cuke-dedup 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to CukeDedup are documented in this file. The project follow
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-09-21
+
+### Changed
+
+- **Breaking (reports and baselines):** semantic fingerprints now use the first 128 bits of SHA-256 instead of FNV-1a-64. JSON and JSONL reports use schema version `3`, SARIF publishes `cukeDedupFingerprint/v3`, and semantic baselines use version `3`. Existing version `1` or `2` baselines are rejected for comparison and can be regenerated in place with `--update-baseline`.
+- Matcher compilation now runs in bounded windows instead of retaining every compiled matcher at once, substantially reducing peak memory on large definition corpora. Complete, untruncated runs retain the same findings; a run that exhausts its matcher-scan budget may become incomplete or retain a different bounded subset than v0.6.0.
+
 ## [0.6.0] - 2026-09-18
 
 ### Added
@@ -277,6 +284,7 @@ Initial public release.
 - Native Cargo and npm distributions for eight supported targets.
 - A checksum-verified GitHub Action and an agent-oriented CukeDedup skill.
 
+[0.7.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.5.0...v0.6.0
 [0.5.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.3.0...v0.4.0

package/README.md

@@ -136,7 +136,7 @@ steps:
     with:
       fetch-depth: 0
       persist-credentials: false
-  - uses: figueiredoluiz/cuke-dedup@v0.6.0
+  - uses: figueiredoluiz/cuke-dedup@v0.7.0
     with:
       path: .
       threshold: 5

package/SECURITY.md

@@ -5,11 +5,6 @@
 Security fixes are released for the latest published minor version. Before the first
 stable release, only the latest `0.x` release is supported.
 
-| Version | Supported |
-| --- | --- |
-| 0.2.x | Yes |
-| Older versions | No |
-
 ## Reporting a vulnerability
 
 Please do not open a public issue for a suspected vulnerability. Use

package/docs/ci-and-baselines.md

@@ -18,7 +18,7 @@ steps:
       fetch-depth: 0
       persist-credentials: false
 
-  - uses: figueiredoluiz/cuke-dedup@v0.6.0
+  - uses: figueiredoluiz/cuke-dedup@v0.7.0
     id: cuke-dedup
     with:
       path: .
@@ -101,8 +101,7 @@ cuke-dedup . --baseline .cuke-dedup-baseline.json --fail-on-new 3
 
 Baselines store sorted semantic fingerprints with multiplicity counts. Renames and unrelated line
 changes do not make a finding new, while an additional occurrence beyond the recorded count does.
-Version `1` baselines from CukeDedup 0.1 can be replaced by running the version `2` tool with
-`--update-baseline`; comparison rejects mismatched schemas.
+Version `1` and `2` baselines can be replaced by running the version `3` tool with `--update-baseline`; comparison rejects mismatched schemas and names the regeneration command.
 
 Updates reject `--changed-since` and are skipped after incomplete analysis or an operational error,
 preventing a partial scan from erasing accepted findings.

package/docs/reports.md

@@ -23,7 +23,7 @@ Rule headings are bold cyan, paths are blue, error/warning labels are red/yellow
 
 ## JSON and HTML
 
-JSON schema version `2` contains:
+JSON schema version `3` contains:
 
 - Relative Unicode-aware source spans and severity.
 - Suppressions and semantic fingerprints.
@@ -43,7 +43,7 @@ byte-reproducible artifacts matter. The deterministic corpus census remains pres
 
 ## JSON Lines
 
-JSONL schema version `2` emits one compact record per finding and a final summary:
+JSONL schema version `3` emits one compact record per finding and a final summary:
 
 ```sh
 cuke-dedup . --reporters jsonl \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cuke-dedup",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Static analysis for duplicate and reusable Cucumber step definitions",
   "type": "module",
   "bin": {
@@ -24,6 +24,8 @@
     "bump:version": "node scripts/release/bump-version.mjs",
     "pack:check": "npm pack --dry-run",
     "corpus:check": "node scripts/check/check-corpus.mjs",
+    "memory:check": "node scripts/check/check-memory.mjs target/release/cuke-dedup",
+    "duplication:check": "node scripts/check/check-duplication.mjs",
     "benchmark": "node scripts/benchmark/benchmark-analysis.mjs"
   },
   "engines": {
@@ -47,13 +49,13 @@
     "npm/platforms/*"
   ],
   "optionalDependencies": {
-    "cuke-dedup-darwin-arm64": "0.6.0",
-    "cuke-dedup-darwin-x64": "0.6.0",
-    "cuke-dedup-linux-arm64-gnu": "0.6.0",
-    "cuke-dedup-linux-arm64-musl": "0.6.0",
-    "cuke-dedup-linux-x64-gnu": "0.6.0",
-    "cuke-dedup-linux-x64-musl": "0.6.0",
-    "cuke-dedup-windows-arm64-msvc": "0.6.0",
-    "cuke-dedup-windows-x64-msvc": "0.6.0"
+    "cuke-dedup-darwin-arm64": "0.7.0",
+    "cuke-dedup-darwin-x64": "0.7.0",
+    "cuke-dedup-linux-arm64-gnu": "0.7.0",
+    "cuke-dedup-linux-arm64-musl": "0.7.0",
+    "cuke-dedup-linux-x64-gnu": "0.7.0",
+    "cuke-dedup-linux-x64-musl": "0.7.0",
+    "cuke-dedup-windows-arm64-msvc": "0.7.0",
+    "cuke-dedup-windows-x64-msvc": "0.7.0"
   }
 }