Skip to content

Update dependency karma to v6 [SECURITY]#288

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-karma-vulnerability
Open

Update dependency karma to v6 [SECURITY]#288
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-karma-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 7, 2022 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
karma (source) ~3.1.0 → ~6.3.16 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-0437

karma prior to version 6.3.14 contains a cross-site scripting vulnerability.

CVE-2021-23495

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.

Release Notes

karma-runner/karma (karma)

v6.3.16

Compare Source

Features
  • support SRI verification of link tags (dc51a2e)
  • support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

6.3.19 (2022-04-19)

Bug Fixes
  • client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes
  • deps: upgrade socket.io to v4.4.1 (52a30bb)

6.3.17 (2022-02-28)

Bug Fixes

6.3.16 (2022-02-10)

Bug Fixes
  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

6.3.14 (2022-02-05)

Bug Fixes
  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

6.3.12 (2022-01-24)

Bug Fixes
  • remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes
  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes
  • logger: create parent folders if they are missing (0d24bd9), closes #​3734

6.3.9 (2021-11-16)

Bug Fixes

6.3.8 (2021-11-07)

Bug Fixes
  • reporter: warning if stack trace contains generated code invocation (4f23b14)

6.3.7 (2021-11-01)

Bug Fixes
  • middleware: replace %X_UA_COMPATIBLE% marker anywhere in the file (f1aeaec), closes #​3711

6.3.6 (2021-10-25)

Bug Fixes

6.3.5 (2021-10-20)

Bug Fixes
  • client: prevent socket.io from hanging due to mocked clocks (#​3695) (105da90)

6.3.4 (2021-06-14)

Bug Fixes

6.3.3 (2021-06-01)

Bug Fixes

6.3.2 (2021-03-29)

Bug Fixes

6.3.1 (2021-03-24)

Bug Fixes

v6.3.15

Compare Source

Features
  • support SRI verification of link tags (dc51a2e)
  • support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

6.3.19 (2022-04-19)

Bug Fixes
  • client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes
  • deps: upgrade socket.io to v4.4.1 (52a30bb)

6.3.17 (2022-02-28)

Bug Fixes

6.3.16 (2022-02-10)

Bug Fixes
  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

6.3.14 (2022-02-05)

Bug Fixes
  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

6.3.12 (2022-01-24)

Bug Fixes
  • remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes
  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes
  • logger: create parent folders if they are missing (0d24bd9), closes #​3734

6.3.9 (2021-11-16)

Bug Fixes

6.3.8 (2021-11-07)

Bug Fixes
  • reporter: warning if stack trace contains generated code invocation (4f23b14)

6.3.7 (2021-11-01)

Bug Fixes
  • middleware: replace %X_UA_COMPATIBLE% marker anywhere in the file (f1aeaec), closes #​3711

6.3.6 (2021-10-25)

Bug Fixes

6.3.5 (2021-10-20)

Bug Fixes
  • client: prevent socket.io from hanging due to mocked clocks (#​3695) (105da90)

6.3.4 (2021-06-14)

Bug Fixes

6.3.3 (2021-06-01)

Bug Fixes

6.3.2 (2021-03-29)

Bug Fixes

6.3.1 (2021-03-24)

Bug Fixes

v6.3.14

Compare Source

Features
  • support SRI verification of link tags (dc51a2e)
  • support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

6.3.19 (2022-04-19)

Bug Fixes
  • client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes
  • deps: upgrade socket.io to v4.4.1 (52a30bb)

6.3.17 (2022-02-28)

Bug Fixes

6.3.16 (2022-02-10)

Bug Fixes
  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

6.3.14 (2022-02-05)

Bug Fixes
  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

6.3.12 (2022-01-24)

Bug Fixes
  • remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes
  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes
  • logger: create parent folders if they are missing (0d24bd9), closes #​3734

6.3.9 (2021-11-16)

Bug Fixes

6.3.8 (2021-11-07)

Bug Fixes
  • reporter: warning if stack trace contains generated code invocation (4f23b14)

6.3.7 (2021-11-01)

Bug Fixes
  • middleware: replace %X_UA_COMPATIBLE% marker anywhere in the file (f1aeaec), closes #​3711

6.3.6 (2021-10-25)

Bug Fixes

6.3.5 (2021-10-20)

Bug Fixes
  • client: prevent socket.io from hanging due to mocked clocks (#​3695) (105da90)

6.3.4 (2021-06-14)

Bug Fixes

6.3.3 (2021-06-01)

Bug Fixes

6.3.2 (2021-03-29)

Bug Fixes

6.3.1 (2021-03-24)

Bug Fixes

v6.3.13

Compare Source

Features
  • support SRI verification of link tags (dc51a2e)
  • support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

6.3.19 (2022-04-19)

Bug Fixes
  • client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes
  • deps: upgrade socket.io to v4.4.1 (52a30bb)

6.3.17 (2022-02-28)

Bug Fixes

6.3.16 (2022-02-10)

Bug Fixes
  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

6.3.14 (2022-02-05)

Bug Fixes
  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

6.3.12 (2022-01-24)

Bug Fixes
  • remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes
  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes
  • logger: create parent folders if they are missing (0d24bd9), closes #​3734

6.3.9 (2021-11-16)

Bug Fixes

6.3.8 (2021-11-07)

Bug Fixes
  • reporter: warning if stack trace contains generated code invocation (4f23b14)

6.3.7 (2021-11-01)

Bug Fixes
  • middleware: replace %X_UA_COMPATIBLE% marker anywhere in the file (f1aeaec), closes #​3711

6.3.6 (2021-10-25)

Bug Fixes

6.3.5 (2021-10-20)

Bug Fixes
  • client: prevent socket.io from hanging due to mocked clocks (#​3695) (105da90)

6.3.4 (2021-06-14)

Bug Fixes

6.3.3 (2021-06-01)

Bug Fixes

6.3.2 (2021-03-29)

Bug Fixes

6.3.1 (2021-03-24)

Bug Fixes

v6.3.12

Compare Source

Features
  • support SRI verification of link tags (dc51a2e)
  • support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

6.3.19 (2022-04-19)

Bug Fixes
  • client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes
  • deps: upgrade socket.io to v4.4.1 (52a30bb)

6.3.17 (2022-02-28)

Bug Fixes

6.3.16 (2022-02-10)

Bug Fixes
  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

6.3.14 (2022-02-05)

Bug Fixes
  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

6.3.12 (2022-01-24)

Bug Fixes
  • remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes
  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes
  • logger: create parent folders if they are missing (0d24bd9), closes #​3734

6.3.9 (2021-11-16)

Bug Fixes

6.3.8 (2021-11-07)

Bug Fixes
  • reporter: warning if stack trace contains generated code invocation (4f23b14)

6.3.7 (2021-11-01)

Bug Fixes
  • middleware: replace %X_UA_COMPATIBLE% marker anywhere in the file (f1aeaec), closes #​3711

6.3.6 (2021-10-25)

Bug Fixes

6.3.5 (2021-10-20)

Bug Fixes
  • client: prevent socket.io from hanging due to mocked clocks (#​3695) (105da90)

6.3.4 (2021-06-14)

Bug Fixes

6.3.3 (2021-06-01)

Bug Fixes

6.3.2 (2021-03-29)

Bug Fixes

6.3.1 (2021-03-24)

Bug Fixes

v6.3.11

Compare Source

Features
  • support SRI verification of link tags (dc51a2e)
  • support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

6.3.19 (2022-04-19)

Bug Fixes
  • client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes
  • deps: upgrade socket.io to v4.4.1 (52a30bb)

6.3.17 (2022-02-28)

Bug Fixes

6.3.16 (2022-02-10)

Bug Fixes
  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

6.3.14 (2022-02-05)

Bug Fixes
  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

6.3.12 (2022-01-24)

Bug Fixes
  • remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes
  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes
  • logger: create parent folders if they are missing (0d24bd9), closes #​3734

6.3.9 (2021-11-16)

