chore(deps): update npm dependencies updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@quasar/app-vite (source)	3.10.1 → 3.10.2
dotenv	18.0.5 → 18.0.7
eslint (source)	10.11.0 → 10.12.0
globals	17.12.0 → 17.13.0
jscpd (source)	5.4.0 → 5.4.1
postcss (source)	8.5.28 → 8.5.29
prettier (source)	3.9.9 → 3.9.10
quasar (source)	2.34.0 → 2.35.0
release-it	21.1.0 → 21.1.1
vue-router (source)	5.3.1 → 5.4.0

---

Release Notes

quasarframework/quasar (@​quasar/app-vite)

v3.10.2

Compare Source

Changes

• fix(app-vite): BEX mode on Windows -> building the background script, content scripts and dom script no longer fails with [RESOLVE_ERROR] Could not resolve '#q-app/bex/background' (Matched alias not found). The same project already built fine on Linux/macOS; Rolldown on Windows needed the #q-app/bex/* aliases registered ahead of the generic #q-app one (#​18564)

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

motdotla/dotenv (dotenv)

v18.0.7

Compare Source

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#​1070)
• CLI should honor DOTENV_QUIET setting in .env file (#​1071)

v18.0.6

Compare Source

Changed

• Use smarter parseBoolean not Boolean() to fix override (#​1069)

eslint/eslint (eslint)

v10.12.0

Compare Source

Features

• 4618052 feat: handle astral letters in new-cap (#​21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#​21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#​21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#​21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#​21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#​21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#​21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#​21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#​21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#​21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#​21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#​21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#​21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#​21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#​21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#​21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#​21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#​21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#​21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#​21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#​21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#​21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#​21342) (ESLint Bot)

sindresorhus/globals (globals)

v17.13.0

Compare Source

• Update globals (2026-10-01) (#​354) b007369

---

kucherenko/jscpd (jscpd)

v5.4.1

Compare Source

New Features

• --similarity compares the structure of functions in 15 languages. jscpd parses every function and method and normalizes its syntax tree: the names of the functions it calls and its operators stay, local names, field names and literals become markers, and comments and the parentheses around one expression drop out. Every subtree of that tree is a fingerprint, and two functions score the Jaccard index of their two fingerprint sets, so a renamed copy scores 1 and an edited statement lowers the score.

  • It reads JavaScript, TypeScript, Python, Java, Kotlin, Scala, C#, Go, Rust, C, C++, PHP, Ruby, Swift and Clojure, and the code blocks of Markdown files and the scripts of Vue, Svelte and Astro components. 5.4.0 compared JavaScript and TypeScript only.
  • The search is exact: it finds every pair at or above the ratio. A function nested in another is part of it, and test files and Rust mod tests are left out. Code between jscpd:ignore-start and jscpd:ignore-end, or matched by --ignore-pattern, adds nothing to a function (#​1144).
  • --similarity alone compares at 0.8. --min-nodes (config key minNodes, 20 by default) sets the smallest normalized tree that takes part, --min-lines applies as before and --min-tokens does not. The JSON report gives the node count of both functions as nodes.
  • While the method was built, a check on 100 open-source repositories against a brute-force implementation of it, which scores every pair, found the same 58,405 pairs with the same scores, and jscpd's runs took 64.8 seconds on one thread against 498.
  • fixtures/similarity-demo has a runnable example in every language. (#​1129, #​1132, #​1134, #​1136, #​1139, #​1147, #​1148, #​1149, #​1150, #​1152, #​1155, #​1138, #​1141, #​1142, #​1143, #​1145, #​1146, #​1156)

• An edn reporter. -r edn writes jscpd-report.edn with {:candidates [...] :clones [...]}. The candidates are every pair --similarity found, most similar first, with their score, language, both locations and node counts, also the pairs a token clone already reports. The clones are the ones the other passes found, with their kind, method and score. (#​1151, #​1153, #​1156)

• --changed reports the clones of the files you are working on. The changed files are the ones git status lists: staged, unstaged and untracked files, and a renamed file under its new name. jscpd still scans every file and reports a clone when one of its fragments is in a changed file, so a new file that copies an unchanged one shows up.

  • The first run saves the clones of HEAD to .jscpd-baseline.json at the repository root, or to the --baseline file, with the commit and a hash of the scan paths and options. Later runs read it and mark the clones HEAD did not have as [NEW], so --fail-on-new-clones works with it. jscpd builds the file again after a commit or for other paths or options. A baseline file without a commit, such as one --update-baseline wrote, is used as it is.
  • --changed-only scans the changed files alone, and they match only one another.
  • Both flags are command line only. fixtures/changed-demo walks through five steps. (#​1154, #​1172)

• --report-name sets the base name of the report files. Linter aggregators such as MegaLinter run several tools into one reports folder, and two jscpd runs there overwrote each other's jscpd-report.json. --report-name megalinter-jscpd (config key reportName) names the json, xml, csv, html, markdown, sarif and edn reports, and the GitHub Action takes it as the report-name input. The badge, OpenMetrics and CodeClimate files keep their names. The name must be a plain file name: a path, an extension or an empty name is an error. Contributed by @​MannXo. (#​1015, #​1058)

• The MCP server finds every type of clone and compares folders. Every tool takes kinds: exact, renamed, similar and semantic, or type1 to type4. Without it, a tool reports what jscpd reports with the server's options. compare_folders(left, right) returns the JSON report of --compare for two folders. The server speaks the MCP revision 2026-07-28, and clients of the older revisions keep working. check_duplication now finds every copy of a snippet, where it used to match one of two, and --mcp no longer ignores --semantic. (#​1135, #​1137)

Changes

• --similarity scores differ from 5.4.0. The method is new, so a pair that scored 0.85 before can score lower now. Refresh a --threshold or a baseline that was set on the old results. --similarity 1 now reports functions with the same structure; up to 5.4.0 a ratio of 1 turned the search off, and jscpd prints a warning that says so. The options that the method replaced never reached a release. (#​1156)

Bug Fixes

• --semantic and --compare found functions named if in C, C++ and C# code. Around #if and #ifdef, the grammars read else if (…) { } as a function named if, or while or await, and every if ( in the scan counted as a call to it, so in --compare one such branch could collect thousands of callers. jscpd now drops a function whose type is the keyword else. A word such as if, while or catch before a parenthesis counts as a call only as a member, as in promise.catch(f). Reported by @​MysterionRise, fixed by @​mvanhorn. (#​1163, #​1188)

• Three --compare fixes found on Apache Lucene and Lucene.NET, all by @​MysterionRise:

  • Test helpers now count toward the namesakes of a call. A private assertEquals in Lucene's benchmark code took all 6,127 calls to the name, 6,126 of them from tests. (#​1165)
  • The HTML map cuts a long folder label in its middle, so the folders of one module no longer read alike. (#​1166)
  • A .NET test project counts as tests wherever Tests sits in its dotted name, as in Lucene.Net.Tests.Analysis.Common. Before, 6,736 functions in 771 files of such projects counted as code. (#​1167)

• The --compare reports disagreed. The console and the HTML map now round a share the same way, so 60 of 147 functions read 41% in both. A Tests block appears only when a side has a test that counts, and a declaration without a body no longer counts as a function. (#​1130)

• --dead-code reported an import used only in a TSDoc link as unused. {@link X}, {@linkcode X} and {@linkplain X} now count as uses of X, as TypeScript counts them, and in JavaScript files the JSDoc types of @param, @returns, @type and the like count too. A name in the docs credits the import only, so a function that only a link names is still reported. (#​1170, #​1171)

• --ignore-pattern dropped the wrong tokens in code blocks. jscpd computed the ranges on the host file but tokenized Markdown fences, component scripts and Razor blocks from the block's own offsets. The ranges now move to the block. (#​1144)

• git commands run from a hook acted on the hook's repository. jscpd's git subprocesses now drop the variables git exports to hooks, such as GIT_DIR and GIT_INDEX_FILE; before, --baseline-from-ref in a pre-commit hook wrote the base tree into the commit's index. A --history range or a --baseline-from-ref ref that starts with - is refused, so a scanned repository's config can no longer pass git an option such as --output=<file>. The worktree cleanup no longer prunes the user's other worktrees, and an API key that an embeddings API echoes in an error is redacted. (#​1169)

• The Nix flake warned about stdenv.isDarwin. It uses stdenv.hostPlatform.isDarwin now. Contributed by @​mlavrinenko. (#​1133)

Other

• The minimum Rust version is 1.97. oxc 0.153 and ruff 0.0.16 need it. (#​1187)
• jscpd depends on basta 0.3.1, which has the dead-code fixes above.
• The tests check behavior instead of implementation details, and CI measures line coverage (#​1168). The release retries cargo publish while the crates.io index catches up (#​1123), and the compare-codebases skill keeps vendored and build folders out of a comparison (#​1124).

Dependencies

• oxc moved to 0.153 (#​1125, #​1184), ruff to 0.0.16 (#​1185) and tree-sitter-swift to 0.7.4 (#​1186), together in #​1187. The new Swift grammar reads nil as a node of its own, and --similarity treats it as a literal.
• xxhash-rust moved to 0.8.19 (#​1126, #​1140), and yoke-derive to 0.8.4 because 0.8.3 was yanked.
• In CI, taiki-e/install-action moved to 2.87.26 (#​1127, #​1183) and dorny/test-reporter to 3.2.0 (#​1182).

