First release from the v5-only master. Bumps jscpd to 5.1.2 and every
sub-crate (cpd-core 0.1.11, cpd-tokenizer 0.1.13, cpd-finder 0.1.14,
cpd-reporter 0.1.12) so the new crates.io metadata from #988 and the
Windows drive-path fix in cpd-finder are republished. Adds the 5.1.2
changelog section (linux-arm64-musl package, cargo-binstall, Docker
image, jscpd --version naming, pre-commit hook args, repository split)
and refreshes the version examples in docs/.
Pre-release checks: cargo fmt, clippy -D warnings, cargo test --locked
(22 suites), cargo check --all-targets --target x86_64-pc-windows-msvc,
release-notes extraction dry-run against rust/CHANGELOG.md.
Everything belonging to the v4 TypeScript engine moves to the master-v4
branch: apps/, packages/, build-utils/, changesets, pnpm workspace, turbo,
the Node.js CI workflow and the ts-* release jobs. What remains is the
Rust workspace under rust/, the npm wrapper and platform packages, the
GitHub Action, Docker image, flake, skills, benchmark and fixtures/.
- rust.yml gains a smoke job that runs the release binary against
fixtures/ (json, sarif, html) and asserts clones and reporters
- release.yml keeps only the Rust jobs; pnpm removed from every workflow;
audit.yml keeps cargo audit + cargo deny; dependabot drops the root npm entry
- root package.json becomes a thin private package depending on the exact
jscpd@5 version so the pre-commit hook keeps installing the binary;
sync-version.mjs keeps it in step
- .pre-commit-hooks.yaml used v4-only flags that the v5 CLI rejects; fixed
- FORMATS.md is now generated from the Rust tokenizer (224 formats)
- README, docs, CONTRIBUTING, SECURITY, package and crate descriptions,
benchmark and skills rewritten for v5 on its own terms: no v5-vs-v4 speed
multipliers anywhere, a single "Looking for v4?" pointer to master-v4
Rust / crates.io
- report the invoked binary name in --version/--help (jscpd vs cpd)
- add repository, documentation, keywords, categories to all crates
- exclude tests/ from the jscpd crate package; add cargo-binstall metadata
- expand the crates.io README and render it on docs.rs
npm
- add funding field to jscpd, cpd and jscpd@4 packages
- add jscpd-linux-arm64-musl platform package and clearer unsupported-platform error
- enable provenance for the v4 changeset publish
Pipelines
- rust.yml: windows-latest in the matrix, drop dead schedule guard
- release.yml: cosign-sign release assets, floating v5 tag, LICENSE in tarballs,
invoke the new docker.yml (GHCR multi-arch image) after each release
- audit.yml: nightly cargo audit, cargo deny and pnpm audit
- Dockerfile: multi-stage image from release binaries (distroless), mcp target for Glama
Docs / community
- README: shields badges, single primary install per OS, GitHub Action snippet,
link to jscpd.dev, v5.1 features, 15 reporters, 224 formats, 8 platforms
- docs: @v5 action tag, Docker usage, baseline section, current crate versions
- YAML issue forms with engine selector, config.yml, CODEOWNERS
- remove stale .github/CONTRIBUTING.md stub, custom.md, TODO.md; untrack rust/jscpd-report.json
- examples: mark as v4 API, add a Rust cpd-finder example
Republishes the jscpd npm wrapper with platform pins that match the
release. jscpd@5.1.0 shipped optionalDependencies pinned to the 5.0.16
binaries, so `npm i jscpd@5.1.0` resolved an engine one release behind
and `jscpd --version` printed `cpd 5.0.16` — every 5.1.0 fix, including
the Windows --baseline-from-ref fix, was absent for jscpd users. The cpd
package, the platform packages and the crates.io release were all correct;
only the wrapper's pins were stale.
Root cause in scripts/sync-version.mjs: the wrapper's version and its
platform pins were written behind one `version !== npmVersion` guard, so
once anything set version before the script ran, the guard read "already
up to date" and skipped the pins. Version and pins are now updated
independently, and the script ends by verifying that every npm version and
platform pin equals the release version, exiting non-zero otherwise.
release.yml runs this script, so the same mismatch now fails the release
rather than publishing. This is the 5.0.13 defect again — that fix covered
the cpd package but not the jscpd wrapper.
Sub-crates bumped for the code that changed since the published 5.1.0
(cpd-tokenizer 0.1.12, cpd-finder 0.1.13, cpd-reporter 0.1.11); cpd-core
is unchanged at 0.1.10. The only source delta is the clippy collapsible_if
rewrites unmasked by the MSRV correction, which are behaviour-preserving.
