Update karma to 3.0.0 #384
Assignees
Comments
|
@0xazure thanks for reporting this. Would you be willing to send a pull request with an update to our karma version in package.json? Let me know if you need any help with that. |
|
I'd be happy to! I'll dig into |
humphd
pushed a commit
that referenced
this issue
Sep 13, 2018
Resolves `npm audit` warnings about 1 low, 5 moderate vulnerabilities related to versions before karma@3.0.0. Closes #384.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
A fresh install of the project dependencies ends with a little blurb about dependency vulnerabilities:
The full output of
npm auditis as follows (and rather long, see details), but the audit suggests a key take-away:=== npm audit security report === # Run npm install --save-dev karma@3.0.0 to resolve 6 vulnerabilities SEMVER WARNING: Recommended action is a potentially breaking change ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Moderate │ Memory Exposure │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ tunnel-agent │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ karma [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ karma > log4js > loggly > request > tunnel-agent │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/598 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Moderate │ Prototype pollution │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ hoek │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ karma [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ karma > log4js > loggly > request > hawk > boom > hoek │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/566 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Moderate │ Prototype pollution │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ hoek │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ karma [dev] 8000 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ karma > log4js > loggly > request > hawk > cryptiles > boom │ │ │ > hoek │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/566 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Moderate │ Prototype pollution │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ hoek │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ karma [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ karma > log4js > loggly > request > hawk > hoek │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/566 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Moderate │ Prototype pollution │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ hoek │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ karma [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ karma > log4js > loggly > request > hawk > sntp > hoek │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/566 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Low │ Regular Expression Denial of Service │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ timespan │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ karma [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ karma > log4js > loggly > timespan │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/533 │ └───────────────┴──────────────────────────────────────────────────────────────┘ found 6 vulnerabilities (1 low, 5 moderate) in 9518 scanned packages 6 vulnerabilities require semver-major dependency updates.# Run npm install --save-dev karma@3.0.0 to resolve 6 vulnerabilities SEMVER WARNING: Recommended action is a potentially breaking changeIt seems like upgrading the
karmadev dependency resolves all of the issues identified in the audit.The breaking change between the
2.xand3.xbranches seems to be dropping Nodejs4 support but no other major changes, so this should be a pretty straight-forward upgrade.The text was updated successfully, but these errors were encountered: