fix(deps): bump karma from ^4.4 to ^6.4#776
Conversation
Clears two medium Dependabot advisories in the karma test runner: open redirect (fixed in 6.3.16) and cross-site scripting (fixed in 6.3.14). karma is a devDependency (test-only) and is never shipped in the app. The existing karma.conf.js loads unchanged under karma 6 (verified via karma.config.parseConfig) and all karma-* plugins install cleanly, so no config migration is required. Co-Authored-By: Claude Opus 4.8 <[email protected]> Signed-off-by: Thomas Müller <[email protected]>
karma 6 removed the static `Server.start()` used by the gulp `karma` task (`TypeError: KarmaServer.start is not a function`). Instantiate `new karma.Server(config, doneCallback)` with config built via `karma.config.parseConfig(...)` and call `.start()` on the instance. Also propagate a non-zero karma exit code as a task error so failing tests fail the build. Co-Authored-By: Claude Opus 4.8 <[email protected]> Signed-off-by: Thomas Müller <[email protected]>
dj4oC
left a comment
dj4oC
left a comment
There was a problem hiding this comment.
This PR bumps the karma devDependency from ^4.4 to ^6.4 in package.json and updates gulpfile.js's karma task to use the new programmatic Server-startup API required by Karma 6.
Findings
Nothing blocking. The gulpfile.js change correctly migrates from the deprecated KarmaServer.start(config, callback) call to the Karma 6.x pattern (karma.config.parseConfig(...) with promiseConfig/throwErrors, followed by new karma.Server(config, exitCallback).start()), matching the officially documented migration path — this is not a partial/trivially-passing shim. It also improves on the original by checking the exit code and catching config-parse rejections, whereas the old code silently called done() regardless of failure. The bumped package (karma, MIT-licensed) is already covered by the repo's .github/dependabot.yml npm entry (root directory), so no dependabot config gap. No PHP, composer, or new files touched.
Verdict
Approved
🤖 Automated review by Claude Code (security · stability · performance · coverage)
Generated by Claude Code
🤖 Automated review by Claude Code (security · stability · performance · coverage) Generated by Claude Code |
3 participants
What
Bump the
karmatest runner from^4.4to^6.4.Why
Clears the two remaining open Dependabot advisories on this repo, both in
karma:6.3.166.3.14karmais adevDependency(test-only) and is never shipped in the apptarball, so there is no runtime impact for users.
Compatibility
karma.conf.jsloads unchanged under karma 6, verified viakarma.config.parseConfig(...)(frameworks/reporters/browsers resolve, pluginautoload intact).
karma-*plugins install cleanly alongside karma 6.4.4; no configmigration required.
Verification
JS-unit CI (
make test-js→npm run test→ gulp karma, Firefox) exercises thefull run.