Karma 6.4.4 Depends on "Vulnerable" inflight Library

[poiuylkkk]

[email protected] depends on a deprecated version of the 'glob' package.
Need to update the version of glob to 9 or higher to fix the following vulnerabilities

https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116

[email protected] C:\Myfolders\Myfiles\2_proj\demo\06-ng\ng-demo
└─┬ [email protected]
└─┬ [email protected]
└── [email protected]

[anthony-redFox]

I can propose to use https://www.npmjs.com/package/karma-up my fork which updated all deps

package.json
"overrides": {
"karma": "npm:[email protected]"
},

[Devvox93]

body-parser 1.20.3 should be included in the package.json updates as well. Fixes a High vulnerability reported by Mend.

[anthony-redFox]

"body-parser": "^1.20.2", it is not have the fixed version usages so that mean you can use body-parser 1.20.3 as well

[beneccles]

Hi all,

Any updates on when the deprecated packages are due to be updated in Karma?