[dependabot]

Bumps the tooling-minor-patch group with 5 updates in the / directory:

Package	From	To
prettier	3.9.9	3.9.10
eslint-plugin-prettier	5.5.6	5.5.7
dependency-cruiser	18.4.0	18.7.2
jscpd	5.3.3	5.4.2
knip	6.38.0	6.44.1

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view

Updates eslint-plugin-prettier from 5.5.6 to 5.5.7

Release notes

Sourced from eslint-plugin-prettier's releases.

v5.5.7

Patch Changes

• #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

• #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

New Contributors

• @​truongbo17 made their first contribution in prettier/eslint-plugin-prettier#798
• @​OskarEichler made their first contribution in prettier/eslint-plugin-prettier#796

Full Changelog: prettier/eslint-plugin-prettier@v5.5.6...v5.5.7

Changelog

Sourced from eslint-plugin-prettier's changelog.

5.5.7

Patch Changes

• #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

• #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

Commits

• e6dd27a chore: keep packageManager when cleaning package.json for release (#808)
• 7544956 chore: release eslint-plugin-prettier (#799)
• e3e5238 ci: enable npm publish provenance for changesets v3 (#807)
• 7c923c4 build(deps): Bump http-cache-semantics from 4.2.0 to 4.3.0 (#806)
• 1b7c433 fix: bump synckit to surface worker failures instead of hanging (#805)
• a6b3feb docs: explain line endings and endOfLine behavior (#804)
• 2f6ba1d ci: exercise the getLocFromIndex ponyfill on ESLint 9 (#803)
• cf1d2c5 chore(deps): update (#802)
• 9f14a55 chore(deps): update all dependencies (#788)
• 7e53ecd fix: map fallback source locations to actual line starts (#796)
• Additional commits viewable in compare view

Updates dependency-cruiser from 18.4.0 to 18.7.2

Release notes

Sourced from dependency-cruiser's releases.

v18.7.2

🐛 fixes

• e65bb5b4 fix(extract/resolve): adds correctly handling 'bundledDependencies: true' (#1120) thanks to @​sebdanielsson for finding and filing the issue that led to this fix.

👷 maintenance

• 4e2daa02 fix(manifest): updates contributor list with recent contributors
• a37c1cf6 chore(test): bumps minimum branch coverage up to current HWM
• 1ecdae89 build(npm): updates external dependencies

v18.7.1

🐛 fixes

• 2a46eecf fix(main/resolve-options): resolves tsconfig paths without baseUrl from the tsconfig directory (#1116) Thanks to @​thirtytwobits for raising the issue and @​Johannes7549 for making the fixing pull request!
• fd7889bf fix(extract/transpile): passes the file name to the typescript transpiler to prevent it choking on imports from './module' (#1118). Thanks to @​sebdanielsson for reporting the issue, finding the root cause and baking the fixing PR!

👷 maintenance

• 00ca161c build(npm): updates external dependencies
• 96a1dd35 doc(README): removes broken link
• c5b97371 chore(npm): refreshes lock-file
• dbe5e74e chore(Gort): makes agent instruction even more explicit
• 5adda5b2 chore(gha): replaces last remnant of yarn with node --run
• deea6a17 doc: corrects type references in jsdoc

Note for those eagerly awaiting typescript 7.1 support - thanks to @​buko106 there's a dependency-cruiser (beta) version that works with typescript 7.1 beta . The fixes in this (18.7.1) release combined with 7.1 beta support will be published as 18.8.0-beta-2.

v18.7.0

✨ features

• 6ae13a39 feat(summarize): makes the missing compiler warnings more precise (#1111) This a.o. makes dependency-cruiser stop reporting a missing typescript compiler even when swc was installed (and swc was sufficient for the configured features). Thanks @​duvillierA for raising the issue!

🐛 fixes

• da0efbb4 fix(extract/resolve): disregards peerDependenciesMeta and similar actual non-dependencies keys to prevent false positives (#1110). Thanks @​arvidtorbjoernsen for reporting the issue that led to this fix!
• c580daf6 fix(extract/swc): expands extensions swc can handle to all ts* variants (#1105) Thanks @​duvillierA for raising the issue and for providing the fix that landed in the PR!
• 9d53b95a fix(extract/swc): adds recognition of type-only-ness of exports (#1106). Thanks @​duvillierA for raising the issue and for providing the fix that landed in the PR!

📖 documentation

• 8b4dbdee docs: fix typo in no-duplicate-dep-types comment (#1108)

... (truncated)

Commits

• f51bc48 18.7.2
• 4e2daa0 fix(manifest): updates contributor list with recent contributors
• a37c1cf chore(test): bumps minimum branch coverage up to current HWM
• 1ecdae8 build(npm): updates external dependencies
• e65bb5b fix(extract/resolve): adds correctly handling 'bundledDependencies: true' (#1...
• 5173200 18.7.1
• 00ca161 build(npm): updates external dependencies
• fd7889b fix(extract/transpile): passes the file name to the typescript transpiler to ...
• 96a1dd3 doc(README): removes broken link
• 2a46eec fix(main/resolve-options): resolves tsconfig paths without baseUrl from the t...
• Additional commits viewable in compare view

Updates jscpd from 5.3.3 to 5.4.2

Release notes

Sourced from jscpd's releases.

Release v5.4.2

The post What's new in jscpd 5.4.2 shows the new features with commands and real output.

New Features

• Boundaries keep the code of a module inside it. The new boundaries key of the config file lists rules. A rule names the code it protects (code: a folder, a file, a glob, or a method as path#name), where copies of it must not show up (notIn, or every file outside code when it is left out) and where they may after all (allow). Every clone run checks the rules, and a copy of protected code outside its boundary fails the run with exit code 1. Import linters miss such copies, because a copied function imports nothing.

  • jscpd looks for copies three ways, and a rule can set its own bars in thresholds. Token clones find copy-paste, the structure comparison of --similarity finds an edited copy, and the --semantic model finds the same logic written again, often in another language. disable turns kinds off by their --kind names. Without a downloaded model, jscpd prints a warning and checks the rules without the semantic search.
  • A mistake in a rule, such as an unknown key or a glob that doesn't compile, stops the run with an error that names the rule. A rule that checks nothing in a run, after a typo in a path or a method name for example, gets a warning.
  • The console, console-full, ai and json reporters show the violations, the json one under boundaries. Baselines and --changed don't apply to violations yet, and SARIF, the language server and the MCP server don't report them.
  • fixtures/boundaries-demo is a small shop whose web app copies the backend's pricing and loan code. (#1225, #1227)

• --ignore-identifiers pairs a name with one name. Every name used to match every other name, so x = x + x * x was a clone of d = a + b * c, although its data flows another way. Now a name on one side has to stand for the same name on the other side every time, and two names can't stand for one, as in Baker's parameterized matching and NiCad's consistent renaming. On 24 projects in 11 languages, 6,942 of the 14,501 renamed clones that the old matching reported had no such mapping.

  • jscpd cuts a clone where a name starts to stand for two and still reports every part of --min-tokens tokens or more.
  • A name reached as a member, after . or ?., and after -> in C, C++, PHP and Perl, is another name than a local of the same text. A constructor that sets this.url = url still matches its copy that sets this.url = link (#1220).
  • --ignore-identifiers and --ignore-identifiers=consistent give the new matching, --ignore-identifiers=blind the old one. The config takes "ignoreIdentifiers": true, "consistent" or "blind", and the Action input takes consistent or blind. The value goes after = only, so --ignore-identifiers src/ still scans src/.
  • fixtures/type2-demo has the consistent and members examples. (#1217, #1218)

• --similarity pairs a name with one name too. The fingerprint of a subtree now records how its names repeat, so x = x + x * x no longer scores 1.0 against d = a + b * c, and a renamed copy still does. Members, labels such as keyword arguments and object keys, and types each have names of their own, so self.url = url still matches self.url = link. A function's own name matches any name. Kotlin's true, false and null and Clojure's true, false and nil are literals now. On the same 24 projects, 15 of 23,530 pairs fell below 0.8, and runs take 2 to 9% longer. --ignore-identifiers=blind brings back the old scores and also turns on renamed token clones. fixtures/similarity-demo/names scores a renamed copy at 1.00 and a mirrored function at 0.74. (#1219)

• --history tracks the health score, and a bare --history walks the last 30 commits. Every commit of the series gets the score that jscpd --health gives its tree. The console draws a health chart under the duplication chart and adds HEALTH and CHANGE columns, and every point of the JSON report has health. --health and --dashboard take --history now: the badge or the dashboard comes first, then the series, in the markdown and html reports too.

