chore(deps-dev): bump the npm-dev-dependencies group in /cli with 3 updates

[dependabot]

Bumps the npm-dev-dependencies group in /cli with 3 updates: @types/node, jscpd and knip.

Updates @types/node from 26.6.4 to 26.6.5

Commits

• See full diff in compare view

Updates jscpd from 5.4.0 to 5.4.1

Release notes

Sourced from jscpd's releases.

Release v5.4.1

New Features

• --similarity compares the structure of functions in 15 languages. jscpd parses every function and method and normalizes its syntax tree: the names of the functions it calls and its operators stay, local names, field names and literals become markers, and comments and the parentheses around one expression drop out. Every subtree of that tree is a fingerprint, and two functions score the Jaccard index of their two fingerprint sets, so a renamed copy scores 1 and an edited statement lowers the score.

  • It reads JavaScript, TypeScript, Python, Java, Kotlin, Scala, C#, Go, Rust, C, C++, PHP, Ruby, Swift and Clojure, and the code blocks of Markdown files and the scripts of Vue, Svelte and Astro components. 5.4.0 compared JavaScript and TypeScript only.
  • The search is exact: it finds every pair at or above the ratio. A function nested in another is part of it, and test files and Rust mod tests are left out. Code between jscpd:ignore-start and jscpd:ignore-end, or matched by --ignore-pattern, adds nothing to a function (#1144).
  • --similarity alone compares at 0.8. --min-nodes (config key minNodes, 20 by default) sets the smallest normalized tree that takes part, --min-lines applies as before and --min-tokens does not. The JSON report gives the node count of both functions as nodes.
  • While the method was built, a check on 100 open-source repositories against a brute-force implementation of it, which scores every pair, found the same 58,405 pairs with the same scores, and jscpd's runs took 64.8 seconds on one thread against 498.
  • fixtures/similarity-demo has a runnable example in every language. (#1129, #1132, #1134, #1136, #1139, #1147, #1148, #1149, #1150, #1152, #1155, #1138, #1141, #1142, #1143, #1145, #1146, #1156)

• An edn reporter. -r edn writes jscpd-report.edn with {:candidates [...] :clones [...]}. The candidates are every pair --similarity found, most similar first, with their score, language, both locations and node counts, also the pairs a token clone already reports. The clones are the ones the other passes found, with their kind, method and score. (#1151, #1153, #1156)

• --changed reports the clones of the files you are working on. The changed files are the ones git status lists: staged, unstaged and untracked files, and a renamed file under its new name. jscpd still scans every file and reports a clone when one of its fragments is in a changed file, so a new file that copies an unchanged one shows up.

  • The first run saves the clones of HEAD to .jscpd-baseline.json at the repository root, or to the --baseline file, with the commit and a hash of the scan paths and options. Later runs read it and mark the clones HEAD did not have as [NEW], so --fail-on-new-clones works with it. jscpd builds the file again after a commit or for other paths or options. A baseline file without a commit, such as one --update-baseline wrote, is used as it is.
  • --changed-only scans the changed files alone, and they match only one another.
  • Both flags are command line only. fixtures/changed-demo walks through five steps. (#1154, #1172)

• --report-name sets the base name of the report files. Linter aggregators such as MegaLinter run several tools into one reports folder, and two jscpd runs there overwrote each other's jscpd-report.json. --report-name megalinter-jscpd (config key reportName) names the json, xml, csv, html, markdown, sarif and edn reports, and the GitHub Action takes it as the report-name input. The badge, OpenMetrics and CodeClimate files keep their names. The name must be a plain file name: a path, an extension or an empty name is an error. Contributed by @​MannXo. (#1015, #1058)

• The MCP server finds every type of clone and compares folders. Every tool takes kinds: exact, renamed, similar and semantic, or type1 to type4. Without it, a tool reports what jscpd reports with the server's options. compare_folders(left, right) returns the JSON report of --compare for two folders. The server speaks the MCP revision 2026-07-28, and clients of the older revisions keep working. check_duplication now finds every copy of a snippet, where it used to match one of two, and --mcp no longer ignores --semantic. (#1135, #1137)

Changes

• --similarity scores differ from 5.4.0. The method is new, so a pair that scored 0.85 before can score lower now. Refresh a --threshold or a baseline that was set on the old results. --similarity 1 now reports functions with the same structure; up to 5.4.0 a ratio of 1 turned the search off, and jscpd prints a warning that says so. The options that the method replaced never reached a release. (#1156)

Bug Fixes

• --semantic and --compare found functions named if in C, C++ and C# code. Around #if and #ifdef, the grammars read else if (…) { } as a function named if, or while or await, and every if ( in the scan counted as a call to it, so in --compare one such branch could collect thousands of callers. jscpd now drops a function whose type is the keyword else. A word such as if, while or catch before a parenthesis counts as a call only as a member, as in promise.catch(f). Reported by @​MysterionRise, fixed by @​mvanhorn. (#1163, #1188)

• Three --compare fixes found on Apache Lucene and Lucene.NET, all by @​MysterionRise:

