build(deps): Bump jscpd from 4.0.5 to 4.0.9

[dependabot]

Bumps jscpd from 4.0.5 to 4.0.9.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

@dependabot merge

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes. Give us feedback}

[codacy-production]

Pull Request Overview

While the dependency update to jscpd@4.0.9 is technically up to standards, it introduces a breaking change in the Node.js engine requirement (>=20) via the node-sarif-builder transitive dependency. This upgrade from v2 to v3 in the SARIF reporter also poses a risk of API incompatibilities that could break duplication reporting in CI. Ensure your environment and configuration are compatible before merging.

Test suggestions

• Verify that duplication detection remains functional with jscpd 4.0.9.
• Ensure SARIF report generation is compatible with node-sarif-builder v3.4.0.
• Validate that the execution environment/CI supports Node.js >= 20 as required by the new sarif-builder.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that duplication detection remains functional with jscpd 4.0.9.
2. Ensure SARIF report generation is compatible with node-sarif-builder v3.4.0.
3. Validate that the execution environment/CI supports Node.js >= 20 as required by the new sarif-builder.

Low confidence findings

• The upgrade of node-sarif-builder to v3.4.0 may introduce breaking changes that impact SARIF reporting functionality. It is recommended to verify the output format matches existing consumers of the report.

---

🗒️ Improve review quality by adding custom instructions

[codacy-production]

_{🔴 HIGH RISK}

Updating to jscpd@4.0.9 introduces a transitive dependency on node-sarif-builder@3.4.0, which increases the minimum Node.js requirement to version 20 (up from version 14). This may cause runtime failures in environments using older Node.js versions.

Try running the following prompt in your coding agent:

Check the CI configuration files (e.g., .github/workflows, .gitlab-ci.yml) and Dockerfiles to verify that the Node.js version is set to 20 or higher.

[codacy-production]

_{🔴 HIGH RISK}

Suggestion: Specify the exact version for the dependency to prevent dependency hijacking and ensure build reproducibility.

Suggested change

	"jscpd": "^4.0.9"
	"jscpd": "4.0.9"

See Issue in Codacy

[dependabot]

Superseded by #52.