From 6b8a122e8ff7318116385ec7d09889fc59b27b5d Mon Sep 17 00:00:00 2001 From: diegosouzapw Date: Tue, 16 Jun 2026 10:40:24 -0300 Subject: [PATCH] chore(deps): ignore jscpd major bumps (v5 Rust rewrite breaks the duplication gate) Our duplication ratchet (scripts/check/check-duplication.mjs) is pinned to jscpd@4 and parses jscpd-report.json against a frozen baseline. jscpd v5 is a native Rust binary with no Node.js API and a different report/bin, so a major bump would break the gate. Migrate deliberately, not via dependabot. Closes the noise from #3916. --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 300a19739e..4fe8d53bb7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -24,6 +24,12 @@ updates: update-types: ["version-update:semver-major"] - dependency-name: "eslint-config-next" update-types: ["version-update:semver-major"] + # jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API). + # scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it + # parses jscpd-report.json against a frozen baseline). A v5 major would break + # the duplication gate — migrate the gate intentionally, not via dependabot. + - dependency-name: "jscpd" + update-types: ["version-update:semver-major"] - package-ecosystem: "github-actions" directory: "/"