chore(deps-dev): bump jscpd from 5.2.1 to 5.3.2

[dependabot]

Bumps jscpd from 5.2.1 to 5.3.2.

Release notes

Sourced from jscpd's releases.

Release v5.3.2

New Features

• Rust dead code, read from the compiler. jscpd does not parse Rust, and does not need to. Every cargo build already prints lines like function reprint is never used, with real name resolution, trait dispatch and macro expansion behind them. The dead-code run now reads that output, from the JSON of cargo check (or build, clippy, test --no-run), and reports it next to everything else, through the same categories, reporters and --min-confidence, at 100% confidence.
  • basta takes --rust-diagnostics <file>, or - for a pipe: cargo check --all-targets --message-format=json | basta . --rust-diagnostics -.
  • jscpd takes the same flag for --dead-code, --dashboard and --health, so a Rust project gets its health badge from the check it already runs: cargo check --all-targets --message-format=json | jscpd . --health --rust-diagnostics - --reporters badge. The dead-code section of the config file takes the file as rustDiagnostics.
  • Neither tool runs cargo itself, because that would execute the project's build scripts and procedural macros.
  • The compiler's span covers only the name, so the item's real size is read from the source. An item that --all-targets reports twice is counted once. A diagnostic inside a macro expansion, or for a crate outside the scanned paths, is left out.
  • A finding from a test target is handled like a test file in any other language: reported only with --include-tests, at 85%.
  • In a workspace, cargo writes paths relative to the workspace root, and they are resolved as such. A relative manifest_path in a hand-edited or copied file is resolved from where the file lives.
  • The compiler never reports a pub item of a library, and it has no notion of an unused file, so jscpd reports neither for Rust.
  • The dashboard's dead-code heading no longer names three languages, and a project with no language the run could read says so in its health score.
  • See fixtures/dead-code-demo. (#1089)

Bug Fixes

• Text around an embedded code block was counted as code. A ts block in a markdown file, a <script> in a single-file component: jscpd scans these under the embedded language's own format, and the block keeps the line numbers of the file it lives in. The statistics read those numbers as if the block ran the whole way, which put the markdown prose and the component templates into the embedded language's line counts — both the total and the duplicated lines. On a repository with about 3600 markdown files the typescript row said 51.30% of lines were duplicated where the same code, scanned with -f typescript, said 3.37%. Neither number was a typo and both came from the same run.

  An embedded source now counts the lines its blocks occupy, and a clone counts the block lines it covers rather than everything its fragment reaches across. The two percentage columns agree again, which is the quickest way to check a run: they measure the same duplication, so when the line column sits far below the token column it is counting text that holds no code. Ordinary files are counted exactly as before. See fixtures/embedded-stats-demo. (#1091, closes #1090)

• Every clone was one line short. Duplicated lines came from end - start, so a clone covering lines 10 through 19 counted nine — while the console printed 10 lines for it, from its own arithmetic. Line counts are inclusive now, and the header and the table come from one place. Expect duplicated-line totals to rise by about one line per clone, and percentages with them. (#1091)

Other

• The dead-code engine in this release is basta 0.3.0, which is also published on its own: basta on npm, crates.io and GitHub.

Published Packages

• basta@0.3.0 on crates.io
• cpd-core@0.1.18 on crates.io
• cpd-finder@0.1.18 on crates.io
• cpd-reporter@0.1.19 on crates.io
• cpd-tokenizer@0.1.17 on crates.io
• jscpd@5.3.2 on crates.io
• cpd@5.3.2 on npm
• jscpd@5.3.2 on npm
• jscpd-darwin-arm64@5.3.2 on npm
• jscpd-darwin-x64@5.3.2 on npm
• jscpd-linux-x64-gnu@5.3.2 on npm
• jscpd-linux-arm64-gnu@5.3.2 on npm
• jscpd-linux-x64-musl@5.3.2 on npm
• jscpd-linux-arm64-musl@5.3.2 on npm
• jscpd-windows-x64-msvc@5.3.2 on npm
• jscpd-windows-arm64-msvc@5.3.2 on npm
• jscpd==5.3.2 on PyPI

Verify

... (truncated)

Commits

• beb5528 release: cpd-v5.3.2
• e90cf5e release: cpd-v5.3.1
• 9257686 release: cpd-v5.3.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.