Karma 6.4.4 Depends on "Vulnerable" inflight Library

[poiuylkkk]

[email protected] depends on a deprecated version of the 'glob' package. Need to update the version of glob to 9 or higher to fix the following vulnerabilities

https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116

[email protected] C:\Myfolders\Myfiles\2_proj\demo\06-ng\ng-demo └─┬ [email protected] └─┬ [email protected] └── [email protected]

[anthony-redFox]

I can propose to use https://www.npmjs.com/package/karma-up my fork which updated all deps

package.json "overrides": { "karma": "npm:[email protected]" },

[Devvox93]

body-parser 1.20.3 should be included in the package.json updates as well. Fixes a High vulnerability reported by Mend.

[anthony-redFox]

"body-parser": "^1.20.2", it is not have the fixed version usages so that mean you can use body-parser 1.20.3 as well

[beneccles]

Hi all,

Any updates on when the deprecated packages are due to be updated in Karma?

[rgant]

It would be nice to see these dependencies updated.

[broomfn]

+1

[AllenPCG]

+2

[daze99]

+1

[YanFChen]

+1

[pstoellberger]

+1

[kosso]

Would very much appreciate new apps not spitting out errors based on this issue in a new Angular 19 app.

[vivek-ra]

+1

[Karexar]

+1

[xiv3n]

+1

[disha-sengupta]

+1

[ZackManning]

+1

[ronwang01]

+1

[ThomasHeinkel]

+1

[ryanscovill]

+1

[Montag1206]

+1

[valdrin-hoti]

+1

[pgeyman]

+1

[MarkCuypersPpw]

+1

[hlovdal]

For anyone ending up here due to npm audit complaining

# npm audit report

body-parser  <2.2.1
Severity: moderate
body-parser is vulnerable to denial of service when url encoding is used - https://github.com/advisories/GHSA-wqch-xfxh-vrr4
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/body-parser
node_modules/karma/node_modules/body-parser
  karma  >=0.13.0-rc.0
  Depends on vulnerable versions of body-parser
  node_modules/karma
    @angular/build  >=19.2.0-next.0
    Depends on vulnerable versions of karma
    node_modules/@angular/build
    karma-jasmine  >=5.0.0
    Depends on vulnerable versions of karma
    node_modules/karma-jasmine
    karma-jasmine-html-reporter  >=2.0.0
    Depends on vulnerable versions of karma
    Depends on vulnerable versions of karma-jasmine
    node_modules/karma-jasmine-html-reporter

5 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

the suggested downgrade of karma to version 0.12.37 is not a viable solution. Instead add an override as a workaround:

diff --git a/package.json b/package.json
index 54a3f03..c56e4fb 100644
--- a/package.json
+++ b/package.json
@@ -9,10 +9,15 @@
     "watch": "ng build --watch --configuration development",
     "test": "ng test --watch=false --code-coverage",
     "zzzz-last-script": ""
   },
   "private": true,
+  "overrides": {
+    "karma": {
+      "body-parser": "2.2.1"
+    }
+  },
   "dependencies": {
     "@angular/common": "^20.3.12",
     "@angular/compiler": "^20.3.12",
     "@angular/core": "^20.3.12",
     "@angular/forms": "^20.3.12",
@@ -29,10 +34,11 @@
   "devDependencies": {
     "@angular/build": "^20.3.10",
     "@angular/cli": "^20.3.10",
     "@angular/compiler-cli": "^20.3.12",
     "@types/jasmine": "~5.1.13",
+    "body-parser": "^2.2.1",
     "jasmine-auto-spies": "^8.0.1",
     "jasmine-core": "~5.12.1",
     "karma": "~6.4.4",
     "karma-chrome-launcher": "~3.2.0",
     "karma-coverage": "~2.2.1",