Pre-release verification: cargo fmt --check, clippy --workspace
--all-targets -D warnings, 847 tests, cargo +1.96 check at the declared
MSRV, and — per the Windows-only blind spot that blocked 5.0.15, 5.0.16
and 5.1.0 — cargo check --workspace --all-targets --target
x86_64-pc-windows-msvc, all clean. Release-notes extraction for 5.1.1
dry-run against rust/CHANGELOG.md returns the right section.
Revert the 5.1.1 bump (its release run was cancelled before publishing
anything; crates.io already has 5.1.0 and npm has nothing newer than
5.0.16, so the registry-based detect resumes the 5.1.0 release on this
push) and fold the fingerprint fix into the 5.1.0 changelog section.
Claude-Session: https://claude.ai/code/session_01VvWzWfEK6oV4HTe6EoGkff
Bump cpd/jscpd to 5.0.14 and changed sub-crates (cpd-core 0.1.7,
cpd-tokenizer 0.1.8, cpd-finder 0.1.9). Includes --cross-formats (#810)
and the prose-only markdown fix (#883).
sync-version.mjs now also syncs the cpd package optionalDependencies
(cpd@5.0.12 shipped pointing at the 5.0.11 binaries, which forced the
manual npm-only cpd@5.0.13) and its inter-crate dependency regex now
matches the actual Cargo.toml formatting (space before closing brace),
so dependency refs are bumped along with crate versions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Renames the compiled binary from cpd(.exe) to jscpd(.exe) and the
platform-specific optional-dependency npm packages from cpd-* to
jscpd-* to avoid collision with an antivirus-flagged executable name.
Fixes#826
- Add curl install method (jscpd.dev/install.sh) to README Quick Start
- Remove unused badges (Ukraine, jscpd SVG, npm downloads, codecov,
FOSSA, Open Collective, nodei.co) from README; keep npm version,
license, CI, and NPM badge
- Remove Star History and GA tracker from README; restore NPM badge
- Add GA tracker to all sub-READMEs
- Set homepage to https://jscpd.dev in all package.json files
- Set homepage to https://jscpd.dev in all Cargo.toml files
The publish-jscpd job was missing actions/setup-node with registry-url,
so NODE_AUTH_TOKEN was never written to .npmrc. npm publish failed with
ENEEDAUTH because it couldn't authenticate to the npm registry.
Also normalized repository.url in rust/package.json and
rust/jscpd/package.json to use git+https:// prefix (as npm pkg fix
recommends) to suppress the publish warning.
- Add BlameMap type to blame module, expose per-line blame data
- enrich() now returns BlameMap for reporter consumption
- ReporterOptions gains blame_data field for per-line blame lookup
- console-full --blame shows: line_a | author_a | ==/<= | line_b | author_b | code
- console-full no-blame shows both fragment A and B snippets
- Add statistics table to console-full reporter
- Strip :format suffix from source_id in print_snippet
- Bump version to 5.0.2
- Add npm package scaffold for cpd@5.0.0 with prebuilt binary distribution
- rust/package.json: main cpd package with optionalDependencies for 6 platforms
- rust/run-cpd.js: CLI shim with platform detection and binary resolution
- rust/platform-map.js: platform detection (6 targets including musl)
- rust/npm/prebuilt-targets.json: platform matrix configuration
- rust/npm/cpd-*/package.json: platform package templates
- rust/scripts/npm-prebuilt-package.mjs: assembles platform packages from binaries
- Add GitHub Actions workflows
- .github/workflows/crates-publish.yml: publishes all 5 crates to crates.io
in dependency order with OIDC Trusted Publishing and index-wait polling
- .github/workflows/npm-rust-publish.yml: cross-compiles for 6 platforms,
publishes platform packages with idempotency checks, then main cpd package
- .github/workflows/release-rust.yml: orchestrator triggered by push to
release/rust branch, creates GitHub Release with cpd-v<version> tag
- Configure Rust crates for publishing
- Change binary name from jscpd to cpd (crate name stays jscpd)
- Convert inter-crate deps to dual version+path format for crates.io
- Update integration tests for cpd binary name
- Add build and release scripts
- rust/scripts/sync-version.mjs: syncs version from package.json to Cargo.toml
- rust/scripts/publish-crates.sh: manual crates.io publish with dependency ordering
- Document pnpm workspace exclusion for rust/ directory
apk