chore(deps-dev): bump the tooling-minor-patch group with 3 updates

[dependabot]

Bumps the tooling-minor-patch group with 3 updates: dependency-cruiser, jscpd and knip.

Updates dependency-cruiser from 18.4.0 to 18.5.0

Release notes

Sourced from dependency-cruiser's releases.

v18.5.0

✨ features

• 25ac2f7f feat(extract/tsc): adds support for imports inside module and namespace blocks (#1095) - thanks to @​arpitjain099 for detecting the missing feature AND making the PR
• 918d9193 feat(report/markdown): adds baseline stale table (#1102)

👷 maintenance

• 10860b9a build(npm): updates external dependencies

Commits

• 0c97313 18.5.0
• 10860b9 build(npm): updates external dependencies
• 25ac2f7 feat(extract/tsc): adds support for imports inside module and namespace block...
• 918d919 feat(report/markdown): adds baseline stale table (#1102)
• See full diff in compare view

Updates jscpd from 5.3.3 to 5.4.0

Release notes

Sourced from jscpd's releases.

Release v5.4.0

New Features

• A language server: jscpd --lsp. An editor starts jscpd for a workspace, and the files you edit get what jscpd finds as diagnostics that follow the text in the editor, saved or not. After 300 ms without typing, the server tokenizes the file again from the buffer and searches its detection pool again from the tokens it keeps for the rest of the project.

  • The server runs five analyses: clones (exact, renamed and near-miss copies), similar functions (--similarity), semantic clones (--semantic), dead code (--dead-code) and complexity, with a limit of 15 per function and the complex-file bar of the health score per file. Only clones are on unless you turn the others on, with --lsp-analyses, with the lsp section of .jscpd.json, or from the editor's settings, and each place wins over the one before it.
  • The code of each diagnostic is the id of its rule, the one the SARIF reporters write for clones and dead code. A clone is a warning, as in SARIF, and lsp.clones.warningTokens lowers the smaller ones to information. Dead code is a hint that editors fade.
  • Each .jscpd.json in the workspace makes its folder a project of its own, and clones are found within a project. A workspace with no config is one project across all its folders.
  • A clone comes with "Go to the other copy" and "Ignore this clone", which wraps the fragment in jscpd:ignore-start and jscpd:ignore-end comments. Dead code and semantic clones run in the background after a save, and the progress of each run ends with what it found, such as 94 files, 13 clones.
  • Editor clients can ask for the whole project's clones, semantic pairs, dead code, complexity and statistics with custom requests.
  • docs/editors.md has the setup for Neovim, Helix, Sublime Text, Emacs and JetBrains IDEs, and fixtures/lsp-demo is a project that shows each analysis. (#1120, #1121, #1122)

• Comparing two codebases, experimental: --compare. jscpd --compare source target pairs the functions of two folders with the --semantic model and reports which functions of each side have a counterpart in the other. During a port to another language or platform, that is what is still to port; for two implementations of one app, it is what only one of them has.

  • A function pairs with its counterpart when the model finds them each other's closest match. A short function the model cannot place pairs by name when the names match once case and underscores are ignored and the code is similar enough. Every pair has its similarity and a level, high, medium or low, and the report lists the pairs under other names on their own.
  • Tests and code are measured apart, and a test pairs only with a test. jscpd tells a test by the conventions of its language, such as *_test.go, test_*.py, *.test.ts or Rust's #[cfg(test)], and JavaScript test cases take part under their titles.
  • The console, JSON and Markdown reporters print the totals per side and per file, the functions with no counterpart and the pairs. -r html writes a migration map: both sides as dependency graphs with the pairs bridging them, a table of the same pairs, and the functions ready to port, whose callees all have a counterpart already. The JSON report lists those as readyToPort.
  • On the Java and Python versions of nayuki/QR-Code-generator, it paired 30 of 41 Java functions with no wrong pair. fixtures/compare-demo is a runnable example. (#1115, #1118, #1119)

• Agent skills for ports. compare-codebases explains how --compare pairs functions and how to check a comparison. code-migration ports a codebase tests first, binds tests to code by coverage, and takes the next function to port from --compare. Install them with npx skills add kucherenko/jscpd --skill <name>. (#1115, #1117)

