Karma 6.4.4 Depends on "Vulnerable" inflight Library

[poiuylkkk]

karma@6.4.4 depends on a deprecated version of the 'glob' package.
Need to update the version of glob to 9 or higher to fix the following vulnerabilities

https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116

ng-demo@0.0.0 C:\Myfolders\Myfiles\2_proj\demo\06-ng\ng-demo
└─┬ karma@6.4.4
└─┬ glob@7.2.3
└── inflight@1.0.6

[anthony-redFox]

I can propose to use https://www.npmjs.com/package/karma-up my fork which updated all deps

package.json
"overrides": {
"karma": "npm:karma-up@7.0.1"
},

[Devvox93]

body-parser 1.20.3 should be included in the package.json updates as well. Fixes a High vulnerability reported by Mend.

[anthony-redFox]

"body-parser": "^1.20.2", it is not have the fixed version usages so that mean you can use body-parser 1.20.3 as well

[beneccles]

Hi all,

Any updates on when the deprecated packages are due to be updated in Karma?

[rgant]

It would be nice to see these dependencies updated.

[broomfn]

+1

[AllenPCG]

+2

[daze99]

+1

[YanFChen]

+1

[pstoellberger]

+1

[kosso]

Would very much appreciate new apps not spitting out errors based on this issue in a new Angular 19 app.