build(deps): Bump jscpd from 4.0.5 to 4.1.0

[dependabot]

Bumps jscpd from 4.0.5 to 4.1.0.

Changelog

Sourced from jscpd's changelog.

4.1.0 — 2026-05-09

New Features

• AI Reporter — new ai reporter that produces compact, token-efficient clone output specifically designed for feeding results into language models and AI tooling. Use --reporters ai to activate it.
• MCP Server enhancements — the Model Context Protocol server now exposes a jscpd://statistics resource and supports a recheck endpoint so AI agents can trigger a rescan without restarting the process.
• Apex & CFML language support — jscpd can now detect duplicate code in Salesforce Apex and ColdFusion Markup Language (CFML) files (closes #83, #619).
• GDScript support — detect copy-paste duplication in Godot Engine GDScript files.
• HTML reporter footer — the HTML report now displays a branded footer with the jscpd version and a sponsor link.
• --noTips flag — suppress the usage-tip messages that appear after a detection run.
• CI: Node.js 22.x / 24.x — continuous integration updated to test against the latest Node.js LTS and current releases.

Performance

• Tokenizer — grammars are now loaded lazily, hot paths are O(n), and the spark-md5 dependency has been removed in favour of a lighter built-in implementation. Startup time and memory usage are noticeably reduced on large codebases.
• Replaced the vendored reprism syntax library with the official prismjs npm package, shrinking the installed footprint.

Bug Fixes

• Restored the correct start.line expectation for weak-mode clone detection.

---

4.0.7 — 2026-01-11

New Features

• jscpd-server — a new jscpd-server package ships a RESTful HTTP API for code-duplication detection. Ideal for CI pipelines, IDE plugins, and services that need on-demand analysis without spinning up a CLI process.
• GitHub Actions example — an example_github_action.yml starter workflow is included in the repository.

Bug Fixes

• Ignore patterns defined in configuration files are now applied correctly (the path-matching bug in resolveIgnorePattern has been fixed).
• Importing jscpd as a Node.js module no longer auto-executes the CLI entry point.
• Fixed an invalid documentation link.

---

4.0.6 — 2026-01-11

Bug Fixes

• Dependency and lock-file updates to address security advisories.

---

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

@dependabot merge

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR bumps jscpd to version 4.1.0. While the primary goal is a dependency update, the upgrade of the transitive dependency node-sarif-builder from v2 to v3 introduces a significant breaking change: the minimum required Node.js version has increased from >=14 to >=20.

Although Codacy analysis is 'up to standards', the PR lacks automated verification for this version transition. Specifically, the migration from reprism to prismjs and the updated engine requirements are not covered by any new or modified tests. The merge should be gated on verifying environment compatibility and functionality of the new reporting components.

About this PR

• The shift to Node.js 20 as a minimum requirement (via node-sarif-builder v3) is a systemic change. This must be validated across all infrastructure, including developer local environments, CI runners, and production-like containers.
• No functional or integration tests were added to verify the dependency bump. Given the replacement of internal syntax highlighting engines and SARIF builders, manual or automated verification is required to ensure detection accuracy.

Test suggestions

• Verify that jscpd 4.1.0 correctly identifies clones in the codebase.
• Confirm that SARIF reports are generated correctly using node-sarif-builder 3.4.0.
• Validate the tool's execution in a Node.js 20+ environment, given the updated engine requirements.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that jscpd 4.1.0 correctly identifies clones in the codebase.
2. Confirm that SARIF reports are generated correctly using node-sarif-builder 3.4.0.
3. Validate the tool's execution in a Node.js 20+ environment, given the updated engine requirements.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Pinning the dependency to the exact version 4.1.0 ensures deterministic builds and protects against potential dependency confusion or hijacking attacks. While the package-lock.json locks the current installation, pinning in package.json provides an additional layer of security.

Suggested change

	"jscpd": "^4.1.0"
	"jscpd": "4.1.0"

[codacy-production]

_{🔴 HIGH RISK}

The update to jscpd@4.1.0 introduces node-sarif-builder@3.4.0, which requires Node.js >= 20. This is a breaking change for the execution environment. Please verify CI config files and Dockerfiles to ensure the environment is updated to version 20 or higher.

[dependabot]

Superseded by #53.