mirror of
https://github.com/kucherenko/jscpd.git
synced 2026-09-19 08:11:03 +08:00
apk
d790c6c1d3
Everything belonging to the v4 TypeScript engine moves to the master-v4 branch: apps/, packages/, build-utils/, changesets, pnpm workspace, turbo, the Node.js CI workflow and the ts-* release jobs. What remains is the Rust workspace under rust/, the npm wrapper and platform packages, the GitHub Action, Docker image, flake, skills, benchmark and fixtures/. - rust.yml gains a smoke job that runs the release binary against fixtures/ (json, sarif, html) and asserts clones and reporters - release.yml keeps only the Rust jobs; pnpm removed from every workflow; audit.yml keeps cargo audit + cargo deny; dependabot drops the root npm entry - root package.json becomes a thin private package depending on the exact jscpd@5 version so the pre-commit hook keeps installing the binary; sync-version.mjs keeps it in step - .pre-commit-hooks.yaml used v4-only flags that the v5 CLI rejects; fixed - FORMATS.md is now generated from the Rust tokenizer (224 formats) - README, docs, CONTRIBUTING, SECURITY, package and crate descriptions, benchmark and skills rewritten for v5 on its own terms: no v5-vs-v4 speed multipliers anywhere, a single "Looking for v4?" pointer to master-v4
1.3 KiB
1.3 KiB
Security Policy
Supported Versions
| Version | Branch | Supported |
|---|---|---|
| 5.x (Rust engine) | master |
✅ Active development |
| 4.x (TypeScript engine) | master-v4 |
✅ Security fixes only |
| < 4.0 | — | ❌ |
Reporting a Vulnerability
Please report security vulnerabilities privately — do not open a public issue.
- Preferred: GitHub private vulnerability reporting
- Alternatively: email kucherenko.andrey@gmail.com with "jscpd security" in the subject
Please include a description of the issue, steps to reproduce, affected versions, and any known impact.
You can expect an acknowledgement within 7 days. Once a fix is available, it is released for the supported version lines and the advisory is published with credit to the reporter (unless you prefer to stay anonymous).
Fixed vulnerabilities are identified in the release notes and changelog of the release that contains the fix, with a reference to the published advisory: rust/CHANGELOG.md for 5.x, and CHANGELOG.md on the master-v4 branch for 4.x.