chore(deps-dev): bump the dependencies group with 3 updates

[dependabot]

Bumps the dependencies group with 3 updates: @babel/eslint-parser, @types/node and jscpd.

Updates @babel/eslint-parser from 8.0.6 to 8.0.7

Release notes

Sourced from @​babel/eslint-parser's releases.

v8.0.7 (2026-10-07)

Thanks @​brunoborta, @​CINC0S, @​hoobnn, and @​jpradelle for your first PRs!

🐛 Bug Fix

• babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • #18295 Bump regexpu-core to 6.5.3 (@​JLHwung)
• babel-plugin-transform-for-of
  • #18292 Skip for await in transform-for-of (@​brunoborta)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • #18283 Fix asyncIterator helper forwarding .throw() to .return() (@​brunoborta)
• babel-parser
  • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
• babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • #18284 Guard @@toPrimitive usage in toPrimitive helper (@​nicolo-ribaudo)
• babel-plugin-transform-block-scoping
  • #18195 fix: closures in for-loop init capture wrong binding (@​joelle-a-dev)
• babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
  • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
• babel-traverse
  • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
  • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
• Other
  • #18257 Fix eslint-parser AST definition of AccessorProperty (@​jpradelle)
• babel-core
  • #18254 fix(core): createConfigItem allows cb as 2nd arg (@​JLHwung)

🏠 Internal

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #18255 Simplify interopRequireWildcard helper (@​nicolo-ribaudo)

Committers: 11

• Babel Bot (@​babel-bot)
• Bruno "Borta" Bortagaray (@​brunoborta)
• CINC05 (@​CINC0S)
• Huáng Jùnliàng (@​JLHwung)
• Joelle Mahfoud (@​joelle-a-dev)
• Julien Pradelle (@​jpradelle)
• Kevin Deng (@​sxzz)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• Samual Norman (@​samualtnorman)
• @​wulu007
• hoobnn (@​hoobnn)

Changelog

Sourced from @​babel/eslint-parser's changelog.

v8.0.7 (2026-10-07)

🐛 Bug Fix

• babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • #18295 Bump regexpu-core to 6.5.3 (@​JLHwung)
• babel-plugin-transform-for-of
  • #18292 Skip for await in transform-for-of (@​brunoborta)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • #18283 Fix asyncIterator helper forwarding .throw() to .return() (@​brunoborta)
• babel-parser
  • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
• babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • #18284 Guard @@toPrimitive usage in toPrimitive helper (@​nicolo-ribaudo)
• babel-plugin-transform-block-scoping
  • #18195 fix: closures in for-loop init capture wrong binding (@​joelle-a-dev)
• babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
  • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
• babel-traverse
  • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
  • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
• Other
  • #18257 Fix eslint-parser AST definition of AccessorProperty (@​jpradelle)
• babel-core
  • #18254 fix(core): createConfigItem allows cb as 2nd arg (@​JLHwung)

🏠 Internal

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #18255 Simplify interopRequireWildcard helper (@​nicolo-ribaudo)

Commits

• 1fc0073 v8.0.7
• b6bb564 Fix eslint-parser AST definition of AccessorProperty (#18257)
• See full diff in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

• See full diff in compare view

Updates jscpd from 5.4.0 to 5.4.1

Release notes

Sourced from jscpd's releases.

Release v5.4.1

New Features

• --similarity compares the structure of functions in 15 languages. jscpd parses every function and method and normalizes its syntax tree: the names of the functions it calls and its operators stay, local names, field names and literals become markers, and comments and the parentheses around one expression drop out. Every subtree of that tree is a fingerprint, and two functions score the Jaccard index of their two fingerprint sets, so a renamed copy scores 1 and an edited statement lowers the score.

  • It reads JavaScript, TypeScript, Python, Java, Kotlin, Scala, C#, Go, Rust, C, C++, PHP, Ruby, Swift and Clojure, and the code blocks of Markdown files and the scripts of Vue, Svelte and Astro components. 5.4.0 compared JavaScript and TypeScript only.
  • The search is exact: it finds every pair at or above the ratio. A function nested in another is part of it, and test files and Rust mod tests are left out. Code between jscpd:ignore-start and jscpd:ignore-end, or matched by --ignore-pattern, adds nothing to a function (#1144).
  • --similarity alone compares at 0.8. --min-nodes (config key minNodes, 20 by default) sets the smallest normalized tree that takes part, --min-lines applies as before and --min-tokens does not. The JSON report gives the node count of both functions as nodes.
  • While the method was built, a check on 100 open-source repositories against a brute-force implementation of it, which scores every pair, found the same 58,405 pairs with the same scores, and jscpd's runs took 64.8 seconds on one thread against 498.
  • fixtures/similarity-demo has a runnable example in every language. (#1129, #1132, #1134, #1136, #1139, #1147, #1148, #1149, #1150, #1152, #1155, #1138, #1141, #1142, #1143, #1145, #1146, #1156)

• An edn reporter. -r edn writes jscpd-report.edn with {:candidates [...] :clones [...]}. The candidates are every pair --similarity found, most similar first, with their score, language, both locations and node counts, also the pairs a token clone already reports. The clones are the ones the other passes found, with their kind, method and score. (#1151, #1153, #1156)

• --changed reports the clones of the files you are working on. The changed files are the ones git status lists: staged, unstaged and untracked files, and a renamed file under its new name. jscpd still scans every file and reports a clone when one of its fragments is in a changed file, so a new file that copies an unchanged one shows up.

  • The first run saves the clones of HEAD to .jscpd-baseline.json at the repository root, or to the --baseline file, with the commit and a hash of the scan paths and options. Later runs read it and mark the clones HEAD did not have as [NEW], so --fail-on-new-clones works with it. jscpd builds the file again after a commit or for other paths or options. A baseline file without a commit, such as one --update-baseline wrote, is used as it is.
  • --changed-only scans the changed files alone, and they match only one another.
  • Both flags are command line only. fixtures/changed-demo walks through five steps. (#1154, #1172)

• --report-name sets the base name of the report files. Linter aggregators such as MegaLinter run several tools into one reports folder, and two jscpd runs there overwrote each other's jscpd-report.json. --report-name megalinter-jscpd (config key reportName) names the json, xml, csv, html, markdown, sarif and edn reports, and the GitHub Action takes it as the report-name input. The badge, OpenMetrics and CodeClimate files keep their names. The name must be a plain file name: a path, an extension or an empty name is an error. Contributed by @​MannXo. (#1015, #1058)

• The MCP server finds every type of clone and compares folders. Every tool takes kinds: exact, renamed, similar and semantic, or type1 to type4. Without it, a tool reports what jscpd reports with the server's options. compare_folders(left, right) returns the JSON report of --compare for two folders. The server speaks the MCP revision 2026-07-28, and clients of the older revisions keep working. check_duplication now finds every copy of a snippet, where it used to match one of two, and --mcp no longer ignores --semantic. (#1135, #1137)

Changes

• --similarity scores differ from 5.4.0. The method is new, so a pair that scored 0.85 before can score lower now. Refresh a --threshold or a baseline that was set on the old results. --similarity 1 now reports functions with the same structure; up to 5.4.0 a ratio of 1 turned the search off, and jscpd prints a warning that says so. The options that the method replaced never reached a release. (#1156)

Bug Fixes

• --semantic and --compare found functions named if in C, C++ and C# code. Around #if and #ifdef, the grammars read else if (…) { } as a function named if, or while or await, and every if ( in the scan counted as a call to it, so in --compare one such branch could collect thousands of callers. jscpd now drops a function whose type is the keyword else. A word such as if, while or catch before a parenthesis counts as a call only as a member, as in promise.catch(f). Reported by @​MysterionRise, fixed by @​mvanhorn. (#1163, #1188)

• Three --compare fixes found on Apache Lucene and Lucene.NET, all by @​MysterionRise:

  • Test helpers now count toward the namesakes of a call. A private assertEquals in Lucene's benchmark code took all 6,127 calls to the name, 6,126 of them from tests. (#1165)
  • The HTML map cuts a long folder label in its middle, so the folders of one module no longer read alike. (#1166)
  • A .NET test project counts as tests wherever Tests sits in its dotted name, as in Lucene.Net.Tests.Analysis.Common. Before, 6,736 functions in 771 files of such projects counted as code. (#1167)

• The --compare reports disagreed. The console and the HTML map now round a share the same way, so 60 of 147 functions read 41% in both. A Tests block appears only when a side has a test that counts, and a declaration without a body no longer counts as a function. (#1130)

• --dead-code reported an import used only in a TSDoc link as unused. {@link X}, {@linkcode X} and {@linkplain X} now count as uses of X, as TypeScript counts them, and in JavaScript files the JSDoc types of @param, @returns, @type and the like count too. A name in the docs credits the import only, so a function that only a link names is still reported. (#1170, #1171)

• --ignore-pattern dropped the wrong tokens in code blocks. jscpd computed the ranges on the host file but tokenized Markdown fences, component scripts and Razor blocks from the block's own offsets. The ranges now move to the block. (#1144)

• git commands run from a hook acted on the hook's repository. jscpd's git subprocesses now drop the variables git exports to hooks, such as GIT_DIR and GIT_INDEX_FILE; before, --baseline-from-ref in a pre-commit hook wrote the base tree into the commit's index. A --history range or a --baseline-from-ref ref that starts with - is refused, so a scanned repository's config can no longer pass git an option such as --output=<file>. The worktree cleanup no longer prunes the user's other worktrees, and an API key that an embeddings API echoes in an error is redacted. (#1169)

• The Nix flake warned about stdenv.isDarwin. It uses stdenv.hostPlatform.isDarwin now. Contributed by @​mlavrinenko. (#1133)

Other

• The minimum Rust version is 1.97. oxc 0.153 and ruff 0.0.16 need it. (#1187)
• jscpd depends on basta 0.3.1, which has the dead-code fixes above.
• The tests check behavior instead of implementation details, and CI measures line coverage (#1168). The release retries cargo publish while the crates.io index catches up (#1123), and the compare-codebases skill keeps vendored and build folders out of a comparison (#1124).

... (truncated)

Commits

• 095d6ca release: cpd-v5.4.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Updates three dev dependencies. Includes jscpd 5.4.1, whose --similarity scoring can differ from 5.4.0, so thresholds or baselines set on old results should be refreshed.

^{Written for commit d660eeb. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: cac099e1-56d4-4250-8bde-f1350bf58df4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}