build(deps-dev): bump monocart-coverage-reports from 2.12.9 to 2.12.11

[dependabot]

Bumps monocart-coverage-reports from 2.12.9 to 2.12.11.

Changelog

Sourced from monocart-coverage-reports's changelog.

• 2.12.11

  • fixed child process crash when the tested code spawns a subprocess with a different cwd (NODE_OPTIONS register path is now absolute)

• 2.12.10

  • updated dependencies

Commits

• d7b4588 updated version: 2.12.10 => 2.12.11
• 89f15fb update docs
• 139aaa4 update docs
• fd3124d fix types
• 70cd882 update docs
• 748ed1e update docs
• 8a420d0 update docs
• cb91354 Merge pull request #125 from cenfun/issue-194
• 6ddae34 fix Codacy Static Code Analysis
• e3cc46e changelog
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Low risk dev-dependency bump that only affects coverage report generation; main risk is minor CI/coverage tooling behavior changes due to updated transitive dependencies.

Overview
Updates the dev dependency monocart-coverage-reports from 2.12.9 to 2.12.11 (in injected/package.json and package-lock.json).

The lockfile refresh pulls in newer transitive versions (e.g., acorn-walk, console-grid, eight-colors, lz-utils, monocart-locator) and adds a nested foreground-child@4 under monocart-coverage-reports.

^{Reviewed by Cursor Bugbot for commit 57a46a4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Suggested comment for Cursor review (copy and paste as a new comment):

@cursoragent can you review against the current code and outline potential impacts based on the changelogs of the update?

Can you check the test coverage and ensure that the new code is covered?
Can you think through if this dependency is still needed or if there's better practices used elsewhere.

Can you draft a separate PR with any fixes that might be needed?

Note: GitHub Actions bot cannot trigger Cursor agent directly. Please copy the above comment to invoke the review.

[github-actions]

Build Branch

Branch	pr-releases/dependabot/npm_and_yarn/main/monocart-coverage-reports-2.12.11
Commit	bd0d8ec4f6
Updated	April 24, 2026 at 12:23:48 AM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/dependabot/npm_and_yarn/main/monocart-coverage-reports-2.12.11

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/monocart-coverage-reports-2.12.11")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/monocart-coverage-reports-2.12.11
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/monocart-coverage-reports-2.12.11

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#bd0d8ec4f65b4bc1c892816c1909061654d1dc56

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "bd0d8ec4f65b4bc1c892816c1909061654d1dc56")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/monocart-coverage-reports-2.12.11
git -C submodules/content-scope-scripts checkout bd0d8ec4f65b4bc1c892816c1909061654d1dc56

[cursor]

Web Compatibility Assessment

• injected/package.json (L59-L59) — info: monocart-coverage-reports was bumped in devDependencies only. This package is used by coverage/reporting scripts, not by injected runtime bundles, so no direct impact to API surface fidelity, prototype shims, DOM behavior, feature lifecycle (load/init/urlChanged), or platform runtime behavior.
• package-lock.json (L61-L61, L7213-L7257) — info: lockfile update is consistent with the devDependency bump and remains dev: true; no runtime dependency graph change for page-injected code.
• package-lock.json (L2200-L2211, L3476-L3481, L3980-L3985, L7028-L7033) — info: transitive bumps (acorn-walk, console-grid, eight-colors, lz-utils) are coverage-tool transitive deps only; none touch injected/src/features, wrapper/shim utilities, entry points, or browser-facing contracts.

Security Assessment

• injected/package.json + package-lock.json (ranges above) — info: no changes to captured-globals, wrapper-utils, DDGProxy, message bridge, transport origin checks, or config-gating paths. No new postMessage, CustomEvent, dynamic code execution, or network exfiltration paths introduced in injected runtime.
• package-lock.json (L7237-L7251) — info: nested foreground-child update is still dev-only and constrained to tooling execution context, not hostile-page runtime context.

Risk Level

Low Risk — dependency-only dev tooling update with no modifications to injected runtime code paths, browser API overrides, messaging boundaries, or security-sensitive initialization logic.

Recommendations

1. Run the injected coverage workflow once (npm run coverage-int + npm run coverage-report) to validate report generation/output compatibility after the monocart bump.
2. Optional hardening alternative: pin monocart-coverage-reports to an exact version (instead of caret) if you want deterministic tooling behavior across reinstalls.
3. Keep this class of tooling-only bumps isolated from runtime feature changes in PRs to preserve clear compatibility/security review boundaries.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Stale comment

Dependency Risk Review: monocart-coverage-reports 2.12.9 -> 2.12.11

Confirmed concern (moderate): coverage path is not exercised in PR CI

• This package is only consumed by injected/scripts/merge-coverage.js via CoverageReport.
• That script is executed by npm run coverage-report -w injected in .github/workflows/coverage.yml.
• .github/workflows/coverage.yml only runs on schedule and workflow_dispatch, not pull_request.
• Result: regressions from this update can merge without PR-time signal, then fail later in nightly/manual coverage runs.

