monocart-coverage-reports 2.12.10 → 2.12.11

package/lib/utils/util.js

@@ -76,23 +76,24 @@ const Util = {
     },
 
     strToObj: (str) => {
-        if (typeof str === 'string') {
-            str = str.trim();
-            if (str.startsWith('{') && str.endsWith('}')) {
-                let fun;
-                let err;
-                try {
-                    fun = new Function(`return ${str}`);
-                } catch (e) {
-                    err = e;
-                }
-                if (!err) {
-                    const obj = fun();
-                    if (obj && typeof obj === 'object') {
-                        return obj;
-                    }
-                }
+        if (typeof str !== 'string') {
+            return;
+        }
+        str = str.trim();
+        if (!(str.startsWith('{') && str.endsWith('}'))) {
+            return;
+        }
+        // Accept JSON-like objects using single or double quotes, e.g.
+        //   {'**/node_modules/**':false,'**/src/*.js':true}
+        // Normalize single quotes to double quotes, then JSON.parse (safe, no code execution).
+        const normalized = str.replace(/'/g, '"');
+        try {
+            const obj = JSON.parse(normalized);
+            if (obj && typeof obj === 'object') {
+                return obj;
             }
+        } catch (e) {
+            // not a parseable object literal
         }
     },
 
@@ -744,7 +745,6 @@ const Util = {
     // skip \s and comments
     fixSourceRange: (locator, start, end) => {
 
-        let fixedStart = start;
         let fixedEnd = end;
 
         const rangeText = locator.getSlice(start, end);
@@ -814,7 +814,7 @@ const Util = {
             startOffset += 1;
         }
 
-        fixedStart = start + startOffset;
+        const fixedStart = start + startOffset;
 
         return {
             fixedStart,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "monocart-coverage-reports",
-    "version": "2.12.10",
+    "version": "2.12.11",
     "description": "A code coverage tool to generate native V8 reports or Istanbul reports.",
     "main": "./lib/index.js",
     "bin": {
@@ -51,6 +51,7 @@
         "test-merge-v8": "node ./test/test-merge-v8.js",
         "test-merge-cli": "npx mcr merge -r console-details,v8 --inputDir .temp/code-coverage/raw --outputDir .temp/merge-cli",
         "test-client": "node ./test/test-client.js",
+        "test-cp": "npx mcr node test/test-cp.mjs --outputDir .temp/test-cp",
         "test-all": "node ./test/test.js",
         "test-pr": "node --inspect=9230 ./test/test-pr.js",
         "test": "npm run test-unit && npx mcr npm run test-all -c test/mcr.config.mcr.js && node ./scripts/docs.js",
@@ -91,7 +92,7 @@
         "@jsdevtools/coverage-istanbul-loader": "^3.0.5",
         "@rollup/plugin-commonjs": "^29.0.2",
         "@rollup/plugin-typescript": "^12.3.0",
-        "@swc/core": "^1.15.26",
+        "@swc/core": "^1.15.30",
         "@types/node": "^25.6.0",
         "async-tick": "^1.0.2",
         "babel-loader": "^10.1.1",
@@ -100,7 +101,7 @@
         "cross-env": "^10.1.0",
         "diff-sequences": "^29.6.3",
         "esbuild": "^0.28.0",
-        "eslint": "~10.2.0",
+        "eslint": "~10.2.1",
         "eslint-config-plus": "^2.0.4",
         "eslint-plugin-html": "^8.1.4",
         "eslint-plugin-vue": "^10.8.0",
@@ -115,9 +116,9 @@
         "node-stream-zip": "^1.15.0",
         "open": "^11.0.0",
         "playwright": "^1.59.1",
-        "postcss": "^8.5.9",
-        "puppeteer": "^24.40.0",
-        "rollup": "^4.60.1",
+        "postcss": "^8.5.10",
+        "puppeteer": "^24.41.0",
+        "rollup": "^4.60.2",
         "starfall-cli": "^2.0.24",
         "stylelint": "^17.8.0",
         "stylelint-config-plus": "^1.1.6",
@@ -126,7 +127,7 @@
         "ts-loader": "^9.5.7",
         "tsx": "^4.21.0",
         "turbogrid": "^3.2.4",
-        "typescript": "^6.0.2",
+        "typescript": "^6.0.3",
         "vine-ui": "^3.1.18",
         "webpack": "^5.106.2",
         "ws": "^8.20.0",