Update dependency karma to v6.3.16 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
karma (source)	6.3.4 -> 6.3.16

GitHub Vulnerability Alerts

CVE-2022-0437

karma prior to version 6.3.14 contains a cross-site scripting vulnerability.

CVE-2021-23495

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.

---

Release Notes

karma-runner/karma (karma)

v6.3.16

Compare Source

Bug Fixes

• security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

v6.3.15

Compare Source

Bug Fixes

• helper: make mkdirIfNotExists helper resilient to concurrent calls (d9dade2), closes /github.com/karma-runner/karma-coverage/issues/434#issuecomment-1017939333

v6.3.14

Compare Source

Bug Fixes

• remove string template from client code (91d5acd)
• warn when singleRun and autoWatch are false (69cfc76)
• security: remove XSS vulnerability in returnUrl query param (839578c)

v6.3.13

Compare Source

Bug Fixes

• deps: bump log4js to resolve security issue (5bf2df3), closes #​3751

v6.3.12

Compare Source

Bug Fixes

• remove depreciation warning from log4js (41bed33)

v6.3.11

Compare Source

Bug Fixes

• deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

v6.3.10

Compare Source

Bug Fixes

• logger: create parent folders if they are missing (0d24bd9), closes #​3734

v6.3.9

Compare Source

Bug Fixes

• restartOnFileChange option not restarting the test run (92ffe60), closes #​27 #​3724

v6.3.8

Compare Source

Bug Fixes

• reporter: warning if stack trace contains generated code invocation (4f23b14)

v6.3.7

Compare Source

Bug Fixes

• middleware: replace %X_UA_COMPATIBLE% marker anywhere in the file (f1aeaec), closes #​3711

v6.3.6

Compare Source

Bug Fixes

• bump vulnerable ua-parser-js version (6f2b2ec), closes #​3713

v6.3.5

Compare Source

Bug Fixes

• client: prevent socket.io from hanging due to mocked clocks (#​3695) (105da90)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[cloudflare-pages]

Deploying youtacrands-va-github-io with    Cloudflare Pages

Latest commit:	cd967f4
Status:	✅  Deploy successful!
Preview URL:	https://5ce0733f.youtacrands-va-github-io.pages.dev
Branch Preview URL:	https://renovate-npm-karma-vulnerabi.youtacrands-va-github-io.pages.dev

View logs

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details

Scanned Manifest Files

package-lock.json

• socket.io-parser@4.0.4
• engine.io@4.1.1
• ua-parser-js@0.7.28
• karma@6.3.4
• log4js@6.3.0
• @socket.io/component-emitter@3.1.0
• @types/cors@2.8.17
• cookie@0.4.2
• date-format@4.0.14
• debug@4.3.4
• engine.io@6.5.4
• engine.io-parser@5.2.2
• flatted@3.3.1
• isbinaryfile@4.0.10
• karma@6.3.16
• log4js@6.9.1
• mime@2.6.0
• mkdirp@0.5.6
• rfdc@1.3.1
• socket.io@4.7.5
• socket.io-adapter@2.5.4
• socket.io-parser@4.2.4
• streamroller@3.1.5
• tmp@0.2.3
• ua-parser-js@0.7.37
• ws@8.11.0
• @types/component-emitter@1.2.10
• @types/cors@2.8.12
• base64-arraybuffer@0.1.4
• cookie@0.4.1
• date-format@2.1.0
• date-format@3.0.0
• engine.io-parser@4.0.3
• flatted@2.0.2
• isbinaryfile@4.0.8
• rfdc@1.3.0
• socket.io@3.1.2
• socket.io-adapter@2.1.0
• streamroller@2.2.4
• tmp@0.2.1
• ws@7.4.6