Uncertain concerns (needs validation)

• Upstream changelog for 2.12.11 says: "fixed child process crash when the tested code spawns a subprocess with a different cwd". This is likely a positive fix, but behavior changed in child-process handling; run coverage workflow once to confirm no environment-specific side effects.
• Transitive change includes foreground-child major bump (3.x -> nested 4.0.3) and license change on that nested package (BlueOak-1.0.0). Not a runtime app risk (dev-only path), but worth confirming against internal license policy.

Dependency necessity / alternatives

• Keeping this dependency is reasonable: repo currently relies on it to merge c8 + Playwright V8 coverage formats in injected/scripts/merge-coverage.js.
• Alternative follow-up (separate PR): add fixture-based unit tests for merge-coverage.js to reduce reliance on scheduled workflow for validation.

Suggested separate PR (no changes on this PR)

1. Add a lightweight PR-triggered coverage merge smoke test (or path-filtered job) that runs npm run coverage-report -w injected against fixture coverage JSON.
2. Add unit tests around merge-coverage.js parsing/filters so monocart-coverage-reports API compatibility is validated on every PR.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Stale comment

Follow-up created for the mitigation discussed above: #2653

It adds a PR-time CI smoke step (npm run coverage-report -w injected) so future monocart-coverage-reports updates are validated before merge.

View PR

  

_{Sent by Cursor Automation: Review dependabot}

[github-actions]

[Beta] Generated file diff

Time updated: Fri, 24 Apr 2026 00:24:04 GMT

[cursor]

Web Compatibility Assessment

• injected/package.json (56-59) — info: Change is limited to a devDependency version bump (monocart-coverage-reports ^2.12.9 → ^2.12.11). No injected runtime feature code, wrapper utilities, API shims, or platform entry points are modified, so no direct browser API surface/prototype-chain compatibility regression is introduced.
• package-lock.json (7211-7260, plus transitive lockfile entries at 2198-2204, 3474-3480, 3978-3984, 7026-7032) — info: Lockfile-only updates for coverage tooling and its transitive packages (acorn-walk, console-grid, eight-colors, lz-utils, foreground-child, monocart-locator). These are build/test-time dependencies and do not execute in page context; no change to site-facing behavior.

Security Assessment

• injected/package.json (56-59) — info: No new page-context logic paths; no impact to captured globals hygiene, message bridge trust boundaries, origin validation, or iframe security controls.
• package-lock.json (7211-7260) — info: Dependency graph changes are scoped to dev tooling (dev: true), with no modifications to injected/src/ runtime code. No new postMessage, dynamic code execution, config trust, or prototype attack surface in injected scripts.

Risk Level

Low Risk — This PR is dependency/lockfile-only for development coverage tooling and does not modify runtime injection, compatibility wrappers, or security-critical message/config pathways.

Recommendations

1. Run coverage-generation CI smoke validation (injected test workflow that invokes monocart-coverage-reports) to catch tooling contract changes from transitive updates (notably foreground-child major bump).
2. Keep this PR scoped to tooling only (no runtime rebundling artifacts) so rollback remains trivial if coverage/report formatting behavior changes.
3. If desired for defense-in-depth, add/maintain a CI assertion that production injected bundles are byte-identical for devDependency-only PRs.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Confirmed Concern

1. monocart-coverage-reports is not exercised by required PR CI in this repo.
   • This dependency is only used by injected/scripts/merge-coverage.js (via npm run coverage-report -w injected).
   • coverage-report is run in .github/workflows/coverage.yml, but that workflow triggers on schedule/workflow_dispatch, not pull_request.
   • pull_request checks in .github/workflows/tests.yml run unit/integration tests, but do not run coverage-report.

Impact: regressions in coverage merge/report generation can be merged undetected on dependency bumps.

Changelog/Delta Assessment

• Upstream changelog:
  • 2.12.10: dependency updates
  • 2.12.11: fix for child-process crash when subprocess cwd differs (absolute NODE_OPTIONS register path)
  • Source: CHANGELOG.md
• Lockfile also introduces transitive updates including foreground-child 3.x -> 4.x (major), monocart-locator 1.0.2 -> 1.0.3, and parser/util package updates.

Uncertain Concerns (assumptions + validation needed)

• foreground-child major bump is transitive/dev-only here; likely low runtime risk for app code, but behavior changes could affect coverage tooling subprocess behavior.
• Upstream includes internal logic changes (CLI path handling and object parsing logic), but this repo uses the API path, not mcr CLI. Low expected impact, still unverified in this repo’s PR CI.

Dependency Necessity

• Dependency is currently still needed: it is directly imported in injected/scripts/merge-coverage.js and used by coverage artifact workflows.
• Alternative (larger change): remove merged monocart reporting and rely on separate native reporters (c8 + Playwright artifacts), if merged V8 reporting is no longer required.

Suggested Follow-up (separate PR, not this Dependabot PR)

• Add a PR-triggered check that runs npm run coverage-report -w injected with fixture coverage input (or wire coverage.yml to pull_request for dependency files) so future bumps are validated in CI.

  

_{Sent by Cursor Automation: Review dependabot}