Bug Fixes

6.3.8 (2021-11-07)

Bug Fixes
  • reporter: warning if stack trace contains generated code invocation (4f23b14)

6.3.7 (2021-11-01)

Bug Fixes
  • middleware: replace %X_UA_COMPATIBLE% marker anywhere in the file (f1aeaec), closes #​3711

6.3.6 (2021-10-25)

Bug Fixes

6.3.5 (2021-10-20)

Bug Fixes
  • client: prevent socket.io from hanging due to mocked clocks (#​3695) (105da90)

6.3.4 (2021-06-14)

Bug Fixes

6.3.3 (2021-06-01)

Bug Fixes

6.3.2 (2021-03-29)

Bug Fixes

6.3.1 (2021-03-24)

Bug Fixes

v6.3.10

Compare Source

Features
  • support SRI verification of link tags (dc51a2e)
  • support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

6.3.19 (2022-04-19)

Bug Fixes
  • client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes
  • deps: upgrade socket.io to v4.4.1 (52a30bb)

6.3.17 (2022-02-28)

Bug Fixes

6.3.16 (2022-02-10)

Bug Fixes
  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

6.3.14 (2022-02-05)

Bug Fixes
  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

6.3.12 (2022-01-24)

Bug Fixes
  • remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes
  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes
  • logger: create parent folders if they are missing (0d24bd9), closes #​3734

6.3.9 (2021-11-16)

Bug Fixes

6.3.8 (2021-11-07)

Bug Fixes
  • reporter: warning if stack trace contains generated code invocation (4f23b14)

6.3.7 (2021-11-01)

Bug Fixes
  • middleware: replace %X_UA_COMPATIBLE% marker anywhere in the file (f1aeaec), closes #​3711

6.3.6 (2021-10-25)

Bug Fixes

6.3.5 (2021-10-20)

Bug Fixes
  • client: prevent socket.io from hanging due to mocked clocks (#​3695) (105da90)

6.3.4 (2021-06-14)

Bug Fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch from 96a3330 to 6e3d732 Compare June 18, 2022 15:24
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch from 6e3d732 to ad64b8d Compare March 25, 2023 03:14
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 85bf262 to 968c6ff Compare April 3, 2023 12:54
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from d1734be to 54b4405 Compare April 17, 2023 14:25
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 3 times, most recently from 2b674bc to 0e4a38a Compare June 4, 2023 08:00
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch from 0e4a38a to 9ee49de Compare June 4, 2023 11:57
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 6 times, most recently from 75949f4 to 475ec9f Compare June 19, 2023 11:47
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 6dabd2c to c9ab2cf Compare June 29, 2023 13:19
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 4 times, most recently from c093849 to 0717e1d Compare July 9, 2023 12:52
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 4 times, most recently from aee00d1 to bc03309 Compare July 19, 2023 17:11
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 4 times, most recently from e72827c to ed7f083 Compare August 1, 2023 20:11
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch from 098b178 to 210b12b Compare July 3, 2025 00:46
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 4 times, most recently from 974d105 to 3bbc9b4 Compare August 13, 2025 19:26
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 0f2cb75 to 2f0f4c6 Compare August 19, 2025 23:45
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 3520629 to fa6ac38 Compare August 31, 2025 14:33
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 205589d to 8300550 Compare September 25, 2025 22:00
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from b983607 to 1472da2 Compare October 22, 2025 01:12
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 4975dde to 1489bf9 Compare November 11, 2025 04:55
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 0674413 to a808d7e Compare November 19, 2025 05:48
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 2bc5345 to cb752da Compare December 3, 2025 21:32
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 11b3164 to b068c97 Compare December 31, 2025 19:28
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 2f04146 to 857ee40 Compare January 8, 2026 22:09
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from cd63cdb to 1d3297a Compare January 19, 2026 22:25
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from 47f6de0 to 57f5e33 Compare February 3, 2026 02:41
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch from 57f5e33 to c0f63f0 Compare February 12, 2026 18:09
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch from c0f63f0 to 344e39b Compare February 12, 2026 23:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants