Karma: Please upgrade to latest braces version

[maeisdev]

Expected behaviour

Updated to braces 2.3.1.

Actual behaviour

 === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ braces                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.3.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ karma [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ karma > expand-braces > braces                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/786                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

Environment Details

Karma version: 4.0.0

[Adam-Kernig]

@maedewiza I don't want to disrupt this too much, how did you copy the npm audi text in so cleanly, I have reported this issue in angular also, just wondering :)

[Adam-Kernig]

Update:
Braces has not been updated in 4 years, is this wise to have this package in at all.

[luc-tielen]

this fixed it for me (add to package.json), but hopefully only temporarily needed:

  "resolutions": {
    "braces": "^2.3.2",
  }

[dominik-bln]

Seems to work only for yarn, anyone got a working solution for npm?

[KurtPreston]

@SteinRobert any chance of releasing this fix on a 3.x build?

[SteinRobert]

@KurtPreston that's not for me to decide - I just provided the PR. I'm not a maintainer/owner of this project. However from what I see in this repo it seems unlikely.

[KurtPreston]

@SteinRobert Sorry, my mistake, misread the PR. Thanks for the patch!
@johnjbarton Any chance of releasing this fix on a 3.x build?

[johnjbarton]

We should get #3265 fixed first. (And this will be on 4.x)

[Adam-Kernig]

When is this master version going to be launched so we can updated, will this be 4.0.1

[Westbrook]

Can we get a release of these security updates, please?

[johnjbarton]

Once we know that the npm audit at head is clean.

[e-mihaylin]

Once we know that the npm audit at head is clean.

just checked, issue persists(