.github/workflows/release.yml

@@ -0,0 +1,35 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  main:
+    name: Test, Tag Commit and Release to NPM
+    runs-on: ubuntu-latest
+    env:
+      BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
+      BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
+      SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
+      SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.KARMARUNNERBOT_GITHUB_TOKEN }}
+      KARMA_TEST_NO_FALLBACK: 1
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          token: ${{ env.GITHUB_TOKEN }}
+      - uses: actions/setup-node@v2
+        with:
+          node-version: 14
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run build:check
+      - run: npm run test:unit
+      - run: npm run test:e2e
+      - run: npm run test:client
+      - run: npm run test:integration
+      - run: npm run semantic-release

.github/workflows/test.yml

@@ -0,0 +1,64 @@
+name: Test
+
+on:
+  push:
+    branches-ignore:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  main:
+    name: Lint and Unit (Client and Server), E2E and Integration Test
+    runs-on: ubuntu-latest
+    env:
+      BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
+      BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
+      SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
+      SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v2
+        with:
+          node-version: 14
+          cache: npm
+      - run: npm ci
+      - run: npm run commitlint -- --from `git merge-base origin/master $GITHUB_SHA`
+      - run: npm run lint
+      - run: npm run build:check
+      - run: npm run test:unit
+      - run: npm run test:e2e
+      - run: npm run test:client
+      - run: npm run test:integration
+  linux:
+    name: "Node ${{ matrix.node }} on Linux: Server Unit and E2E Test"
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: [ 10, 12 ]
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run test:unit
+      - run: npm run test:e2e
+  windows:
+    name: "Node ${{ matrix.node }} on Windows: Server Unit and Client Unit Test"
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        node: [10, 12, 14]
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run test:unit

CHANGELOG.md

@@ -1,3 +1,82 @@
+## [6.3.14](https://github.com/karma-runner/karma/compare/v6.3.13...v6.3.14) (2022-02-05)
+
+
+### Bug Fixes
+
+* remove string template from client code ([91d5acd](https://github.com/karma-runner/karma/commit/91d5acda6325caf91685da465d688527bd412b47))
+* warn when `singleRun` and `autoWatch` are `false` ([69cfc76](https://github.com/karma-runner/karma/commit/69cfc763c8f83e8e7e64d34e17829d0d3dcc0449))
+* **security:** remove XSS vulnerability in `returnUrl` query param ([839578c](https://github.com/karma-runner/karma/commit/839578c45a8ac42fbc1d72105f97eab77dd3eb8a))
+
+## [6.3.13](https://github.com/karma-runner/karma/compare/v6.3.12...v6.3.13) (2022-01-31)
+
+
+### Bug Fixes
+
+* **deps:** bump log4js to resolve security issue ([5bf2df3](https://github.com/karma-runner/karma/commit/5bf2df304453c8f71ebc725653fd174ddb1dd28b)), closes [#3751](https://github.com/karma-runner/karma/issues/3751)
+
+## [6.3.12](https://github.com/karma-runner/karma/compare/v6.3.11...v6.3.12) (2022-01-24)
+
+
+### Bug Fixes
+
+* remove depreciation warning from log4js ([41bed33](https://github.com/karma-runner/karma/commit/41bed33bf4b88c7e0787ca3a5ec15f2913b936fd))
+
+## [6.3.11](https://github.com/karma-runner/karma/compare/v6.3.10...v6.3.11) (2022-01-13)
+
+
+### Bug Fixes
+
+* **deps:** pin colors package to 1.4.0 due to security vulnerability ([a5219c5](https://github.com/karma-runner/karma/commit/a5219c52e2515248eefae4fe1863ac8ad3fdd43b))
+
+## [6.3.10](https://github.com/karma-runner/karma/compare/v6.3.9...v6.3.10) (2022-01-08)
+
+
+### Bug Fixes
+
+* **logger:** create parent folders if they are missing ([0d24bd9](https://github.com/karma-runner/karma/commit/0d24bd937f7089d1456e2ecf04419d2c268c3144)), closes [#3734](https://github.com/karma-runner/karma/issues/3734)
+
+## [6.3.9](https://github.com/karma-runner/karma/compare/v6.3.8...v6.3.9) (2021-11-16)
+
+
+### Bug Fixes
+
+* restartOnFileChange option not restarting the test run ([92ffe60](https://github.com/karma-runner/karma/commit/92ffe6018451f6144e8bc7726d304057b5ac9d0a)), closes [#27](https://github.com/karma-runner/karma/issues/27) [#3724](https://github.com/karma-runner/karma/issues/3724)
+
+## [6.3.8](https://github.com/karma-runner/karma/compare/v6.3.7...v6.3.8) (2021-11-07)
+
+
+### Bug Fixes
+
+* **reporter:** warning if stack trace contains generated code invocation ([4f23b14](https://github.com/karma-runner/karma/commit/4f23b14d3e774c0401f2c9eecb188b37aed020eb))
+
+## [6.3.7](https://github.com/karma-runner/karma/compare/v6.3.6...v6.3.7) (2021-11-01)
+
+
+### Bug Fixes
+
+* **middleware:** replace %X_UA_COMPATIBLE% marker anywhere in the file ([f1aeaec](https://github.com/karma-runner/karma/commit/f1aeaec09e49856747b8f650d06b4dcc61eb637e)), closes [#3711](https://github.com/karma-runner/karma/issues/3711)
+
+## [6.3.6](https://github.com/karma-runner/karma/compare/v6.3.5...v6.3.6) (2021-10-25)
+
+
+### Bug Fixes
+
+* bump vulnerable ua-parser-js version ([6f2b2ec](https://github.com/karma-runner/karma/commit/6f2b2ec6ed0218980eabf2cbf44e0c8f16fee661)), closes [#3713](https://github.com/karma-runner/karma/issues/3713)
+
+## [6.3.5](https://github.com/karma-runner/karma/compare/v6.3.4...v6.3.5) (2021-10-20)
+
+
+### Bug Fixes
+
+* **client:** prevent socket.io from hanging due to mocked clocks ([#3695](https://github.com/karma-runner/karma/issues/3695)) ([105da90](https://github.com/karma-runner/karma/commit/105da90a9975c1050f96cda966bd30a3c677494e))
+
+## [6.3.4](https://github.com/karma-runner/karma/compare/v6.3.3...v6.3.4) (2021-06-14)
+
+
+### Bug Fixes
+
+* bump production dependencies within SemVer ranges ([#3682](https://github.com/karma-runner/karma/issues/3682)) ([36467a8](https://github.com/karma-runner/karma/commit/36467a8ac357108343dde4131ef34099004711e5)), closes [#3680](https://github.com/karma-runner/karma/issues/3680)
+
 ## [6.3.3](https://github.com/karma-runner/karma/compare/v6.3.2...v6.3.3) (2021-06-01)
 
 

README.md

@@ -1,7 +1,7 @@
 # Karma
 [![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat-square)](https://github.com/karma-runner/karma) [![npm version](https://img.shields.io/npm/v/karma.svg?style=flat-square)](https://www.npmjs.com/package/karma) [![npm downloads](https://img.shields.io/npm/dm/karma.svg?style=flat-square)](https://npmcharts.com/compare/karma?minimal=true)
 
-[![Build Status](https://img.shields.io/travis/karma-runner/karma/master.svg?style=flat-square)](https://travis-ci.org/karma-runner/karma) [![Build Status](https://img.shields.io/appveyor/ci/dignifiedquire/karma/master.svg?style=flat-square)](https://ci.appveyor.com/project/dignifiedquire/karma) [![Code Climate](https://img.shields.io/codeclimate/github/karma-runner/karma.svg?style=flat-square)](https://codeclimate.com/github/karma-runner/karma) [![PRs Welcome](https://img.shields.io/badge/prs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com/) [![Dependency Status](https://img.shields.io/david/karma-runner/karma.svg?style=flat-square)](https://david-dm.org/karma-runner/karma) [![devDependency Status](https://img.shields.io/david/dev/karma-runner/karma.svg?style=flat-square)](https://david-dm.org/karma-runner/karma#info=devDependencies) [![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
+ [![Code Climate](https://img.shields.io/codeclimate/github/karma-runner/karma.svg?style=flat-square)](https://codeclimate.com/github/karma-runner/karma) [![PRs Welcome](https://img.shields.io/badge/prs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com/) [![Dependency Status](https://img.shields.io/david/karma-runner/karma.svg?style=flat-square)](https://david-dm.org/karma-runner/karma) [![devDependency Status](https://img.shields.io/david/dev/karma-runner/karma.svg?style=flat-square)](https://david-dm.org/karma-runner/karma#info=devDependencies) [![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
 
 A simple tool that allows you to execute JavaScript code in multiple
 _real_ browsers.

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest version of the project are currently being supported with security updates.
+
+## Reporting a Vulnerability
+
+To report a security issue, please email karma-runner-eng+security@google.com
+with a description of the issue, the steps you took to create the issue,
+affected versions, and if known, mitigations for the issue.

client/karma.js

@@ -232,20 +232,23 @@ function Karma (updater, socket, iframe, opener, navigator, location, document)
       resultsBuffer = []
     }
 
-    // A test could have incorrectly issued a navigate. Wait one turn
-    // to ensure the error from an incorrect navigate is processed.
-    var config = this.config
-    setTimeout(function () {
-      socket.emit('complete', result || {})
-      if (config.clearContext) {
-        navigateContextTo('about:blank')
-      } else {
-        self.updater.updateTestStatus('complete')
-      }
-      if (returnUrl) {
-        location.href = returnUrl
+    socket.emit('complete', result || {})
+    if (this.config.clearContext) {
+      navigateContextTo('about:blank')
+    } else {
+      self.updater.updateTestStatus('complete')
+    }
+    if (returnUrl) {
+      if (!/^https?:\/\//.test(returnUrl)) {
+        throw new Error(
+          'Security: Navigation to '.concat(
+            returnUrl,
+            ' was blocked to prevent malicious exploits.'
+          )
+        )
       }
-    })
+      location.href = returnUrl
+    }
   }
 
   this.info = function (info) {

client/main.js

@@ -16,7 +16,8 @@ var socket = io(location.host, {
   reconnectionDelayMax: Infinity,
   timeout: BROWSER_SOCKET_TIMEOUT,
   path: KARMA_PROXY_PATH + KARMA_URL_ROOT.substr(1) + 'socket.io',
-  'sync disconnect on unload': true
+  'sync disconnect on unload': true,
+  useNativeTimers: true
 })
 
 // instantiate the updater of the view

commitlint.config.js

@@ -1 +1 @@
-module.exports = { extends: ['@commitlint/config-conventional'] }
+module.exports = { extends: ['@commitlint/config-angular'] }

docs/config/01-configuration-file.md

@@ -853,11 +853,11 @@ When running a browser in different environments, it can take different amounts
 client socket to connect. If Karma cannot connect within the default timeout, you may see an
 error similar to the following:
 ```
-ChromeHeadless have not captured in 60000ms, killing.
+ChromeHeadless has not captured in 60000ms, killing.
 Trying to start ChromeHeadless again (1/2).
-ChromeHeadless have not captured in 60000ms, killing.
+ChromeHeadless has not captured in 60000ms, killing.
 Trying to start ChromeHeadless again (2/2).
-ChromeHeadless have not captured in 60000ms, killing.
+ChromeHeadless has not captured in 60000ms, killing.
 ChromeHeadless failed 2 times(timeout). Giving up.
 ```
 If you see this error, you can try increasing the socket connection timeout.

docs/dev/02-making-changes.md

@@ -2,14 +2,13 @@
 TODO:
 - add more info about updating PR
   - rebasing/squashing changes
-  - making sure Travis is green
+  - making sure CI is green
 - how to run tests on sauce labs
 - how to set up plugins
 -->
 
 If you are thinking about making Karma better, or you just want to hack on it, that’s great!
 Here are some tips on how to set up a Karma workspace and how to send a good pull request.
-**Please note we enforce [commit message conventions].**
 
 ## Setting up the Workspace
 
@@ -66,11 +65,15 @@ change the code, run the tests, etc.
 
 ## Sending a Pull Request
 
-- Commit your changes (**please follow our [commit message conventions]**):
+- Commit your changes (please follow [commit message conventions]):
   ```bash
   $ git commit -m "..."
   ```
-- Push to your github repo:
+- Verify that the last commit follows the conventions:
+  ```bash
+  $ npm run commit:check
+  ```
+- Push to your GitHub repo:
   ```bash
   $ git push origin <branch_name>
   ```

docs/dev/03-maintaining.md

@@ -21,7 +21,7 @@ An issue or pull request is untriaged (needs to be triaged) when it is not assig
 
 ## Merging a pull request
 Please, make sure:
-- Travis build is green.
+- CI build is green.
 - At least one owner (other than you) approved the PR
   - by commenting “LGTM” or something like that.
   - if it’s just a simple docs change or a typo fix, feel free to skip this step.