chore(deps-dev): bump jscpd from 4.3.0 to 5.4.0

[dependabot]

Bumps jscpd from 4.3.0 to 5.4.0.

Release notes

Sourced from jscpd's releases.

Release v5.4.0

New Features

• A language server: jscpd --lsp. An editor starts jscpd for a workspace, and the files you edit get what jscpd finds as diagnostics that follow the text in the editor, saved or not. After 300 ms without typing, the server tokenizes the file again from the buffer and searches its detection pool again from the tokens it keeps for the rest of the project.

  • The server runs five analyses: clones (exact, renamed and near-miss copies), similar functions (--similarity), semantic clones (--semantic), dead code (--dead-code) and complexity, with a limit of 15 per function and the complex-file bar of the health score per file. Only clones are on unless you turn the others on, with --lsp-analyses, with the lsp section of .jscpd.json, or from the editor's settings, and each place wins over the one before it.
  • The code of each diagnostic is the id of its rule, the one the SARIF reporters write for clones and dead code. A clone is a warning, as in SARIF, and lsp.clones.warningTokens lowers the smaller ones to information. Dead code is a hint that editors fade.
  • Each .jscpd.json in the workspace makes its folder a project of its own, and clones are found within a project. A workspace with no config is one project across all its folders.
  • A clone comes with "Go to the other copy" and "Ignore this clone", which wraps the fragment in jscpd:ignore-start and jscpd:ignore-end comments. Dead code and semantic clones run in the background after a save, and the progress of each run ends with what it found, such as 94 files, 13 clones.
  • Editor clients can ask for the whole project's clones, semantic pairs, dead code, complexity and statistics with custom requests.
  • docs/editors.md has the setup for Neovim, Helix, Sublime Text, Emacs and JetBrains IDEs, and fixtures/lsp-demo is a project that shows each analysis. (#1120, #1121, #1122)

• Comparing two codebases, experimental: --compare. jscpd --compare source target pairs the functions of two folders with the --semantic model and reports which functions of each side have a counterpart in the other. During a port to another language or platform, that is what is still to port; for two implementations of one app, it is what only one of them has.

  • A function pairs with its counterpart when the model finds them each other's closest match. A short function the model cannot place pairs by name when the names match once case and underscores are ignored and the code is similar enough. Every pair has its similarity and a level, high, medium or low, and the report lists the pairs under other names on their own.
  • Tests and code are measured apart, and a test pairs only with a test. jscpd tells a test by the conventions of its language, such as *_test.go, test_*.py, *.test.ts or Rust's #[cfg(test)], and JavaScript test cases take part under their titles.
  • The console, JSON and Markdown reporters print the totals per side and per file, the functions with no counterpart and the pairs. -r html writes a migration map: both sides as dependency graphs with the pairs bridging them, a table of the same pairs, and the functions ready to port, whose callees all have a counterpart already. The JSON report lists those as readyToPort.
  • On the Java and Python versions of nayuki/QR-Code-generator, it paired 30 of 41 Java functions with no wrong pair. fixtures/compare-demo is a runnable example. (#1115, #1118, #1119)

• Agent skills for ports. compare-codebases explains how --compare pairs functions and how to check a comparison. code-migration ports a codebase tests first, binds tests to code by coverage, and takes the next function to port from --compare. Install them with npx skills add kucherenko/jscpd --skill <name>. (#1115, #1117)

Changes

• Pairs from --similarity have a SARIF rule of their own, jscpd/similar-function. The similar kind comes from two mechanisms that find different things, and SARIF filed both under jscpd/similar-code. That rule now keeps the copies merged across a gap (--max-gap-lines), and Code Climate's check_name follows. GitHub code scanning matches alerts by rule, so the first upload of --similarity results after the update closes the old alerts and opens the same findings under the new rule. (#1121)

Other

• A failed cargo publish now fails the release job instead of passing it. (#1116)

Published Packages

• basta@0.3.0 on crates.io
• cpd-core@0.1.20 on crates.io
• cpd-finder@0.1.20 on crates.io
• cpd-reporter@0.1.21 on crates.io
• cpd-semantic@0.1.1 on crates.io
• cpd-tokenizer@0.1.19 on crates.io
• jscpd@5.4.0 on crates.io
• cpd@5.4.0 on npm
• jscpd@5.4.0 on npm
• jscpd-darwin-arm64@5.4.0 on npm
• jscpd-darwin-x64@5.4.0 on npm
• jscpd-linux-x64-gnu@5.4.0 on npm
• jscpd-linux-arm64-gnu@5.4.0 on npm
• jscpd-linux-x64-musl@5.4.0 on npm
• jscpd-linux-arm64-musl@5.4.0 on npm
• jscpd-windows-x64-msvc@5.4.0 on npm
• jscpd-windows-arm64-msvc@5.4.0 on npm
• jscpd==5.4.0 on PyPI

... (truncated)

Commits

• b6f832c release: cpd-v5.4.0
• b018556 release: cpd-v5.3.3
• beb5528 release: cpd-v5.3.2
• e90cf5e release: cpd-v5.3.1
• 9257686 release: cpd-v5.3.0
• 7d6b405 release: cpd-v5.2.1
• e27a6c1 docs(npm): ignore examples that actually match
• c8aa3cd Apply suggestion from @​mnahkies
• 88833f9 docs: correct ignore options in readme
• b4cdcc2 release: cpd-v5.2.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Updates the jscpd dev dependency from 4.3.0 to 5.4.0. Version 5.x is a Rust rewrite distributed as a native binary, which removes most of the old JavaScript dependency tree from the lockfile.

• Requires Node >= 18.
• Adds platform-specific binaries as optional dependencies.

^{Written for commit 8522b15. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 33b93017-369d-40bf-8f6e-c1a4da615121

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unbraind]

Superseded by #119, which carries this update together with the PM CLI 2026.10.4 certification.

[dependabot]

Looks like jscpd is up-to-date now, so this is no longer needed.