 npm dist-tag. master keeps the Rust workspace, the shared fixtures/ corpus, the GitHub Action, Dockerfile and flake. README-v4.md describes the TypeScript version in one page; FORMATS.md is now generated from the Rust tokenizer (224 formats). (#989, #990)
• Floating v5 tag for the GitHub Action — uses: kucherenko/jscpd@v5 follows the latest 5.x release; the release workflow moves the tag on every stable release. (#988)
• crates.io metadata — every crate now declares repository, documentation, keywords and categories; the jscpd crate excludes tests/ from the published package, ships an expanded README rendered on docs.rs, and npm packages carry a funding field. (#988)
• Signed release assets — in addition to SLSA provenance, each release archive and checksums.txt now has a Sigstore keyless signature (<asset>.sigstore.json) verifiable with cosign verify-blob; the release notes include the exact commands. (#988)
• CI — Windows joined the pull-request build matrix, a smoke test runs the release binary against the fixtures/ corpus on every push, and a nightly job runs cargo audit and cargo deny. (#988, #989)

Dependencies

• Bump quick-xml to 0.42.0 in /rust (#991)

Published Packages

• cpd-core@0.1.11 on crates.io
• cpd-finder@0.1.14 on crates.io
• cpd-reporter@0.1.12 on crates.io
• cpd-tokenizer@0.1.13 on crates.io
• jscpd@5.1.2 on crates.io
• cpd@5.1.2 on npm
• jscpd@5.1.2 on npm
• jscpd-darwin-arm64@5.1.2 on npm
• jscpd-darwin-x64@5.1.2 on npm
• jscpd-linux-x64-gnu@5.1.2 on npm
• jscpd-linux-arm64-gnu@5.1.2 on npm
• jscpd-linux-x64-musl@5.1.2 on npm
• jscpd-linux-arm64-musl@5.1.2 on npm
• jscpd-windows-x64-msvc@5.1.2 on npm
• jscpd-windows-arm64-msvc@5.1.2 on npm

Verify

Archives are signed with Sigstore (keyless, <asset>.sigstore.json) and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:

... (truncated)

Commits

• 6b25b3a release: cpd-v5.1.2
• d790c6c chore: make master v5-only
• b0c31a4 chore: apply audit fixes across repo, crates, npm wrapper and pipelines
• 9db945c release: cpd-v5.1.1
• a2f4827 release: resume cpd-v5.1.0 with line-ending-agnostic fingerprints
• 892810a release: cpd-v5.1.1
• 74ea908 release: cpd-v5.1.0
• b01910d feat: add support for Windows on ARM
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions