search

karma-runner / karma

Spectacular Test Runner for JavaScript
http://karma-runner.github.io
MIT License
11.95k stars 1.71k forks source link

Karma 6.4.4 Depends on "Vulnerable" inflight Library #3888

Open poiuylkkk opened 2 months ago

poiuylkkk commented 2 months ago

karma@6.4.4 depends on a deprecated version of the 'glob' package. Need to update the version of glob to 9 or higher to fix the following vulnerabilities

https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116

ng-demo@0.0.0 C:\Myfolders\Myfiles\2_proj\demo\06-ng\ng-demo └─┬ karma@6.4.4 └─┬ glob@7.2.3 └── inflight@1.0.6

anthony-redFox commented 2 months ago

I can propose to use https://www.npmjs.com/package/karma-up my fork which updated all deps

package.json "overrides": { "karma": "npm:karma-up@7.0.1" },

Devvox93 commented 1 month ago

body-parser 1.20.3 should be included in the package.json updates as well. Fixes a High vulnerability reported by Mend.

anthony-redFox commented 1 month ago

"body-parser": "^1.20.2", it is not have the fixed version usages so that mean you can use body-parser 1.20.3 as well

beneccles commented 8 hours ago

Hi all,

Any updates on when the deprecated packages are due to be updated in Karma?