@mojaloop/bulk-api-adapter 17.2.3 → 17.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.circleci/config.yml +1 -1
- package/.grype.yaml +91 -8
- package/CHANGELOG.md +8 -0
- package/Dockerfile +1 -2
- package/package.json +17 -10
- package/{sbom-v17.2.2.csv → sbom-v17.2.3.csv} +509 -486
- package/src/handlers/notification/index.js +28 -1
- package/src/lib/healthCheck/subServiceHealth.js +14 -3
- package/test/unit/health.test.js +4 -4
package/.circleci/config.yml
CHANGED
package/.grype.yaml
CHANGED
|
@@ -1,17 +1,100 @@
|
|
|
1
1
|
disabled: false
|
|
2
|
-
|
|
3
2
|
ignore:
|
|
3
|
+
# --- Existing ignores ---
|
|
4
4
|
- vulnerability: GHSA-5j98-mcp5-4vw2
|
|
5
5
|
include-aliases: true
|
|
6
|
-
reason:
|
|
6
|
+
reason: >-
|
|
7
|
+
glob 10.4.5 is bundled in base image npm (/usr/local/lib/node_modules/npm/), not in application code. App uses
|
|
8
|
+
glob 10.5.0.
|
|
9
|
+
- vulnerability: CVE-2025-60876
|
|
10
|
+
include-aliases: true
|
|
11
|
+
reason: "Alpine base image package (apk): busybox - no npm fix available as of 2026-02-06 (moderate severity)"
|
|
7
12
|
|
|
8
|
-
#
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
13
|
+
# --- Base image npm packages (bundled in /usr/local/lib/node_modules/npm/) ---
|
|
14
|
+
- vulnerability: GHSA-34x7-hfp2-rc4v
|
|
15
|
+
include-aliases: true
|
|
16
|
+
reason: "Base image npm package: tar 6.2.1/7.4.3 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
17
|
+
- vulnerability: GHSA-8qq5-rm4j-mr97
|
|
18
|
+
include-aliases: true
|
|
19
|
+
reason: "Base image npm package: tar 6.2.1/7.4.3 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
20
|
+
- vulnerability: GHSA-r6q2-hw4h-h46w
|
|
21
|
+
include-aliases: true
|
|
22
|
+
reason: "Base image npm package: tar 6.2.1/7.4.3 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
23
|
+
- vulnerability: GHSA-73rr-hh4g-fpgx
|
|
24
|
+
include-aliases: true
|
|
25
|
+
reason: "Base image npm package: diff 5.2.0 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10 (low severity)"
|
|
26
|
+
- vulnerability: GHSA-3966-f6p6-2qr9
|
|
27
|
+
include-aliases: true
|
|
28
|
+
reason: "Base image npm package: npm 10.9.4 - bundled in Node.js base image, not fixable via application dependencies as of 2026-02-10"
|
|
29
|
+
- vulnerability: GHSA-g9mf-h72j-4rw9
|
|
30
|
+
include-aliases: true
|
|
31
|
+
reason: "Base image npm package: undici - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
32
|
+
- vulnerability: GHSA-xxjr-mmjv-4gpg
|
|
33
|
+
include-aliases: true
|
|
34
|
+
reason: "Base image npm package: lodash-es 4.17.21 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
12
35
|
|
|
13
|
-
#
|
|
36
|
+
# --- Alpine base image packages (apk) - libcrypto3/libssl3 ---
|
|
37
|
+
- vulnerability: CVE-2025-15467
|
|
38
|
+
include-aliases: true
|
|
39
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (critical severity)"
|
|
40
|
+
- vulnerability: CVE-2025-69420
|
|
41
|
+
include-aliases: true
|
|
42
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (high severity)"
|
|
43
|
+
- vulnerability: CVE-2025-69421
|
|
44
|
+
include-aliases: true
|
|
45
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (high severity)"
|
|
46
|
+
- vulnerability: CVE-2025-69419
|
|
47
|
+
include-aliases: true
|
|
48
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (high severity)"
|
|
49
|
+
- vulnerability: CVE-2026-22796
|
|
50
|
+
include-aliases: true
|
|
51
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
52
|
+
- vulnerability: CVE-2025-66199
|
|
53
|
+
include-aliases: true
|
|
54
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
55
|
+
- vulnerability: CVE-2025-15468
|
|
56
|
+
include-aliases: true
|
|
57
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
58
|
+
- vulnerability: CVE-2026-22795
|
|
59
|
+
include-aliases: true
|
|
60
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
61
|
+
- vulnerability: CVE-2025-68160
|
|
62
|
+
include-aliases: true
|
|
63
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
64
|
+
- vulnerability: CVE-2025-11187
|
|
65
|
+
include-aliases: true
|
|
66
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
67
|
+
- vulnerability: CVE-2025-15469
|
|
68
|
+
include-aliases: true
|
|
69
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
70
|
+
- vulnerability: CVE-2025-69418
|
|
71
|
+
include-aliases: true
|
|
72
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
73
|
+
|
|
74
|
+
# --- Node.js binary vulnerabilities ---
|
|
75
|
+
- vulnerability: CVE-2025-55130
|
|
76
|
+
include-aliases: true
|
|
77
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (critical severity)"
|
|
78
|
+
- vulnerability: CVE-2025-59465
|
|
79
|
+
include-aliases: true
|
|
80
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (high severity)"
|
|
81
|
+
- vulnerability: CVE-2026-21637
|
|
82
|
+
include-aliases: true
|
|
83
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (high severity)"
|
|
84
|
+
- vulnerability: CVE-2025-55131
|
|
85
|
+
include-aliases: true
|
|
86
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (high severity)"
|
|
87
|
+
- vulnerability: CVE-2025-59466
|
|
88
|
+
include-aliases: true
|
|
89
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (high severity)"
|
|
90
|
+
- vulnerability: CVE-2025-55132
|
|
91
|
+
include-aliases: true
|
|
92
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (medium severity)"
|
|
93
|
+
|
|
94
|
+
output:
|
|
95
|
+
- table
|
|
96
|
+
- json
|
|
14
97
|
search:
|
|
15
|
-
scope:
|
|
98
|
+
scope: squashed
|
|
16
99
|
quiet: false
|
|
17
100
|
check-for-app-update: false
|
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,14 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
|
|
4
4
|
|
|
5
|
+
### [17.2.4](https://github.com/mojaloop/bulk-api-adapter/compare/v17.2.3...v17.2.4) (2026-02-12)
|
|
6
|
+
|
|
7
|
+
|
|
8
|
+
### Chore
|
|
9
|
+
|
|
10
|
+
* **ci:** update CircleCI orb to 1.1.10 ([#142](https://github.com/mojaloop/bulk-api-adapter/issues/142)) ([f1cb17f](https://github.com/mojaloop/bulk-api-adapter/commit/f1cb17f9d3e12fd959ab1bbfb3ac35fd7723516a))
|
|
11
|
+
* **sbom:** update sbom [skip ci] ([20fda9b](https://github.com/mojaloop/bulk-api-adapter/commit/20fda9b327b40e890550a7f3a917ed46b041fed0))
|
|
12
|
+
|
|
5
13
|
### [17.2.3](https://github.com/mojaloop/bulk-api-adapter/compare/v17.2.2...v17.2.3) (2025-12-16)
|
|
6
14
|
|
|
7
15
|
|
package/Dockerfile
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mojaloop/bulk-api-adapter",
|
|
3
|
-
"version": "17.2.
|
|
3
|
+
"version": "17.2.4",
|
|
4
4
|
"description": "Mojaloop Bulk API Adapter",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "ModusBox",
|
|
@@ -72,17 +72,17 @@
|
|
|
72
72
|
"@hapi/vision": "7.0.3",
|
|
73
73
|
"@mojaloop/central-services-error-handling": "13.1.5",
|
|
74
74
|
"@mojaloop/central-services-health": "15.2.1",
|
|
75
|
-
"@mojaloop/central-services-logger": "11.10.
|
|
75
|
+
"@mojaloop/central-services-logger": "11.10.3",
|
|
76
76
|
"@mojaloop/central-services-metrics": "12.8.3",
|
|
77
77
|
"@mojaloop/central-services-shared": "^18.26.2",
|
|
78
|
-
"@mojaloop/central-services-stream": "11.
|
|
78
|
+
"@mojaloop/central-services-stream": "11.9.0",
|
|
79
79
|
"@mojaloop/event-sdk": "14.8.2",
|
|
80
80
|
"@mojaloop/object-store-lib": "12.2.2",
|
|
81
|
-
"@mojaloop/sdk-standard-components": "19.18.
|
|
81
|
+
"@mojaloop/sdk-standard-components": "19.18.7",
|
|
82
82
|
"@now-ims/hapi-now-auth": "2.1.0",
|
|
83
|
-
"axios": "1.13.
|
|
83
|
+
"axios": "1.13.5",
|
|
84
84
|
"blipp": "4.0.2",
|
|
85
|
-
"commander": "14.0.
|
|
85
|
+
"commander": "14.0.3",
|
|
86
86
|
"hapi-auth-bearer-token": "8.0.0",
|
|
87
87
|
"hapi-openapi": "3.0.0",
|
|
88
88
|
"hapi-swagger": "17.3.2",
|
|
@@ -111,7 +111,7 @@
|
|
|
111
111
|
"path-to-regexp": "0.1.12",
|
|
112
112
|
"sanitize-html": "2.12.1",
|
|
113
113
|
"markdown-it": "12.3.2",
|
|
114
|
-
"undici": "6.
|
|
114
|
+
"undici": "6.23.0"
|
|
115
115
|
},
|
|
116
116
|
"widdershins": {
|
|
117
117
|
"swagger2openapi": "7.0.8",
|
|
@@ -127,18 +127,25 @@
|
|
|
127
127
|
"yargs-parser": "21.1.1",
|
|
128
128
|
"validator": "13.15.22",
|
|
129
129
|
"js-yaml": "3.14.2",
|
|
130
|
-
"jws": "4.0.1"
|
|
130
|
+
"jws": "4.0.1",
|
|
131
|
+
"fast-xml-parser": "5.3.4",
|
|
132
|
+
"qs": "6.14.1",
|
|
133
|
+
"undici": "6.23.0",
|
|
134
|
+
"axios": "1.13.5",
|
|
135
|
+
"lodash": "4.17.23",
|
|
136
|
+
"lodash-es": "4.17.23",
|
|
137
|
+
"diff": "8.0.3"
|
|
131
138
|
},
|
|
132
139
|
"devDependencies": {
|
|
133
140
|
"audit-ci": "^7.1.0",
|
|
134
141
|
"nodemon": "3.1.11",
|
|
135
|
-
"npm-check-updates": "19.2
|
|
142
|
+
"npm-check-updates": "19.3.2",
|
|
136
143
|
"nyc": "17.1.0",
|
|
137
144
|
"pre-commit": "1.2.2",
|
|
138
145
|
"proxyquire": "2.1.3",
|
|
139
146
|
"replace": "^1.2.2",
|
|
140
147
|
"rewire": "9.0.1",
|
|
141
|
-
"sinon": "21.0.
|
|
148
|
+
"sinon": "21.0.1",
|
|
142
149
|
"standard": "17.1.2",
|
|
143
150
|
"standard-version": "^9.5.0",
|
|
144
151
|
"swagmock": "1.0.0",
|