Changes

• Pairs from --similarity have a SARIF rule of their own, jscpd/similar-function. The similar kind comes from two mechanisms that find different things, and SARIF filed both under jscpd/similar-code. That rule now keeps the copies merged across a gap (--max-gap-lines), and Code Climate's check_name follows. GitHub code scanning matches alerts by rule, so the first upload of --similarity results after the update closes the old alerts and opens the same findings under the new rule. (#1121)

Other

• A failed cargo publish now fails the release job instead of passing it. (#1116)

Published Packages

• basta@0.3.0 on crates.io
• cpd-core@0.1.20 on crates.io
• cpd-finder@0.1.20 on crates.io
• cpd-reporter@0.1.21 on crates.io
• cpd-semantic@0.1.1 on crates.io
• cpd-tokenizer@0.1.19 on crates.io
• jscpd@5.4.0 on crates.io
• cpd@5.4.0 on npm
• jscpd@5.4.0 on npm
• jscpd-darwin-arm64@5.4.0 on npm
• jscpd-darwin-x64@5.4.0 on npm
• jscpd-linux-x64-gnu@5.4.0 on npm
• jscpd-linux-arm64-gnu@5.4.0 on npm
• jscpd-linux-x64-musl@5.4.0 on npm
• jscpd-linux-arm64-musl@5.4.0 on npm
• jscpd-windows-x64-msvc@5.4.0 on npm
• jscpd-windows-arm64-msvc@5.4.0 on npm
• jscpd==5.4.0 on PyPI

... (truncated)

Commits

• b6f832c release: cpd-v5.4.0
• See full diff in compare view

Updates knip from 6.38.0 to 6.39.0

Release notes

Sourced from knip's releases.

Release 6.39.0

• Add Railway plugin (#2026) (6da55767eb419701dd32f93789a00e8bdc915276) - thanks @​jonahsnider!
• Update query snapshot (8877d3cf35943e17a617e1197fa46c5a43342479)
• Fix excluded tags on entry re-exports (#2062) (b22e27543cb8dd4ba7ec97c70ccfd06bc8f16614) - thanks @​devYRPauli!
• Update rolldown snapshot (3a45c806e1c1b7ceb078903652c8631566400096)
• Skip synthetic self-imports in Vue and Nuxt auto-import compilers (#2067) (d912d807e41f140bbc79bafce6882b3c05dec6ff) - thanks @​bytedoe!
• fix(angular): keep other projects' inputs when one has no architect (#2064) (af3f42e9772e9937fd71b7557d3b54aee1db339a) - thanks @​Cayan!
• fix(vite): resolve nested HTML entry points in multi-page apps (#1988) (4648aefe56e7bac521bb6f17189473b46f8ff00f) - thanks @​DreamLongYT!
• Improve Rstest plugin support (#2068) (add87992e9dfe2f3c22e4c6ba7fa257d7f0151cf) - thanks @​fi3ework!
• Handle profiles, formatters and require paths in Cucumber plugin (#2065) (2ad39fcf02e067b4bdfc06a658bf4bf5abeea764) - thanks @​giaBaoJS!
• fix(playwright): resolve globalSetup/globalTeardown from config dir (#2076) (7060bb968339680d694275413aba2833e4521ed9) - thanks @​alokn!
• fix: read entry export tags under the re-exported names (#2069) (1698683df95a96b3515795eb664aacf030042d7b) - thanks @​devYRPauli!

Commits

• ed30e5b Release knip@6.39.0
• 1698683 fix: read entry export tags under the re-exported names (#2069)
• 7060bb9 fix(playwright): resolve globalSetup/globalTeardown from config dir (#2076)
• 2ad39fc Handle profiles, formatters and require paths in Cucumber plugin (#2065)
• add8799 Improve Rstest plugin support (#2068)
• 4648aef fix(vite): resolve nested HTML entry points in multi-page apps (#1988)
• af3f42e fix(angular): keep other projects' inputs when one has no architect (#2064)
• d912d80 Skip synthetic self-imports in Vue and Nuxt auto-import compilers (#2067)
• b22e275 Fix excluded tags on entry re-exports (#2062)
• 6da5576 Add Railway plugin (#2026)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}