Thank You ❤️

• @​pygarap for the issues that shaped the new --similarity, the edn reporter and --changed: #​1129, #​1131, #​1132, #​1134, #​1136, #​1139, #​1147, #​1148, #​1149, #​1150, #​1151, #​1152, #​1153, #​1154
• @​MannXo for --report-name (#​1058)
• @​mvanhorn for the fix of phantom C# functions (#​1188)
• @​MysterionRise for three --compare fixes (#​1165, #​1166, #​1167) and the report of phantom functions (#​1163)
• @​mlavrinenko for the Nix flake fix (#​1133)
• The readers of the DOU.ua discussion who reported the TSDoc false positive (#​1170)
• @​emanuelb (#​357), @​jonim8or (#​411, #​412), @​JiangWeixian (#​449) and @​umair2602 (#​519), whose older reports this cycle's triage closed

Published Packages

• basta@0.3.1 on crates.io
• cpd-core@0.1.21 on crates.io
• cpd-finder@0.1.21 on crates.io
• cpd-reporter@0.1.22 on crates.io
• cpd-semantic@0.1.2 on crates.io
• cpd-similarity@0.1.0 on crates.io
• cpd-tokenizer@0.1.20 on crates.io
• jscpd@5.4.1 on crates.io
• cpd@5.4.1 on npm
• jscpd@5.4.1 on npm
• jscpd-darwin-arm64@5.4.1 on npm
• jscpd-darwin-x64@5.4.1 on npm
• jscpd-linux-x64-gnu@5.4.1 on npm
• jscpd-linux-arm64-gnu@5.4.1 on npm
• jscpd-linux-x64-musl@5.4.1 on npm
• jscpd-linux-arm64-musl@5.4.1 on npm
• jscpd-windows-x64-msvc@5.4.1 on npm
• jscpd-windows-arm64-msvc@5.4.1 on npm
• jscpd==5.4.1 on PyPI

Verify

Archives are signed with Sigstore (keyless, <asset>.sigstore.json)
and carry SLSA build provenance. Replace jscpd-linux-x64-gnu.tar.gz with your asset:

cosign verify-blob \
  --bundle jscpd-linux-x64-gnu.tar.gz.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/kucherenko/jscpd/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  jscpd-linux-x64-gnu.tar.gz
gh attestation verify jscpd-linux-x64-gnu.tar.gz --repo kucherenko/jscpd
sha256sum --check --ignore-missing checksums.txt

postcss/postcss (postcss)

v8.5.29

Compare Source

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

prettier/prettier (prettier)

v3.9.10

Compare Source

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

release-it/release-it (release-it)

v21.1.1

Compare Source

• docs: add release-it-git-cliff to plugins list (#​1334) (bf2a3d8) - thanks @​adamhl8!
• Update undici to 7.29.1 (resolve #​1335) (37898f1)
• Update more dependencies (7bd73af)
• Migrate verkit import (5336543)

vuejs/router (vue-router)

v5.4.0

Compare Source

   🚨 Breaking Changes

• experimental: Normalize query values to arrays  -  by @​posva in #​2824 (f1fbc)

   🚀 Features

• Accept a prebuilt matcher in createRouter  -  by @​danielroe in #​2804 (9de96)
• UseScrollRestoration and onRouteRendered  -  by @​posva in #​2805 (e3dde)
• Diagnose experimental beforeEnter migration  -  by @​posva (b695c)
• experimental:
  • Warn about legacy optional param removal  -  by @​posva in #​2818 (c2f92)
  • Extract hash params with definePage  -  by @​posva (dbf2d)
  • Configure required and default hash params  -  by @​posva (cef5c)
  • Never decode the hash, protect-only encoding  -  by @​posva in #​2760 (aca2c)
  • Allow custom regexp for path params in definePage  -  by @​posva in #​2822 (3a192)
• router:
  • Restore hashes and top by default  -  by @​posva (7c385)

   🐞 Bug Fixes

• Resolve experimental guard redirects against target on history navigation  -  by @​posva (2c5fb)
• experimental:
  • Keep declared case of static prefix in MatcherPatternPathStar.build()  -  by @​contactjawad in #​2798 (4dc6b)
  • Make hash params optional and nullable  -  by @​posva (d9a4c)
  • Exclude defaults from required hash params  -  by @​posva (346e2)
  • Align hash parameter parsing with queries  -  by @​posva (cf251)
  • Keep last hash param instead of throwing  -  by @​posva (d1e8a)
  • Disallow required with a default for query params  -  by @​posva (f60e9)
  • Make query params with a default optional on push  -  by @​posva (fb604)
  • Do not inherit params, query, or hash on redirects  -  by @​posva (02a92)
• history:
  • Invalidate obsolete scroll positions  -  by @​posva and @​liuly0322 in #​2814 (071f1)
• unplugin:
  • Sanitize named view in definePage import  -  by @​giaBaoJS in #​2809 (0711d)
  • Keep hex character codes in param segments regexp  -  by @​kwy404 in #​2811 (07663)

   🏎 Performance

• unplugin: Cache merged route overrides  -  by @​posva in #​2821 (732b7)

    View changes on GitHub

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "before 8am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.