kucherenko/jscpd](https:

v4.2.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Developer Productivity

✓ No known CVEs patched

This release patches 1 known CVE

Topics

ai clones-detection code-quality coding-agents copy-paste copy-paste-detection

+9 more

cpd detector dry duplicates duplications mcp quality skill skills

Affected surfaces

deps breaking_upgrade

Summary

AI summary

Fixed JSON reporter duplicate token count computation.

Type	Severity	Summary	CVE
Dependency
Dependency	High	Bumps Vitest from 3.2.4 to 4.1.0 to address CVE-2026-47429 security vulnerability. Bumps Vitest from 3.2.4 to 4.1.0 to address CVE-2026-47429 security vulnerability. Source: llm_adapter@2026-06-07 Confidence: low	—
Dependency	Low	Updates Commander from v5 to v15 for modern Node.js compatibility. Updates Commander from v5 to v15 for modern Node.js compatibility. Source: llm_adapter@2026-06-07 Confidence: high	—
Dependency	Low	Updates Pug, node-sarif-builder, and nodemon for security and compatibility. Updates Pug, node-sarif-builder, and nodemon for security and compatibility. Source: llm_adapter@2026-06-07 Confidence: high	—
Bugfix	Medium	Fixes duplicate token counts in JSON reporter output. Fixes duplicate token counts in JSON reporter output. Source: llm_adapter@2026-06-07 Confidence: high	—
Bugfix	Medium	Improves Gitignore handling to walk parent directories for full parity with Git. Improves Gitignore handling to walk parent directories for full parity with Git. Source: llm_adapter@2026-06-07 Confidence: high	—
Refactor	Low	Migrates CLI option parsing from direct property access to Commander API. Migrates CLI option parsing from direct property access to Commander API. Source: llm_adapter@2026-06-07 Confidence: high	—

Full changelog

JSON reporter duplicate token counts — was always reported as in JSON output; now computed from token positions () (#801).
Gitignore parent-directory walk — files in parent directories up to the repo root are now read and combined with scan-directory files. Also reads and the global for full parity with Git's ignore resolution (#741).
Commander v15 migration — CLI option parsing migrated from direct property access (, etc.) to the API required by Commander v8+. The / flag handling was rewritten to use Commander's native negation support instead of inspection.
Vitest 4.1.0 — bumped from 3.2.4 to address CVE-2026-47429.
Commander v15 — bumped from v5 to v15, enabling modern Node.js compatibility.
Pug 3.0.4, node-sarif-builder 4.1.0, nodemon 3.1.14 — dependency bumps for security and compatibility.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track kucherenko/jscpd](https:

Get notified when new releases ship.

About kucherenko/jscpd](https: