package: use karma 0.12.28

This makes the following deprecation message go away:

  connect deprecated res.headerSent: use standard res.headersSent