chore(STRINGS-2449): upgrade karma to 6.4.4

[anthonyshchang]

Purpose

• Resolve security issue related to socket-io.
• Resolve lint errors
• Simplify test workflow

Vulnerability

Due to improper type validation in the socket.io-parser library (which is used by the socket.io and socket.io-client packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

https://github.com/phrase/angular-phrase/security/dependabot/33
https://github.com/phrase/angular-phrase/security/dependabot/22

Ticket

https://phrase.atlassian.net/browse/STRINGS-2449

[anthonyshchang]

Resolves:

1. https://github.com/phrase/angular-phrase/security/dependabot/33
2. https://github.com/phrase/angular-phrase/security/dependabot/22

[Copilot]

Pull Request Overview

Upgrades Karma to 6.4.4 to resolve a Socket.IO parser security issue, adds a dedicated CI test script, and refactors the Karma configuration for headless and CI environments.

• Bump Karma to version 6.4.4 and add @types/node
• Introduce test:ci script and update GitHub Actions to use it
• Refactor karma.conf.js for headless browsers, middleware stats, and CI flag handling

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

File	Description
package.json	Updated test scripts, bumped karma, and added @types/node
karma.conf.js	Switched to headless browsers, added webpackMiddleware, and CI flag logic
.github/workflows/main.yml	Switched CI job to npm run test:ci

Comments suppressed due to low confidence (1)

package.json:10

• The default npm test script now omits --single-run, causing Karma to stay in watch mode and never exit. Consider restoring --single-run here or documenting its behavior change to avoid hanging processes.

"test": "npm run lint && karma start",

[Copilot]

[nitpick] Dev dependencies are no longer sorted alphabetically; sorting them helps maintain readability and makes diffs clearer when new entries are added.

[Copilot]

[nitpick] Since ChromeHeadless and FirefoxHeadless do not require an X server, you may be able to remove xvfb-run and the DISPLAY export to simplify the CI job and speed up test startup.