  • Test helpers now count toward the namesakes of a call. A private assertEquals in Lucene's benchmark code took all 6,127 calls to the name, 6,126 of them from tests. (#1165)
  • The HTML map cuts a long folder label in its middle, so the folders of one module no longer read alike. (#1166)
  • A .NET test project counts as tests wherever Tests sits in its dotted name, as in Lucene.Net.Tests.Analysis.Common. Before, 6,736 functions in 771 files of such projects counted as code. (#1167)

• The --compare reports disagreed. The console and the HTML map now round a share the same way, so 60 of 147 functions read 41% in both. A Tests block appears only when a side has a test that counts, and a declaration without a body no longer counts as a function. (#1130)

• --dead-code reported an import used only in a TSDoc link as unused. {@link X}, {@linkcode X} and {@linkplain X} now count as uses of X, as TypeScript counts them, and in JavaScript files the JSDoc types of @param, @returns, @type and the like count too. A name in the docs credits the import only, so a function that only a link names is still reported. (#1170, #1171)

• --ignore-pattern dropped the wrong tokens in code blocks. jscpd computed the ranges on the host file but tokenized Markdown fences, component scripts and Razor blocks from the block's own offsets. The ranges now move to the block. (#1144)

• git commands run from a hook acted on the hook's repository. jscpd's git subprocesses now drop the variables git exports to hooks, such as GIT_DIR and GIT_INDEX_FILE; before, --baseline-from-ref in a pre-commit hook wrote the base tree into the commit's index. A --history range or a --baseline-from-ref ref that starts with - is refused, so a scanned repository's config can no longer pass git an option such as --output=<file>. The worktree cleanup no longer prunes the user's other worktrees, and an API key that an embeddings API echoes in an error is redacted. (#1169)

• The Nix flake warned about stdenv.isDarwin. It uses stdenv.hostPlatform.isDarwin now. Contributed by @​mlavrinenko. (#1133)

Other

• The minimum Rust version is 1.97. oxc 0.153 and ruff 0.0.16 need it. (#1187)
• jscpd depends on basta 0.3.1, which has the dead-code fixes above.
• The tests check behavior instead of implementation details, and CI measures line coverage (#1168). The release retries cargo publish while the crates.io index catches up (#1123), and the compare-codebases skill keeps vendored and build folders out of a comparison (#1124).

... (truncated)

Commits

• 095d6ca release: cpd-v5.4.1
• See full diff in compare view

Updates knip from 6.39.0 to 6.41.0

Release notes

Sourced from knip's releases.

Release 6.41.0

• Add Flue plugin (#2124) (c52737d45ff008d6d96d4c2d4182048a2aa64602) - thanks @​LuisFigueroaG!
• Match all React Native config file extensions (#2125) (898fdffb37ae0bdb3d2653038eb10c2e01edf983) - thanks @​LuisFigueroaG!
• Consolidate fixture guidance and extend plugin guidelines (37a4ca04645f71f599e9b530676543f9893bd641)
• Add AI contribution policy (b15f0fbb090ea0427240880da2bec602c11cea50)
• Use files from tsconfig references with --use-tsconfig-files (#2126) (9618185eafb0c5cb365035f89e9d66718642338a) - thanks @​kaanisthatyou!
• Compile gitignore walk patterns once (resolve #2127) (09c80299779fa5abe133ee8f82051c25870007b8)
• Drop readdir order dependent case from gitignore walk test (ab3da8ff95a05a0fbfba6873b64559017d038aa7)
• fix: recognize binaries from absent optional dependencies (#2120) (d908556eaa98bf9637a2744d2de089bab31b8dbc) - thanks @​DreamLongYT!
• Apply a directory's .gitignore before walking its subdirectories (9560c07862d4c72dc956371b9a77e049d83ed4a9)
• Apply nested .gitignore files to workspace globs (23d35421dd67c405254f2f8bcbc09b18d224e338)
• Update gitignore matcher and walk notes (499f85f4544457dc7c51c4a7612fea69773ef3dd)
• Keep the cwd out of glob patterns and matchers (#2107) (1e82fb807c88cc46951f2028214569f9a2eb0061) - thanks @​kaanisthatyou!
• Support function configs in Rsbuild plugin (#2122) (38071db87e9023e5dd61173ce32f9020a1a5d7ff) - thanks @​bytedoe!
• Separate Expo Router plugin; remove expo-router entry points from Expo plugin (#2128) (ad541764ca7d3c062236661677d1d66d5275122f) - thanks @​jjjjonathan!
• Link Expo config discovery source and fold expo6 fixture into expo-router (2ddeca50956790b10580e835df50bc980cce961d)
• Update dependencies (c9f79148f7165314a7b3c801eff926d1d0d6b060)
• Migrate shell script parsing to unbash v5 (4942cca05303410120a007a5bb23b0c2da725da1)
• Handle updated Formatly result types (ca9e8315e003dae69646f7500fa98ab9ed403b92)
• Preserve TypeScript 5.0 compatibility in shell AST filters (957ac7bbd654f6d3d0c4dc4eab2f4aa133ff0b4b)
• Point timerify crashes to the Node.js version that fixes them (0c235de096fd3361eb918d1290241fa32a62f089)
• Copy importer identifier sets into the reverse index (2860d678a87dddb5ad56299119fb6e108ceffa12)
• Clear the resolver cache at the start of a run (10b5bb82ecd03c88b68ace58a7aea23d188cc5f1)

Release 6.40.0

• Resolve local and scope-only extends in commitlint plugin (#2079) (e667552d4e7122094565d3ad9ae407acfc0ac684) - thanks @​giaBaoJS!
• Clarify worktree guides and plugin review preparation (dd02baf020d23af1d47c44c1a726a61014b270bd)
• Document stale cache results and workarounds (#2078) (3573749a5d5bbee6305f207cc7d1b72c200c8c9b)
• Exclude test files from package entries in production mode (resolve #2082) (b86f45f9d38d4b83baad98e43983e08910e00c78) - thanks @​jonathanong!
• Resolve Serverless file variables in plugins and functions (resolve #2074) (99cac789694ea8d76cd38184d2d7c95f34315224) - thanks @​SwastikTripathi!
• Preserve locally referenced namespace members (resolve #2070) (f0f36df766cd74ad7ae03fbf8940bdeb792439be) - thanks @​MFA-G!
• fix: add the commitlint-plugin prefix to Commitlint plugin names (#2096) (3decd35ff0a4220c7cd2c9142dc69c89794b3927) - thanks @​devYRPauli!
• fix: match .mjs config files in the simple-git-hooks plugin (#2097) (79a87d92396c2444ae4ef3c780c0d2e18cd73e4c) - thanks @​devYRPauli!
• fix: match capacitor.config.js in the Capacitor plugin (#2098) (4a5ec96d818117a7f2eafa027e3b707bc97573a8) - thanks @​devYRPauli!
• fix(typescript): ArrayExpression (#2099) (#2100) (87fea9f201c2fd864eafa31bdad68910a8a177ba) - thanks @​DreamLongYT!
• Preserve development entry pattern groups (7c229f4e1918075d801ed3b046fa022b1d3bcc41)
• Resolve null package exports to the files they hide (resolve #2084, close #2085) (5bd46260feb60b957c2631bc72375ef192e441e0)
• Pin InvokeAI ecosystem test (4e0a3432eb35e3f628f6d3b7fcd14b942de343d0)
• fix(utils): add jsx extension to source mapping (#2087) (eaa353b5fc30c2f12cdf2c29e6dd68e0d0950062) - thanks @​DreamLongYT!
• fix(serverless-framework): handle explicit extensions in handler paths (#2091) (e9393965be7563640921e3f20c946fcb9132e1cb) - thanks @​DreamLongYT!
• Annotate published manifest return type (d95a8310a0d0dca8f23d8dd3f83e7b0a1909d038)
• Add Jasmine plugin (#2105) (9ed14911d5c5752aef36878ab3d515c35d1ac6bc) - thanks @​SulimanAbdulrazzaq!
• fix: resolve workspace exports with fallback arrays (#2088) (49c2aaeaba4544f25cc02c19d5da5152a8ef68c3) - thanks @​DreamLongYT!
• fix(postcss): ignore disabled plugins in object configs (#2092) (b84fdf8a8ee676ee45f4313009ebfe969d034a88) - thanks @​DreamLongYT!
• Resolve webServer commands in Playwright plugin (#2110) (1af96bce36b0d0d07791de100c7f2ea5672a478c) - thanks @​everton-dgn!
• Cache config file inputs per plugin (#2109) (01cb43267ca5dc03a2cbcba0a19fd891d4ed1f37) - thanks @​everton-dgn!
• fix: include custom compiler extensions in source path mapping (#2090) (dc3a47e2d810808314454b8f5c23070f136d15d3) - thanks @​DreamLongYT!
• Don't let a self-closing swallow the next (#2113) (989fdadde0a068d1d1c52e26a8327b99c5de0668) - thanks @​maniflopi!
• fix(oxlint): resolve lint from loaded Vite config (#2108) (6d44e532ed6320cdf4f4c3253b26e155c4d26ba7) - thanks @​everton-dgn!
• fix: resolve Jest module names without the jest-* prefix (#2095) (a5f4cfbff7f263a0ea8d5461a3f9216cbef38602) - thanks @​devYRPauli!

... (truncated)

Commits

• 13d7f21 Release knip@6.41.0
• 10b5bb8 Clear the resolver cache at the start of a run
• 2860d67 Copy importer identifier sets into the reverse index
• 0c235de Point timerify crashes to the Node.js version that fixes them
• 957ac7b Preserve TypeScript 5.0 compatibility in shell AST filters
• ca9e831 Handle updated Formatly result types
• 4942cca Migrate shell script parsing to unbash v5
• c9f7914 Update dependencies
• 2ddeca5 Link Expo config discovery source and fold expo6 fixture into expo-router
• ad54176 Separate Expo Router plugin; remove expo-router entry points from Expo plugin...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions