diff --git a/CHANGELOG.md b/CHANGELOG.md
index 075c126f8..2c96b6e94 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [6.3.11](https://github.com/karma-runner/karma/compare/v6.3.10...v6.3.11) (2022-01-13)
+
+
+### Bug Fixes
+
+* **deps:** pin colors package to 1.4.0 due to security vulnerability ([a5219c5](https://github.com/karma-runner/karma/commit/a5219c52e2515248eefae4fe1863ac8ad3fdd43b))
+
 ## [6.3.10](https://github.com/karma-runner/karma/compare/v6.3.9...v6.3.10) (2022-01-08)
 
 
diff --git a/package-lock.json b/package-lock.json
index 8929131c1..00bdfc8af 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "karma",
-  "version": "6.3.10",
+  "version": "6.3.11",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -5211,7 +5211,7 @@
         "body-parser": "^1.19.0",
         "braces": "^3.0.2",
         "chokidar": "^3.5.1",
-        "colors": "^1.4.0",
+        "colors": "1.4.0",
         "connect": "^3.7.0",
         "di": "^0.0.1",
         "dom-serialize": "^2.2.1",
diff --git a/package.json b/package.json
index a6a67fe29..9c7907417 100644
--- a/package.json
+++ b/package.json
@@ -72,6 +72,7 @@
     "Jérémy Judéaux <jeremy.judeaux@volune.net>",
     "Marcello Nuccio <marcello.nuccio@gmail.com>",
     "Pieter Mees <pietermees@users.noreply.github.com>",
+    "Sergei Startsev <ai@programist.ru>",
     "pavelgj <pavelgj@gmail.com>",
     "sylvain-hamel <sylvainhamel0@gmail.com>",
     "ywong <wongyok@gmail.com>",
@@ -119,7 +120,6 @@
     "Ruben Bridgewater <ruben.bridgewater@fintura.de>",
     "Réda Housni Alaoui <reda.housnialaoui@gmail.com>",
     "Sammy Jelin <sjelin@gmail.com>",
-    "Sergei Startsev <ai@programist.ru>",
     "Sergey Simonchik <sergey.simonchik@gmail.com>",
     "Sergey Simonchik <sergey.simonchik@jetbrains.com>",
     "Shane Russell <shane1337@gmail.com>",
@@ -420,11 +420,14 @@
     "chalkerx@gmail.com>",
     "weiran.zsd@outlook.com>"
   ],
+  "overrides": {
+    "colors": "1.4.0"
+  },
   "dependencies": {
     "body-parser": "^1.19.0",
     "braces": "^3.0.2",
     "chokidar": "^3.5.1",
-    "colors": "^1.4.0",
+    "colors": "1.4.0",
     "connect": "^3.7.0",
     "di": "^0.0.1",
     "dom-serialize": "^2.2.1",
@@ -494,7 +497,7 @@
   "engines": {
     "node": ">= 10"
   },
-  "version": "6.3.10",
+  "version": "6.3.11",
   "license": "MIT",
   "scripts": {
     "lint": "eslint . --ext js --ignore-pattern *.tpl.js",
diff --git a/test/e2e/cli.feature b/test/e2e/cli.feature
index e4f235985..16af67fa3 100644
--- a/test/e2e/cli.feature
+++ b/test/e2e/cli.feature
@@ -30,7 +30,7 @@ Feature: CLI
     When I execute Karma with arguments: "--version"
     Then the stdout matches RegExp:
       """
-      ^\d\.\d\.\d$
+      ^\d+\.\d+\.\d+$
       """
 
   Scenario: Error when command is unknown