Skip to content

Update dependency karma to v6.3.16 [SECURITY] #5994

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 24, 2022
Merged

Update dependency karma to v6.3.16 [SECURITY] #5994

merged 1 commit into from
Mar 24, 2022

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 11, 2022 •
edited
Loading

WhiteSource Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
karma (source) 6.3.4 -> 6.3.16 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-0437

karma prior to version 6.3.14 contains a cross-site scripting vulnerability.

CVE-2021-23495

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.

Release Notes

karma-runner/karma

v6.3.16

Compare Source

Bug Fixes
  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

v6.3.15

Compare Source

v6.3.14

Compare Source

Bug Fixes
  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

v6.3.13

Compare Source

Bug Fixes

v6.3.12

Compare Source

Bug Fixes
  • remove depreciation warning from log4js (41bed33)

v6.3.11

Compare Source

Bug Fixes
  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

v6.3.10

Compare Source

Bug Fixes
  • logger: create parent folders if they are missing (0d24bd9), closes #​3734

v6.3.9

Compare Source

Bug Fixes

v6.3.8

Compare Source

Bug Fixes
  • reporter: warning if stack trace contains generated code invocation (4f23b14)

v6.3.7

Compare Source

Bug Fixes
  • middleware: replace %X_UA_COMPATIBLE% marker anywhere in the file (f1aeaec), closes #​3711

v6.3.6

Compare Source

Bug Fixes

v6.3.5

Compare Source

Bug Fixes
  • client: prevent socket.io from hanging due to mocked clocks (#​3695) (105da90)

Configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by WhiteSource Renovate. View repository job log here.

@renovate renovate bot requested review from allspain and hsubox76 as code owners February 11, 2022 10:19
@changeset-bot
Copy link

changeset-bot bot commented Feb 11, 2022 •
edited
Loading

⚠️ No Changeset found

Latest commit: b9c7cb4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@google-oss-bot
Copy link
Contributor

google-oss-bot commented Feb 11, 2022 •
edited
Loading

Size Report 1

Affected Products

No changes between base commit (2d672ce) and merge commit (6081bde).

Test Logs

  1. https://storage.googleapis.com/firebase-sdk-metric-reports/YHgwaIMioA.html

@google-oss-bot
Copy link
Contributor

google-oss-bot commented Feb 11, 2022 •
edited
Loading

Size Analysis Report 1

Affected Products

No changes between base commit (2d672ce) and merge commit (6081bde).

Test Logs

  1. https://storage.googleapis.com/firebase-sdk-metric-reports/lBaVkf20Mh.html

@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch from 5c7142a to ba39744 Compare February 11, 2022 14:15
@renovate renovate bot changed the title Update dependency karma to v6.3.14 [SECURITY] Update dependency karma [SECURITY] Mar 2, 2022
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch 2 times, most recently from e903795 to 377d5d2 Compare March 2, 2022 13:20
@renovate renovate bot force-pushed the renovate/npm-karma-vulnerability branch from 377d5d2 to b9c7cb4 Compare March 14, 2022 22:53
@renovate renovate bot changed the title Update dependency karma [SECURITY] Update dependency karma to v6.3.16 [SECURITY] Mar 14, 2022
@hsubox76 hsubox76 merged commit f8c571c into master Mar 24, 2022
@hsubox76 hsubox76 deleted the renovate/npm-karma-vulnerability branch March 24, 2022 16:13
@firebase firebase locked and limited conversation to collaborators Apr 24, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@hsubox76 hsubox76 hsubox76 approved these changes

@allspain allspain Awaiting requested review from allspain

Assignees

@hsubox76 hsubox76

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@google-oss-bot @hsubox76 @renovate-bot