Log4js Vulnerability

[shirblc]

Description

Looks like the current version of karma-viewport depends on a vulnerable version of log4js. It also seems that karma-viewport depends on quite a few outdated packages. I know this isn’t production dependency so it’s probably not critical, but it would be really great to have updated sub-dependencies & dependencies… Is there any chance they (or at least log4js) can be upgraded, @squidfunk?

Expected behavior

To have non-vulnerable dependencies.

Actual behavior

There’s a vulnerable version of log4js.

Steps to reproduce the bug

1. Install karma-viewport in a project. You’ll see the npm audit alert.

Package versions

• karma-viewport: 1.0.8
• karma: 6.3.17

System information

• OS: macOS / Linux 20.04
• Browser: Chromium

[squidfunk]

Thanks for reporting. I'm low on time, but I'm happy to collaborate on a PR if you want to help out. I can issue a new release after we upgraded the dependencies and fixed the vulnerabilities.

Edit: note that we need to make sure that the tests pass – they're currently commented out due to issues with Sauce Labs. Unit and integration tests should pass:

karma-viewport/package.json

Lines 39 to 40 in deb1a5f

	"test": "make test",
	"test:integration": "make test-integration",

[shirblc]

Yeah, sure, happy to help. I'll look at it now and hopefully PR later today.

Good to know about tests (was wondering about why they're commented out). I'll make sure the tests pass and I'll see if I can get it working without Sauce Labs (if that's okay). Was there a reason for choosing Sauce Labs? Not familiar with them so I don't know if there's an advantage to them or something special that they can do... Just wondering

[squidfunk]

Was there a reason for choosing Sauce Labs? Not familiar with them so I don't know if there's an advantage to them or something special that they can do... Just wondering

The reason to use SauceLabs (or BrowserStack) was to test on browsers that can't be run in headless mode like Internet Explorer 11, which karma-viewport actually supports. All browsers that are supported were listed in this configuration file. Since IE is history now, I'd say it's okay to replace SauceLabs with the headless strategy you implemented in #660.