kucherenko/jscpd v5.3.2

Release v5.3.2

on GitHub

New Features

• Rust dead code, read from the compiler. jscpd does not parse Rust, and does not need to. Every cargo build already prints lines like function reprint is never used, with real name resolution, trait dispatch and macro expansion behind them. The dead-code run now reads that output, from the JSON of cargo check (or build, clippy, test --no-run), and reports it next to everything else, through the same categories, reporters and --min-confidence, at 100% confidence.
  • basta takes --rust-diagnostics <file>, or - for a pipe: cargo check --all-targets --message-format=json | basta . --rust-diagnostics -.
  • jscpd takes the same flag for --dead-code, --dashboard and --health, so a Rust project gets its health badge from the check it already runs: cargo check --all-targets --message-format=json | jscpd . --health --rust-diagnostics - --reporters badge. The dead-code section of the config file takes the file as rustDiagnostics.
  • Neither tool runs cargo itself, because that would execute the project's build scripts and procedural macros.
  • The compiler's span covers only the name, so the item's real size is read from the source. An item that --all-targets reports twice is counted once. A diagnostic inside a macro expansion, or for a crate outside the scanned paths, is left out.
  • A finding from a test target is handled like a test file in any other language: reported only with --include-tests, at 85%.
  • In a workspace, cargo writes paths relative to the workspace root, and they are resolved as such. A relative manifest_path in a hand-edited or copied file is resolved from where the file lives.
  • The compiler never reports a pub item of a library, and it has no notion of an unused file, so jscpd reports neither for Rust.
  • The dashboard's dead-code heading no longer names three languages, and a project with no language the run could read says so in its health score.
  • See fixtures/dead-code-demo. (#1089)

Bug Fixes

• Text around an embedded code block was counted as code. A ts block in a markdown file, a <script> in a single-file component: jscpd scans these under the embedded language's own format, and the block keeps the line numbers of the file it lives in. The statistics read those numbers as if the block ran the whole way, which put the markdown prose and the component templates into the embedded language's line counts — both the total and the duplicated lines. On a repository with about 3600 markdown files the typescript row said 51.30% of lines were duplicated where the same code, scanned with -f typescript, said 3.37%. Neither number was a typo and both came from the same run.

  An embedded source now counts the lines its blocks occupy, and a clone counts the block lines it covers rather than everything its fragment reaches across. The two percentage columns agree again, which is the quickest way to check a run: they measure the same duplication, so when the line column sits far below the token column it is counting text that holds no code. Ordinary files are counted exactly as before. See fixtures/embedded-stats-demo. (#1091, closes #1090)

• Every clone was one line short. Duplicated lines came from end - start, so a clone covering lines 10 through 19 counted nine — while the console printed 10 lines for it, from its own arithmetic. Line counts are inclusive now, and the header and the table come from one place. Expect duplicated-line totals to rise by about one line per clone, and percentages with them. (#1091)

Other

• The dead-code engine in this release is basta 0.3.0, which is also published on its own: basta on npm, crates.io and GitHub.

Published Packages

• basta@0.3.0 on crates.io
• cpd-core@0.1.18 on crates.io
• cpd-finder@0.1.18 on crates.io
• cpd-reporter@0.1.19 on crates.io
• cpd-tokenizer@0.1.17 on crates.io
• jscpd@5.3.2 on crates.io
• cpd@5.3.2 on npm
• jscpd@5.3.2 on npm
• jscpd-darwin-arm64@5.3.2 on npm
• jscpd-darwin-x64@5.3.2 on npm
• jscpd-linux-x64-gnu@5.3.2 on npm
• jscpd-linux-arm64-gnu@5.3.2 on npm
• jscpd-linux-x64-musl@5.3.2 on npm
• jscpd-linux-arm64-musl@5.3.2 on npm
• jscpd-windows-x64-msvc@5.3.2 on npm
• jscpd-windows-arm64-msvc@5.3.2 on npm
• jscpd==5.3.2 on PyPI

Verify

Archives are signed with Sigstore (keyless, <asset>.sigstore.json)
and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:

cosign verify-blob \
  --bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt