kucherenko/jscpd](https:

v5.0.7 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 1mo Developer Productivity

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

ai clones-detection code-quality coding-agents copy-paste copy-paste-detection

+9 more

cpd detector dry duplicates duplications mcp quality skill skills

Affected surfaces

breaking_upgrade

Summary

AI summary

Fixed stack overflow when scanning deeply‑nested JS/TS files and ensured --max-file-size skips oversized files on each run.

Type	Severity	Summary	CVE
Bugfix
Bugfix	Medium	Prevents stack overflow when scanning deeply nested JS/TS files by using larger rayon stacks. Prevents stack overflow when scanning deeply nested JS/TS files by using larger rayon stacks. Source: llm_adapter@2026-06-11 Confidence: high	—
Bugfix	Medium	Skips files exceeding size limits during walk, avoiding stack overflow from megabyte-scale generated files. Skips files exceeding size limits during walk, avoiding stack overflow from megabyte-scale generated files. Source: llm_adapter@2026-06-11 Confidence: high	—
Bugfix	Medium	Ensures a specific flag takes effect on every invocation instead of silently no‑op after the first call. Ensures a specific flag takes effect on every invocation instead of silently no‑op after the first call. Source: llm_adapter@2026-06-11 Confidence: high	—

Full changelog

Prevent stack overflow when scanning directories containing deeply-nested JS/TS files (e.g. Bun's with 320K+ nested for-loops). OXC's recursive-descent parser allocates one stack frame per AST nesting level; pathological inputs now exceed the default 8 MiB thread stack. Fixed by building a local rayon with 64 MiB stacks instead of using the global pool (which silently fails on re-init)
Default to — files exceeding the limit are skipped at walk time, consistent with jscpd v4's behavior. This prevents OXC from ever seeing megabyte-scale generated files that would overflow the stack
now correctly takes effect on every call (previously silently no-op'd after the first invocation)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track kucherenko/jscpd](https:

Get notified when new releases ship.

About kucherenko/jscpd](https: