cuke-dedup 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -5,6 +5,70 @@ All notable changes to CukeDedup are documented in this file. The project follow
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-16
+
+### Added
+
+- Interactive terminal reports show the tool version, selective color, a finding-count footer, and detection time. `NO_COLOR` disables ANSI styling; redirected output remains plain text.
+
+### Changed
+
+- Terminal findings have a blank line after each rule heading and between findings instead of divider lines.
+- `obj['name']` and `obj.name` read the same property, so two handlers that differ only in that
+  spelling are now recognised as the same handler. This applies to every property access in a
+  handler, not only assertions: `page['locator']('x')` matches `page.locator('x')`. Only a static
+  string literal whose decoded value is a valid identifier is folded — a dynamic key, a template
+  literal, or a name with no dot spelling such as `['not.resolves']` keeps its own identity.
+  Optional access is preserved, so `a?.['b']` matches `a?.b` and neither matches `a.b`.
+  **Reports can gain findings on upgrade**, because pairs that were previously distinguished only
+  by access spelling are now duplicates.
+
+### Fixed
+
+- The regular-expression `v` flag is part of a matcher's identity. It enables Unicode set notation
+  and changes character-class semantics, so `/^a gauge$/v` and `/^a gauge$/` match different inputs
+  and are no longer reported as `normalized-matcher`. Flags that only affect how a match is executed
+  — `g`, `y` and `d` — are still ignored for identity, and two matchers carrying `v` still compare
+  as the same matcher.
+- Replacing the assertion factory through a second `require()` of the same module now revokes
+  assertion trust. Two `require()` calls for one module return the same cached object, so
+  `other.expect = replacement` replaces the factory that a separate `api.expect(...)` call uses.
+  Previously only a local alias (`const other = api`) propagated, so handlers relying on a factory
+  replaced through the second binding were still reported as duplicates.
+- A `for (const x of xs)` or `for (const x in xs)` head binds `x` for the loop, so a reference to
+  `x` in the body is the loop variable rather than an outer constant of the same name. The binding
+  was not registered, so the outer constant's value was substituted into the loop body. This was
+  wrong in both directions: identical loop handlers with different unrelated outer constants were
+  reported as distinct, and different loop bodies sharing an outer constant could be reported as
+  duplicates. `class`, `function`, `catch` and classic `for (let i = …)` bindings were already
+  handled.
+
+## [0.4.0] - 2026-09-15
+
+### Changed
+
+- Static computed property access resolves the same way dot access does at every position of an
+  assertion chain, so `expect(x)['not'].toBe(y)` now carries the semantics of
+  `expect(x).not.toBe(y)`. Conflicting expected values behind a computed modifier are no longer
+  collapsed into a `parameterization-candidate`, and a dotted and a computed spelling of the same
+  assertion can now be reported as near-duplicates where previously neither was. Reports can
+  therefore change in both directions on upgrade.
+- A property name resolves only when it is written as a static string literal. A concatenation, a
+  template literal, a runtime value, or an escape the decoder does not support stays unresolved
+  rather than resolving to a name the source never spells, which keeps the handler non-comparable
+  instead of claiming an assertion.
+
+### Fixed
+
+- Writing through an alias of a matcher builder revokes assertion trust for every spelling of that
+  alias, not only the flat one. Nested destructuring, shorthand bindings, shorthand bindings
+  carrying a default, and object rest bindings are now treated like `const negated =
+  api.expect.not`. Handlers that rely on a matcher replaced through one of those aliases are no
+  longer reported as duplicates.
+- Object rest bindings are treated as the shallow copies they are. `copy.not.objectContaining = x`
+  reaches the object the source still references and revokes trust, while `copy.not = x` replaces a
+  slot on the copy alone and leaves trust intact. Previously neither revoked it.
+
 ## [0.3.0] - 2026-09-14
 
 ### Added
@@ -159,6 +223,8 @@ Initial public release.
 - Native Cargo and npm distributions for eight supported targets.
 - A checksum-verified GitHub Action and an agent-oriented CukeDedup skill.
 
+[0.5.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.1.1...v0.2.0

package/README.md

@@ -23,7 +23,7 @@ With Cargo:
 cargo install cuke-dedup
 ```
 
-Or in a JavaScript project:
+Or in a JavaScript project, using Node.js 24 LTS (recommended):
 
 ```sh
 npm install --save-dev cuke-dedup
@@ -136,7 +136,7 @@ steps:
     with:
       fetch-depth: 0
       persist-credentials: false
-  - uses: figueiredoluiz/cuke-dedup@v0.3.0
+  - uses: figueiredoluiz/cuke-dedup@v0.5.0
     with:
       path: .
       threshold: 5
@@ -185,7 +185,7 @@ and is distributed independently from the Cargo and npm packages.
 
 ## Compatibility
 
-- Rust 1.90 or newer is required. The npm launcher is tested on Node.js 20 and 24.
+- Building from source requires Rust 1.90 or newer. Node.js 24 LTS is recommended for the npm launcher; Node.js 20 remains the minimum compatible version and is tested in CI.
 - Definition extraction currently supports JavaScript and TypeScript, including JSX and common
   module variants.
 - Static analysis cannot safely resolve every dynamic configuration, matcher, wrapper, or imported

package/docs/ci-and-baselines.md

@@ -18,7 +18,7 @@ steps:
       fetch-depth: 0
       persist-credentials: false
 
-  - uses: figueiredoluiz/cuke-dedup@v0.3.0
+  - uses: figueiredoluiz/cuke-dedup@v0.5.0
     id: cuke-dedup
     with:
       path: .

package/docs/reports.md

@@ -17,6 +17,10 @@ file-only run prints the generated paths to stdout.
 Terminal and JSONL both own stdout and cannot be selected together. JSONL can be combined with
 file reporters without contaminating the stream.
 
+The terminal report shows the tool version, leaves a blank line after each rule heading and between findings, and ends with the total number of active findings and detection time. Timing covers discovery, parsing, and analysis; `--no-metrics` omits it.
+
+Rule headings are bold cyan, paths are blue, error/warning labels are red/yellow, and footer details are gray only when stdout is a terminal. Set `NO_COLOR` to a nonempty value to disable color. Piped output and the other report formats contain no ANSI color codes.
+
 ## JSON and HTML
 
 JSON schema version `2` contains:

package/docs/safety-and-limitations.md

@@ -7,7 +7,7 @@ resource limits keep failures visible and bound the work performed.
 ## Compatibility
 
 - The minimum supported Rust version is 1.90.
-- The npm launcher is tested on Node.js 20 and 24.
+- Node.js 24 LTS is recommended for the npm launcher. CI also tests Node.js 20 as the minimum compatible version; Node.js 20 has reached end of life upstream.
 - Source adapters cover JavaScript and TypeScript, including JSX and common module variants.
 - Unsupported source languages are rejected rather than guessed.
 - Classic Gherkin and Gherkin Markdown are supported, including declared Gherkin dialects.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cuke-dedup",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Static analysis for duplicate and reusable Cucumber step definitions",
   "type": "module",
   "bin": {
@@ -47,13 +47,13 @@
     "npm/platforms/*"
   ],
   "optionalDependencies": {
-    "cuke-dedup-darwin-arm64": "0.3.0",
-    "cuke-dedup-darwin-x64": "0.3.0",
-    "cuke-dedup-linux-arm64-gnu": "0.3.0",
-    "cuke-dedup-linux-arm64-musl": "0.3.0",
-    "cuke-dedup-linux-x64-gnu": "0.3.0",
-    "cuke-dedup-linux-x64-musl": "0.3.0",
-    "cuke-dedup-windows-arm64-msvc": "0.3.0",
-    "cuke-dedup-windows-x64-msvc": "0.3.0"
+    "cuke-dedup-darwin-arm64": "0.5.0",
+    "cuke-dedup-darwin-x64": "0.5.0",
+    "cuke-dedup-linux-arm64-gnu": "0.5.0",
+    "cuke-dedup-linux-arm64-musl": "0.5.0",
+    "cuke-dedup-linux-x64-gnu": "0.5.0",
+    "cuke-dedup-linux-x64-musl": "0.5.0",
+    "cuke-dedup-windows-arm64-msvc": "0.5.0",
+    "cuke-dedup-windows-x64-msvc": "0.5.0"
   }
 }