kucherenko/jscpd v5.0.16

Release v5.0.16

on GitHub

New Features

• MCP server over stdio (--mcp) — cpd --mcp /path/to/project serves the Model Context Protocol on stdin/stdout, the transport MCP clients spawn and manage themselves (no port, no network policy). The project is scanned once at startup and kept in memory as detection-ready token hashes, so check_duplication snippet checks answer in milliseconds. Tools: check_duplication (accepts format names or file extensions), get_file_clones (clones involving one file — new over the HTTP server), get_statistics, and check_current_directory (returns the clone list). All clone/match lists are sorted biggest-first and capped by an optional limit argument (default 100) with the untruncated total always reported. Implements protocol revision 2025-06-18 (accepting 2025-03-26 / 2024-11-05 clients); all standard detection options (--min-tokens, --format, --cross-formats, ...) apply to the scan and to snippet checks. (#891)
• Codebase summary (--summary) — opt-in refactoring-hotspot overview appended to the run output: top files and folders ranked by tokens, lines, size, or a token-based cyclomatic-complexity estimate, with each file's duplication share. --summary-top <n> sets the list length, --summary-by tokens|lines|size|complexity picks the ranking metric (config file: summary, summaryTop, summaryBy). Renders in console/console-full, as a compact one-line-per-entry block in the ai reporter, and as an additive summary key in the JSON report (absent when the flag is off, so the schema is unchanged for existing consumers). Computed after detection from data already in memory — runs without --summary are unaffected. (#934)
• Isolated folder groups (--skip-isolated) — skip duplication between monorepo folders owned by different teams: declare isolation groups as comma-separated lists of pipe-separated folders (--skip-isolated "packages/team-a|packages/team-b,libs/a|libs/b"), and clones whose two fragments fall under two different folders of the same group are dropped. Duplication inside a single folder, against shared code, or across unrelated groups is still reported. The config file accepts the nested-array shape "skipIsolated": [["packages/a", "packages/b"]] (kebab-case skip-isolated works too), and the option applies to MCP project scans as well. Ports #628 to the Rust engine. (#942)

Security

• Supply-chain hardening (OpenSSF Scorecard) — every GitHub Action in the release and CI pipelines is pinned to a full commit SHA (kept fresh by Dependabot), workflow tokens follow least privilege (top-level contents: read, write grants scoped to the jobs that need them), and the repository now has a SECURITY.md with private disclosure channels, private vulnerability reporting, and a protected master branch

Bug Fixes

• GitHub "Latest" release badge stays on v5 — Rust v5 releases are created with --latest; legacy TypeScript v4 and cpd v* releases explicitly opt out, so a v4 maintenance release can no longer take the Latest badge from the v5 line

Other

• npm package page polish — README links are absolute GitHub URLs so they resolve on npmjs.com, and the package description and keywords better describe what jscpd does

Dependencies

• Bump Rust toolchain to 1.97 and oxc crates to 0.144 in /rust
• Bump serde to 1.0.229 in /rust
• Bump clap to 4.6.6 in /rust
• Bump memchr to 2.8.3 in /rust
• Bump xxhash-rust to 0.8.18 in /rust

Thank You ❤️

• @hanzhangyu for proposing isolated folder groups for monorepos and contributing the original skipIsolated implementation (#628), which this release ports to the Rust engine

Published Packages

• cpd-core@0.1.9 on crates.io
• cpd-finder@0.1.11 on crates.io
• cpd-reporter@0.1.9 on crates.io
• cpd-tokenizer@0.1.10 on crates.io
• jscpd@5.0.16 on crates.io
• cpd@5.0.16 on npm
• jscpd-darwin-arm64@5.0.16 on npm
• jscpd-darwin-x64@5.0.16 on npm
• jscpd-linux-x64-gnu@5.0.16 on npm
• jscpd-linux-arm64-gnu@5.0.16 on npm
• jscpd-linux-x64-musl@5.0.16 on npm
• jscpd-windows-x64-msvc@5.0.16 on npm

Not Yet Published

• jscpd@5.0.16 (published: 5.0.15)