  • jscpd --history used to fail with "a value is required". Without a value the flag takes the config's history, or else the newest 30 commits of HEAD (--history-limit). --history-every N spaces them N commits apart, and the Action's history input takes true.
  • jscpd scans a commit the way it scans the working tree: --ignore and --pattern see its files at their working-tree paths, and the checkout runs none of the repository's hooks. A walk that stops at the edge of a shallow clone prints a warning that names the commit.
  • The last 30 commits of axios take about 5.4 seconds, against 4.9 without the health score. (#1199)

• jscpd knows 73 more formats by extension, and files by name. 94 of 224 formats had no built-in extension, a gap that came from v4, so jscpd . skipped Dockerfiles, Makefiles, go.mod, Elixir and Nix files unless you mapped them. The new extensions come from GitHub Linguist, and a table of file names maps Dockerfile, Containerfile, Makefile, go.mod, CMakeLists.txt, Gemfile, Jenkinsfile and others. Existing formats got more suffixes, such as .zsh, .jsonc, .tfvars and .sbt. A Markdown fence such as ```dockerfile takes its format from the same table, and --formats-exts and --formats-names still win over every built-in mapping. FORMATS.md lists the file names too. (#1174, #1192)

Changes

• jscpd . scans more files. On 22 repositories the new file associations picked up 1 to 5 more files each, mostly Dockerfiles, .editorconfig, .jsonc, Makefiles and go.mod, and jscpd scans the .rst files of Sphinx docs like Markdown. The duplication percentage can move, and a --threshold gate can fail. (#1192)

• --ignore-identifiers reports fewer renamed clones, and some of them are shorter. A baseline that 5.4 made with --ignore-identifiers is a blind one. Keep --ignore-identifiers=blind with it or update the baseline, or --fail-on-new-clones reports the cut clones as new. (#1218)

• --history walks first parents. A merged branch counts as its merge commit, so a range across merged branches gives fewer points than before. jscpd builds a series only when a reporter shows it (console, console-full, ai or json, and markdown or html with --health or --dashboard), so a badge-only --health job no longer walks the range. The ai lines read 37be780 2026-08-08 2/1/47.6 +47.6 health 72 -2 now, and a wrong health or dead-code option no longer fails a clone run. (#1199)

Bug Fixes

• jscpd aborted on a Markdown page whose front matter ran into a code fence. A page that opens with a horizontal rule and later shows a Python stub had front matter from the rule down to the stub's ..., across the fence, and the scan panicked: jscpd exited with 134, and jscpd --mcp and jscpd --lsp died. A --- on the first line now opens front matter only when the next line isn't blank, as Pandoc reads it, and only a --- or ... line before the first code fence closes it. The frontmatter of an Astro component follows the same rule. A page of code fences that never close used to take quadratic time, 3.9 seconds for 100 KB, and takes 0.04 seconds now. (#1223, #1226)

• A Razor view was read out of order. jscpd tokenized the HTML of a whole view and then the C# of its blocks, so a clone across that seam ended before it started: release builds printed ranges such as [48:48 - 5:35], and debug builds panicked. A view is now one stream in the order of its text. Two identical views count as duplicated from the first line to the last, and markup in an @if or @foreach block matches the same markup outside one. (#1221, #1222)

• The MCP server's check_duplication never matched a Vue, Svelte or Astro snippet. It tokenized a snippet as one stream, while a scan splits a component into its blocks and a Markdown file into its prose and fences. A component snippet met only the components inside Markdown fences, by meaning it found nothing, and the fences of a Markdown snippet matched nothing either. The server now splits a snippet the way a scan splits a file of its format. Each match has format and lines, and the note names every block too short to match. #1228 also fixed how jscpd counts the duplicated lines of a clone whose two fragments swap places, so the statistics of a --cross-formats run can change a little. (#1224, #1228, #1229)

• --history failed when git's log.showSignature was on. git printed the signature check of each signed commit before the commit, and jscpd took that line for a commit hash. jscpd now passes --no-show-signature and reads only lines that start with a commit hash. Reported with an exact reproduction by @​vitorcsbrito. (#1195, #1196)

• --compare paired a function with every near-best lookalike. It took the rule of --semantic, where a group of near-equal functions all pair with each other, but in a port a function has one counterpart. A pair now stays only when it is the best match of one of its two functions, and a near tie goes to the partner in a file of the same name. On the analysis modules of Lucene and Lucene.NET the pairs went from 2,219 to 1,392, and the share of pairs between files of the same name from 46% to 73%. Analysis and numbers by @​MysterionRise. (#1162, #1194)

• --semantic reported a page and the component it renders as a clone. It skips a pair when one function calls the other, but it didn't count a JSX element such as <EditUserForm /> as a call. It does now, and so does the call graph of --compare. Reported by @​Rosenblad, fixed by @​cristianchiriac. (#1210, #1211)

• Reports named a clone in a Markdown block or a component like guide.md:markup. The VS Code extension opened that name as a file and failed. The JSON name, the language server's jscpd/clones and jscpd/semantic, the XML path and the xcode location now name the file, and the JSON keeps the block's language in format. The console, ai and HTML reports still name the block. (#1200)

... (truncated)

Commits

• db415b5 release: cpd-v5.4.2
• 095d6ca release: cpd-v5.4.1
• b6f832c release: cpd-v5.4.0
• See full diff in compare view

Updates knip from 6.38.0 to 6.44.1

Release notes

Sourced from knip's releases.

Release 6.44.1

• Narrow the docs package Node.js engine range to Astro's requirement (60589c42a12b8f26c048318017700f56cbe9bbef)
• Follow resolve.alias in the Rsbuild plugin (#2251) (4dc61d2febaa15770f41d8a5af7d33f19de25fa3) - thanks @​fixfon!
• Read SWC plugins from tools.swc in the Rsbuild plugin (#2253) (ad2227a52970044d727e08a73b22e9ebea811dd1) - thanks @​fixfon!
• Read .release-it.mjs and other c12 extensions in the Release It plugin (#2258) (87816e6f311510c139e998b2b956aed612239b1d) - thanks @​SwastikTripathi!
• Read .mocharc.mjs in the Mocha plugin (#2259) (16fee14f4ec1bcd3244a1b4cb2ac15343a4e0999) - thanks @​SwastikTripathi!
• Restart the language server on config changes after a failed start (#2257) (f7db448226066f61ee6ee7e938cdc683bbbf433f) - thanks @​fixfon!
• Keep the command after boolean flags in the Bun resolver (resolve #2262) (3c84cafb68b2fa3d419b03a3a5e564d60aaeef30)
• Read babel.config.mts in the Babel plugin (#2267) (04abfd84887e57eeb5dd8e8a9044cd3aa405ad8c) - thanks @​clean99!
• Track import().then() callback member usage (#2264) (14565eb56ec16140d30708fa498c8b34f23c1f9f) - thanks @​gioboa!
• Reload the knip config file when the language server restarts (#2261) (fa9ca71a9a67f017e2cf209725f4ab7aa726c220) - thanks @​fixfon!
• Read all supported CSpell configuration locations (#2265) (c6c5b2cbf6a96abef70f6f30301fc67a0f56a6cd) - thanks @​clean99!
• Read SVGR configs from cosmiconfig search locations (#2266) (47082a803eb776166cf39399c1e4e06a737c91e7) - thanks @​clean99!
• Handle extends arrays in the npm-package-json-lint plugin (#2269) (83c8c80a50e0d77babc5422c059ef86c53a2e548) - thanks @​clean99!
• Read Relay configuration from package.json (#2270) (6ce8b0050006251148b3bbc42989bb430ed484ec) - thanks @​clean99!
• Read dependencies from SWC config arrays (#2271) (5ffe9276e8a54ba00035976ad8dfe394535b9f50) - thanks @​clean99!
• Recognize CJS and ESM data files in the Eleventy plugin (#2272) (d939417b0ea7660eae1a119d5e2ddd0aedeadca1) - thanks @​clean99!
• Unroll case iterations in the SolidJS Vite, Buf, Eve and Nx plugin tests (5f87aabe082b3dc0db5a77d7c37119caa9b31fb3)
• Hoist remark to the root for the VS Code remark extension (e7772700fb26260fc877e7d66b30005b1acdfef6)
• Format root Markdown and package READMEs with pnpm remark (58c7670cfb255c395b6dfec0b70b1f25a0860d47)
• Write readable tests (393b34864396372bd9b90ab50de96c0628ad5d91)
• Format Markdown with remark (10c0133f697bcaecb17833094749178fb5d5f594)
• Fix local links in Markdown (a3fd031d853f9ed55cd952a4211c75d43840c921)
• Treat cloudflare: specifiers as runtime built-ins (#2268) (e7f261e82b0a310141aea03956d52d218929c518) - thanks @​SwastikTripathi!

Release 6.44.0

• Clarify that custom entry still adds entry files from package.json (#2206) (4099ddeef28406ed8c9b798cf5ce525241818642) - thanks @​MannXo!
• Resolve expanded package scripts against the directory of their manifest (#2209) (9d8464dd7335b9898a17a0db59c3c33a7ae460f4) - thanks @​fixfon!
• Track exports through namespace member chains of any depth (#2210) (75697027e89e176c16e3d567cff3d6e016d0e9f0) - thanks @​fixfon!
• Do not treat Windows drive letters as package names (#2217) (d412c5be3a5c2d69583ce54b32e033813c1d2972) - thanks @​Cherry!
• Generate built-in compilers list from source (#2216) (d6f594cc767fa41c6f94cf49bfa0302be4b9de40) - thanks @​abrahamguo!
• Update to pnpm@^11 + pnpm dedupe (ef5b819eddbb0b4ff92804524aca590797a199fc)
• Stop growing and rewriting the analysis cache on warm runs (close #2213) (54b02dd84181867f41f98a6c80209dad32fa3da6)
• Use entry in plugins that do not resolve their config files (0b0e3285e3a440650b86a776b5e2a1fc1816bca8)
• Reuse graph reachability for incremental sessions (#2190) (38d926a652e820a375fe59d04ba0980393882153) - thanks @​jakeleventhal!
• fix: reload discovered configuration in watch sessions (#2211) (cefef30891c4428635e5cfc7b147faa42857247d) - thanks @​jakeleventhal!
• Keep editor sessions and views current (#2215) (cfe91abb5e6064230a71926f0d7565fce94486c0) - thanks @​jakeleventhal!
• Add Lingui plugin (#2212) (611e7dbe1c6675612e457324aae411bf4cda5b11) - thanks @​clean99!
• Update dependency bun to v1.4.4 (#2219) (3f35bbdf863057f69f237ab507053271019fc315) - thanks @​renovate[bot]!
• Read CSpell configuration from package.json (#2228) (86ab963cf3cd279a8b8af3a3f0098d24762c59cb) - thanks @​clean99!
• Ignore file discovery order in session configuration test (51a8d33dbe04e76da8f2e2ed24d8943d0e9e15fe)
• Fix strict mode for caught optional peer imports (#2218) (e535f40b8cacea80c830282544975f0be2191323) - thanks @​jay23606!
• Add kysely-codegen plugin (#2223) (a50e8423d28406bd20c213334d3aac4857c1cce0) - thanks @​clean99!
• Add PurgeCSS plugin (#2224) (668aea696a217d7c537791771be6044fc5ae375b) - thanks @​clean99!
• Document plugin args and path bases, issue key order and real-world fixes (8e48df60c4502c66d9daba87d5f436898ae60116)
• Add Mastra plugin (#2227) (dd4e1f72de127eb8328dd941fa4492034f29d69d) - thanks @​ashokram-si!
• Count findPackageJSON() bare specifiers as dependencies (#2235) (d4e387b31235d49fe755acb79553b385aa0de4c9) - thanks @​abrahamguo!
• Add universal hooks file to SvelteKit entries (#2237) (f286584f168d27255769bd9529b49a3518e4f788) - thanks @​APX403!
• Attribute extended tsconfig plugins correctly (#2230) (8d1d1d1e54204287b8321a0a5d50cbfa4562759e) - thanks @​gioboa!
• Resolve reporter in the Mocha plugin (#2232) (c413715a334be72094a02af0dbb37e36e878e262) - thanks @​X-Guardian!

... (truncated)

Commits

• da07b6e Release knip@6.44.1
• e7f261e Treat cloudflare: specifiers as runtime built-ins (#2268)
• 10c0133 Format Markdown with remark
• 5f87aab Unroll case iterations in the SolidJS Vite, Buf, Eve and Nx plugin tests
• d939417 Recognize CJS and ESM data files in the Eleventy plugin (#2272)
• 5ffe927 Read dependencies from SWC config arrays (#2271)
• 6ce8b00 Read Relay configuration from package.json (#2270)
• 83c8c80 Handle extends arrays in the npm-package-json-lint plugin (#2269)
• 47082a8 Read SVGR configs from cosmiconfig search locations (#2266)
• c6c5b2c Read all supported CSpell configuration locations (#2265)
• Additional commits viewable in compare view

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}