chore(deps): bump jscpd from 5.0.15 to 5.0.16

[dependabot]

Bumps jscpd from 5.0.15 to 5.0.16.

Release notes

Sourced from jscpd's releases.

Release v5.0.16

New Features

• MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout, the transport MCP clients spawn and manage themselves (no port, no network policy). The project is scanned once at startup and kept in memory as detection-ready token hashes, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication (accepts format names or file extensions), get_file_clones (clones involving one file — new over the HTTP server), get_statistics, and check_current_directory (returns the clone list). All clone/match lists are sorted biggest-first and capped by an optional limit argument (default 100) with the untruncated total always reported. Implements protocol revision 2025-06-18 (accepting 2025-03-26 / 2024-11-05 clients); all standard detection options (--min-tokens, --format, --cross-formats, ...) apply to the scan and to snippet checks. (#891)
• Codebase summary (--summary) — opt-in refactoring-hotspot overview appended to the run output: top files and folders ranked by tokens, lines, size, or a token-based cyclomatic-complexity estimate, with each file's duplication share. --summary-top <n> sets the list length, --summary-by tokens|lines|size|complexity picks the ranking metric (config file: summary, summaryTop, summaryBy). Renders in console/console-full, as a compact one-line-per-entry block in the ai reporter, and as an additive summary key in the JSON report (absent when the flag is off, so the schema is unchanged for existing consumers). Computed after detection from data already in memory — runs without --summary are unaffected. (#934)
• Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams: declare isolation groups as comma-separated lists of pipe-separated folders (--skip-isolated "packages/team-a|packages/team-b,libs/a|libs/b"), and clones whose two fragments fall under two different folders of the same group are dropped. Duplication inside a single folder, against shared code, or across unrelated groups is still reported. The config file accepts the nested-array shape "skipIsolated": [["packages/a", "packages/b"]] (kebab-case skip-isolated works too), and the option applies to MCP project scans as well. Ports #628 to the Rust engine. (#942)

Security

• Supply-chain hardening (OpenSSF Scorecard) — every GitHub Action in the release and CI pipelines is pinned to a full commit SHA (kept fresh by Dependabot), workflow tokens follow least privilege (top-level contents: read, write grants scoped to the jobs that need them), and the repository now has a SECURITY.md with private disclosure channels, private vulnerability reporting, and a protected master branch

Bug Fixes

• GitHub "Latest" release badge stays on v5 — Rust v5 releases are created with --latest; legacy TypeScript v4 and cpd v* releases explicitly opt out, so a v4 maintenance release can no longer take the Latest badge from the v5 line

Other

• npm package page polish — README links are absolute GitHub URLs so they resolve on npmjs.com, and the package description and keywords better describe what jscpd does

Dependencies

• Bump Rust toolchain to 1.97 and oxc crates to 0.144 in /rust
• Bump serde to 1.0.229 in /rust
• Bump clap to 4.6.6 in /rust
• Bump memchr to 2.8.3 in /rust
• Bump xxhash-rust to 0.8.18 in /rust

Thank You ❤️

• @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#628), which this release ports to the Rust engine

Published Packages

• cpd-core@0.1.9 on crates.io
• cpd-finder@0.1.11 on crates.io
• cpd-reporter@0.1.9 on crates.io
• cpd-tokenizer@0.1.10 on crates.io
• jscpd@5.0.16 on crates.io
• cpd@5.0.16 on npm
• jscpd-darwin-arm64@5.0.16 on npm
• jscpd-darwin-x64@5.0.16 on npm
• jscpd-linux-x64-gnu@5.0.16 on npm
• jscpd-linux-arm64-gnu@5.0.16 on npm
• jscpd-linux-x64-musl@5.0.16 on npm
• jscpd-windows-x64-msvc@5.0.16 on npm

Not Yet Published

... (truncated)

Changelog

Sourced from jscpd's changelog.

5.0.16

New Features

• MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout; the project is scanned once at startup and kept in memory, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication, get_file_clones, get_statistics, check_current_directory. (#891)
• Codebase summary (--summary) — opt-in refactoring-hotspot overview: top files and folders ranked by tokens, lines, size, or complexity, with each file's duplication share; --summary-top and --summary-by tune it. (#934)
• Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams (--skip-isolated "packages/a|packages/b"); clones inside one folder or against shared code are still reported. Config file: "skipIsolated": [["packages/a", "packages/b"]]. (#628, #942)

Security

• Supply-chain hardening (OpenSSF Scorecard) — GitHub Actions pinned to commit SHAs, least-privilege workflow tokens, SECURITY.md with private vulnerability reporting, protected master branch

Bug Fixes

• GitHub "Latest" release badge stays on v5 — legacy v4 releases can no longer take the Latest badge from the v5 line

Thank You ❤️

• @​hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#628), which this release ports to the Rust engine

---

Commits

• 2b08d13 release: cpd-v5.0.16
• 7a01672 chore: pin GitHub 'Latest' badge to v5 releases, polish npm package page
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/openworkflowdev/openworkflow/@openworkflow/cli@702

npm i https://pkg.pr.new/openworkflowdev/openworkflow/@openworkflow/dashboard@702

npm i https://pkg.pr.new/openworkflowdev/openworkflow@702

commit: 3e92f3b