chore(deps): update dependency jscpd to v5.0.15

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jscpd (source)	5.0.14 → 5.0.15

---

Release Notes

kucherenko/jscpd (jscpd)

v5.0.15

Compare Source

New Features

• SARIF: size-based severity — new --sarif-error-tokens <N> flag (also sarifErrorTokens in .jscpd.json): clones with at least N tokens are reported at level error while smaller ones stay warning. When overall duplication exceeds --threshold, all SARIF results are emitted as error, matching the threshold check that fails the build. Default output is unchanged when neither option is set. (#​908)
• SARIF: clone fingerprints — each result carries token_count and a clone_hash in its properties bag, plus a partialFingerprints entry (jscpdCloneHash/v1) for cross-run result identity in consumers like GitHub code scanning. The hash is order-insensitive, so the same clone pair produces the same hash regardless of file discovery order. (#​909)
• SARIF: related-location messages — the duplicate's counterpart location now has a message (Duplicated at <path>:<line>), and the primary message references it via a SARIF embedded link so GitHub code scanning displays it. (#​911)
• SARIF: richer rule metadata — the jscpd/duplicate-code rule now includes a display name, full description, default configuration, and quality tags for better presentation in SARIF viewers and Azure DevOps. (#​914)

Bug Fixes

• Scan-root-relative report paths — fragments store their scan root separately (source_root), so report paths are relative to the scanned directory again (as in 4.x) while reporters can still resolve and read source files; SARIF emits originalUriBaseIds with per-root base ids. Fixes empty snippets and unresolvable paths when scanning from outside the target directory, including multi-root scans. (#​872, #​892)
• Report version stamping — the SARIF tool.driver.version (previously hardcoded 5.0.3) and the HTML report version now match cpd --version, bundled at build time. (#​915)
• Multi-root blame attribution — with multiple scan roots containing the same relative path, git blame data is now keyed by resolved path, so the second root no longer inherits the first root's authors.
• Git root discovery — walking up from a relative scan path no longer terminates early before reaching the repository root.

Dependencies

• Bump serde_json to 1.0.151 in /rust
• Bump ignore to 0.4.32 in /rust
• Bump anyhow to 1.0.104 in /rust

Thank You ❤️

This release was shaped by community contributions — huge thanks to:

• @​chrisc-onaorg for the SARIF clone fingerprints (#​910), related-location messages (#​912), and richer rule metadata (#​914), plus reporting #​909, #​911, and #​915
• @​darronz for the scan-root-relative paths fix (#​913)
• @​nvuillam for proposing size-based SARIF severity (#​908)

Published Packages

• cpd-core@0.1.8 on crates.io
• cpd-finder@0.1.10 on crates.io
• cpd-reporter@0.1.8 on crates.io
• cpd-tokenizer@0.1.9 on crates.io
• jscpd@5.0.15 on crates.io
• cpd@5.0.15 on npm
• jscpd-darwin-arm64@5.0.15 on npm
• jscpd-darwin-x64@5.0.15 on npm
• jscpd-linux-x64-gnu@5.0.15 on npm
• jscpd-linux-arm64-gnu@5.0.15 on npm
• jscpd-linux-x64-musl@5.0.15 on npm
• jscpd-windows-x64-msvc@5.0.15 on npm
• jscpd@5.0.15 on npm

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[w3nl]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}