@mojaloop/bulk-api-adapter 17.2.3 → 17.2.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.circleci/config.yml +1 -1
- package/.grype.yaml +91 -8
- package/.nvmrc +1 -1
- package/CHANGELOG.md +20 -0
- package/Dockerfile +12 -3
- package/audit-ci.jsonc +3 -0
- package/eslint.config.mjs +50 -0
- package/package.json +42 -24
- package/{sbom-v17.2.2.csv → sbom-v17.2.4.csv} +531 -528
- package/src/handlers/notification/index.js +30 -3
- package/src/handlers/register.js +1 -0
- package/src/lib/healthCheck/subServiceHealth.js +15 -3
- package/test/unit/api/handlers/bulkTransfers/{id}/error.test.js +1 -0
- package/test/unit/api/handlers/bulkTransfers/{id}.test.js +2 -0
- package/test/unit/handlers/notification/handler.test.js +2 -2
- package/test/unit/health.test.js +4 -4
- package/test/unit/lib/config.test.js +2 -2
package/.circleci/config.yml
CHANGED
package/.grype.yaml
CHANGED
|
@@ -1,17 +1,100 @@
|
|
|
1
1
|
disabled: false
|
|
2
|
-
|
|
3
2
|
ignore:
|
|
3
|
+
# --- Existing ignores ---
|
|
4
4
|
- vulnerability: GHSA-5j98-mcp5-4vw2
|
|
5
5
|
include-aliases: true
|
|
6
|
-
reason:
|
|
6
|
+
reason: >-
|
|
7
|
+
glob 10.4.5 is bundled in base image npm (/usr/local/lib/node_modules/npm/), not in application code. App uses
|
|
8
|
+
glob 10.5.0.
|
|
9
|
+
- vulnerability: CVE-2025-60876
|
|
10
|
+
include-aliases: true
|
|
11
|
+
reason: "Alpine base image package (apk): busybox - no npm fix available as of 2026-02-06 (moderate severity)"
|
|
7
12
|
|
|
8
|
-
#
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
13
|
+
# --- Base image npm packages (bundled in /usr/local/lib/node_modules/npm/) ---
|
|
14
|
+
- vulnerability: GHSA-34x7-hfp2-rc4v
|
|
15
|
+
include-aliases: true
|
|
16
|
+
reason: "Base image npm package: tar 6.2.1/7.4.3 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
17
|
+
- vulnerability: GHSA-8qq5-rm4j-mr97
|
|
18
|
+
include-aliases: true
|
|
19
|
+
reason: "Base image npm package: tar 6.2.1/7.4.3 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
20
|
+
- vulnerability: GHSA-r6q2-hw4h-h46w
|
|
21
|
+
include-aliases: true
|
|
22
|
+
reason: "Base image npm package: tar 6.2.1/7.4.3 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
23
|
+
- vulnerability: GHSA-73rr-hh4g-fpgx
|
|
24
|
+
include-aliases: true
|
|
25
|
+
reason: "Base image npm package: diff 5.2.0 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10 (low severity)"
|
|
26
|
+
- vulnerability: GHSA-3966-f6p6-2qr9
|
|
27
|
+
include-aliases: true
|
|
28
|
+
reason: "Base image npm package: npm 10.9.4 - bundled in Node.js base image, not fixable via application dependencies as of 2026-02-10"
|
|
29
|
+
- vulnerability: GHSA-g9mf-h72j-4rw9
|
|
30
|
+
include-aliases: true
|
|
31
|
+
reason: "Base image npm package: undici - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
32
|
+
- vulnerability: GHSA-xxjr-mmjv-4gpg
|
|
33
|
+
include-aliases: true
|
|
34
|
+
reason: "Base image npm package: lodash-es 4.17.21 - bundled in Node.js base image npm, not fixable via application dependencies as of 2026-02-10"
|
|
12
35
|
|
|
13
|
-
#
|
|
36
|
+
# --- Alpine base image packages (apk) - libcrypto3/libssl3 ---
|
|
37
|
+
- vulnerability: CVE-2025-15467
|
|
38
|
+
include-aliases: true
|
|
39
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (critical severity)"
|
|
40
|
+
- vulnerability: CVE-2025-69420
|
|
41
|
+
include-aliases: true
|
|
42
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (high severity)"
|
|
43
|
+
- vulnerability: CVE-2025-69421
|
|
44
|
+
include-aliases: true
|
|
45
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (high severity)"
|
|
46
|
+
- vulnerability: CVE-2025-69419
|
|
47
|
+
include-aliases: true
|
|
48
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (high severity)"
|
|
49
|
+
- vulnerability: CVE-2026-22796
|
|
50
|
+
include-aliases: true
|
|
51
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
52
|
+
- vulnerability: CVE-2025-66199
|
|
53
|
+
include-aliases: true
|
|
54
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
55
|
+
- vulnerability: CVE-2025-15468
|
|
56
|
+
include-aliases: true
|
|
57
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
58
|
+
- vulnerability: CVE-2026-22795
|
|
59
|
+
include-aliases: true
|
|
60
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
61
|
+
- vulnerability: CVE-2025-68160
|
|
62
|
+
include-aliases: true
|
|
63
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
64
|
+
- vulnerability: CVE-2025-11187
|
|
65
|
+
include-aliases: true
|
|
66
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
67
|
+
- vulnerability: CVE-2025-15469
|
|
68
|
+
include-aliases: true
|
|
69
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
70
|
+
- vulnerability: CVE-2025-69418
|
|
71
|
+
include-aliases: true
|
|
72
|
+
reason: "Alpine base image package (apk): libcrypto3/libssl3 - no npm fix available as of 2026-02-10 (medium severity)"
|
|
73
|
+
|
|
74
|
+
# --- Node.js binary vulnerabilities ---
|
|
75
|
+
- vulnerability: CVE-2025-55130
|
|
76
|
+
include-aliases: true
|
|
77
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (critical severity)"
|
|
78
|
+
- vulnerability: CVE-2025-59465
|
|
79
|
+
include-aliases: true
|
|
80
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (high severity)"
|
|
81
|
+
- vulnerability: CVE-2026-21637
|
|
82
|
+
include-aliases: true
|
|
83
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (high severity)"
|
|
84
|
+
- vulnerability: CVE-2025-55131
|
|
85
|
+
include-aliases: true
|
|
86
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (high severity)"
|
|
87
|
+
- vulnerability: CVE-2025-59466
|
|
88
|
+
include-aliases: true
|
|
89
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (high severity)"
|
|
90
|
+
- vulnerability: CVE-2025-55132
|
|
91
|
+
include-aliases: true
|
|
92
|
+
reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-10 (medium severity)"
|
|
93
|
+
|
|
94
|
+
output:
|
|
95
|
+
- table
|
|
96
|
+
- json
|
|
14
97
|
search:
|
|
15
|
-
scope:
|
|
98
|
+
scope: squashed
|
|
16
99
|
quiet: false
|
|
17
100
|
check-for-app-update: false
|
package/.nvmrc
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
22.
|
|
1
|
+
22.22.0
|
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,26 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
|
|
4
4
|
|
|
5
|
+
### [17.2.5](https://github.com/mojaloop/bulk-api-adapter/compare/v17.2.4...v17.2.5) (2026-02-19)
|
|
6
|
+
|
|
7
|
+
|
|
8
|
+
### Bug Fixes
|
|
9
|
+
|
|
10
|
+
* remove deprecared mongodb option ([#144](https://github.com/mojaloop/bulk-api-adapter/issues/144)) ([5d336d5](https://github.com/mojaloop/bulk-api-adapter/commit/5d336d5259f4ead8719db9884fdfaafdbda826a0))
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
### Chore
|
|
14
|
+
|
|
15
|
+
* **sbom:** update sbom [skip ci] ([f0a0d19](https://github.com/mojaloop/bulk-api-adapter/commit/f0a0d192490feecb99bb4e27a7c6836073545ad4))
|
|
16
|
+
|
|
17
|
+
### [17.2.4](https://github.com/mojaloop/bulk-api-adapter/compare/v17.2.3...v17.2.4) (2026-02-12)
|
|
18
|
+
|
|
19
|
+
|
|
20
|
+
### Chore
|
|
21
|
+
|
|
22
|
+
* **ci:** update CircleCI orb to 1.1.10 ([#142](https://github.com/mojaloop/bulk-api-adapter/issues/142)) ([f1cb17f](https://github.com/mojaloop/bulk-api-adapter/commit/f1cb17f9d3e12fd959ab1bbfb3ac35fd7723516a))
|
|
23
|
+
* **sbom:** update sbom [skip ci] ([20fda9b](https://github.com/mojaloop/bulk-api-adapter/commit/20fda9b327b40e890550a7f3a917ed46b041fed0))
|
|
24
|
+
|
|
5
25
|
### [17.2.3](https://github.com/mojaloop/bulk-api-adapter/compare/v17.2.2...v17.2.3) (2025-12-16)
|
|
6
26
|
|
|
7
27
|
|
package/Dockerfile
CHANGED
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
# Arguments
|
|
2
|
-
ARG NODE_VERSION=22.
|
|
3
|
-
|
|
2
|
+
ARG NODE_VERSION="22.22.0-alpine3.23"
|
|
4
3
|
# NOTE: Ensure you set NODE_VERSION Build Argument as follows...
|
|
5
4
|
#
|
|
6
5
|
# export NODE_VERSION="$(cat .nvmrc)-alpine" \
|
|
@@ -35,10 +34,20 @@ RUN ln -sf /dev/stdout ./logs/combined.log
|
|
|
35
34
|
|
|
36
35
|
# Create a non-root user: app-user
|
|
37
36
|
RUN adduser -D app-user
|
|
38
|
-
USER app-user
|
|
39
37
|
|
|
40
38
|
COPY --chown=app-user --from=builder /opt/app/ .
|
|
41
39
|
RUN npm prune --production
|
|
42
40
|
|
|
41
|
+
# Remove npm/npx from runtime image to eliminate npm's vulnerable tar - failing grype scan
|
|
42
|
+
USER root
|
|
43
|
+
RUN rm -rf /usr/local/lib/node_modules/npm \
|
|
44
|
+
/usr/local/bin/npm /usr/local/bin/npx
|
|
45
|
+
RUN rm -rf \
|
|
46
|
+
/opt/app/node_modules/@redocly/openapi-core/node_modules/minimatch \
|
|
47
|
+
/opt/app/node_modules/filelist/node_modules/minimatch
|
|
48
|
+
RUN node -e "require('./src/api/index.js'); console.log('startup ok')"
|
|
49
|
+
|
|
50
|
+
USER app-user
|
|
51
|
+
|
|
43
52
|
EXPOSE 3000
|
|
44
53
|
CMD ["node src/api/index.js"]
|
package/audit-ci.jsonc
CHANGED
|
@@ -1,8 +1,11 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
|
|
3
3
|
// audit-ci supports reading JSON, JSONC, and JSON5 config files.
|
|
4
|
+
// Only check production dependencies (devDependencies ignored)
|
|
5
|
+
"skip-dev": true,
|
|
4
6
|
// Only use one of ["low": true, "moderate": true, "high": true, "critical": true]
|
|
5
7
|
"moderate": true,
|
|
6
8
|
"allowlist": [ // NOTE: Please add as much information as possible to any items added to the allowList
|
|
9
|
+
"GHSA-3ppc-4f35-3m26"
|
|
7
10
|
]
|
|
8
11
|
}
|
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
import js from "@eslint/js"
|
|
2
|
+
import globals from "globals"
|
|
3
|
+
|
|
4
|
+
export default [
|
|
5
|
+
|
|
6
|
+
// Base JS recommended rules
|
|
7
|
+
js.configs.recommended,
|
|
8
|
+
|
|
9
|
+
// Application code
|
|
10
|
+
{
|
|
11
|
+
files: ["**/*.js"],
|
|
12
|
+
ignores: [
|
|
13
|
+
"node_modules/**",
|
|
14
|
+
"coverage/**",
|
|
15
|
+
"dist/**"
|
|
16
|
+
],
|
|
17
|
+
languageOptions: {
|
|
18
|
+
ecmaVersion: 2022,
|
|
19
|
+
sourceType: "commonjs",
|
|
20
|
+
globals: {
|
|
21
|
+
...globals.node
|
|
22
|
+
}
|
|
23
|
+
},
|
|
24
|
+
rules: {
|
|
25
|
+
// Common good defaults
|
|
26
|
+
"no-unused-vars": ["warn", { argsIgnorePattern: "^_" }],
|
|
27
|
+
"no-console": "off",
|
|
28
|
+
"no-undef": "error",
|
|
29
|
+
"no-var": "error",
|
|
30
|
+
"prefer-const": "warn"
|
|
31
|
+
}
|
|
32
|
+
},
|
|
33
|
+
|
|
34
|
+
// Jest test files
|
|
35
|
+
{
|
|
36
|
+
files: ["**/*.test.js", "**/test/**/*.js"],
|
|
37
|
+
plugins: {
|
|
38
|
+
// jest: jestPlugin
|
|
39
|
+
},
|
|
40
|
+
languageOptions: {
|
|
41
|
+
globals: {
|
|
42
|
+
...globals.node,
|
|
43
|
+
...globals.jest
|
|
44
|
+
}
|
|
45
|
+
},
|
|
46
|
+
rules: {
|
|
47
|
+
// ...jestPlugin.configs.recommended.rules
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
]
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mojaloop/bulk-api-adapter",
|
|
3
|
-
"version": "17.2.
|
|
3
|
+
"version": "17.2.5",
|
|
4
4
|
"description": "Mojaloop Bulk API Adapter",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "ModusBox",
|
|
@@ -36,10 +36,8 @@
|
|
|
36
36
|
"start:api": "node src/api/index.js",
|
|
37
37
|
"watch:api": "npx nodemon src/api/index.js",
|
|
38
38
|
"regenerate": "yo swaggerize:test --framework hapi --apiPath './src/interface/swagger.yaml'",
|
|
39
|
-
"
|
|
40
|
-
"
|
|
41
|
-
"lint": "npm run standard",
|
|
42
|
-
"lint:fix": "npm run standard:fix",
|
|
39
|
+
"lint": "eslint .",
|
|
40
|
+
"lint:fix": "eslint . --fix",
|
|
43
41
|
"test": "npm run test:unit",
|
|
44
42
|
"test:all": "npm run test",
|
|
45
43
|
"test:unit": "tape 'test/unit/**/*.test.js' | tap-spec",
|
|
@@ -67,22 +65,22 @@
|
|
|
67
65
|
"@hapi/catbox": "12.1.1",
|
|
68
66
|
"@hapi/catbox-memory": "6.0.2",
|
|
69
67
|
"@hapi/good": "9.0.1",
|
|
70
|
-
"@hapi/hapi": "21.4.
|
|
68
|
+
"@hapi/hapi": "21.4.5",
|
|
71
69
|
"@hapi/inert": "7.1.0",
|
|
72
70
|
"@hapi/vision": "7.0.3",
|
|
73
|
-
"@mojaloop/central-services-error-handling": "13.1.
|
|
74
|
-
"@mojaloop/central-services-health": "15.2.
|
|
75
|
-
"@mojaloop/central-services-logger": "11.10.
|
|
76
|
-
"@mojaloop/central-services-metrics": "12.8.
|
|
71
|
+
"@mojaloop/central-services-error-handling": "13.1.6",
|
|
72
|
+
"@mojaloop/central-services-health": "15.2.2",
|
|
73
|
+
"@mojaloop/central-services-logger": "11.10.4",
|
|
74
|
+
"@mojaloop/central-services-metrics": "12.8.5",
|
|
77
75
|
"@mojaloop/central-services-shared": "^18.26.2",
|
|
78
|
-
"@mojaloop/central-services-stream": "11.
|
|
79
|
-
"@mojaloop/event-sdk": "14.8.
|
|
80
|
-
"@mojaloop/object-store-lib": "12.2.
|
|
81
|
-
"@mojaloop/sdk-standard-components": "19.18.
|
|
76
|
+
"@mojaloop/central-services-stream": "11.9.1",
|
|
77
|
+
"@mojaloop/event-sdk": "14.8.3",
|
|
78
|
+
"@mojaloop/object-store-lib": "12.2.3",
|
|
79
|
+
"@mojaloop/sdk-standard-components": "19.18.7",
|
|
82
80
|
"@now-ims/hapi-now-auth": "2.1.0",
|
|
83
|
-
"axios": "1.13.
|
|
81
|
+
"axios": "1.13.5",
|
|
84
82
|
"blipp": "4.0.2",
|
|
85
|
-
"commander": "14.0.
|
|
83
|
+
"commander": "14.0.3",
|
|
86
84
|
"hapi-auth-bearer-token": "8.0.0",
|
|
87
85
|
"hapi-openapi": "3.0.0",
|
|
88
86
|
"hapi-swagger": "17.3.2",
|
|
@@ -95,6 +93,16 @@
|
|
|
95
93
|
"uuid4": "2.0.3"
|
|
96
94
|
},
|
|
97
95
|
"overrides": {
|
|
96
|
+
"ajv": "8.18.0",
|
|
97
|
+
"eslint": {
|
|
98
|
+
"ajv": "6.12.6"
|
|
99
|
+
},
|
|
100
|
+
"eslint@9.39.2": {
|
|
101
|
+
"ajv": "6.12.6"
|
|
102
|
+
},
|
|
103
|
+
"@eslint/eslintrc": {
|
|
104
|
+
"ajv": "6.12.6"
|
|
105
|
+
},
|
|
98
106
|
"form-data": "4.0.4",
|
|
99
107
|
"on-headers": "1.1.0",
|
|
100
108
|
"brace-expansion": "2.0.2",
|
|
@@ -105,13 +113,14 @@
|
|
|
105
113
|
"swagmock": {
|
|
106
114
|
"validator": "13.15.22"
|
|
107
115
|
},
|
|
116
|
+
"ejs": "3.1.10",
|
|
108
117
|
"shins": {
|
|
109
|
-
"ajv": "
|
|
110
|
-
"ejs": "3.1.10",
|
|
118
|
+
"ajv": "8.18.0",
|
|
111
119
|
"path-to-regexp": "0.1.12",
|
|
112
120
|
"sanitize-html": "2.12.1",
|
|
113
121
|
"markdown-it": "12.3.2",
|
|
114
|
-
"undici": "6.
|
|
122
|
+
"undici": "6.23.0",
|
|
123
|
+
"ejs": "3.1.10"
|
|
115
124
|
},
|
|
116
125
|
"widdershins": {
|
|
117
126
|
"swagger2openapi": "7.0.8",
|
|
@@ -127,19 +136,28 @@
|
|
|
127
136
|
"yargs-parser": "21.1.1",
|
|
128
137
|
"validator": "13.15.22",
|
|
129
138
|
"js-yaml": "3.14.2",
|
|
130
|
-
"jws": "4.0.1"
|
|
139
|
+
"jws": "4.0.1",
|
|
140
|
+
"fast-xml-parser": "5.3.6",
|
|
141
|
+
"qs": "6.14.1",
|
|
142
|
+
"undici": "6.23.0",
|
|
143
|
+
"axios": "1.13.5",
|
|
144
|
+
"lodash": "4.17.23",
|
|
145
|
+
"lodash-es": "4.17.23",
|
|
146
|
+
"diff": "8.0.3"
|
|
131
147
|
},
|
|
132
148
|
"devDependencies": {
|
|
133
|
-
"
|
|
149
|
+
"@eslint/js": "10.0.1",
|
|
150
|
+
"audit-ci": "7.1.0",
|
|
151
|
+
"eslint": "10.0.0",
|
|
152
|
+
"globals": "17.3.0",
|
|
134
153
|
"nodemon": "3.1.11",
|
|
135
|
-
"npm-check-updates": "19.
|
|
154
|
+
"npm-check-updates": "19.4.0",
|
|
136
155
|
"nyc": "17.1.0",
|
|
137
156
|
"pre-commit": "1.2.2",
|
|
138
157
|
"proxyquire": "2.1.3",
|
|
139
158
|
"replace": "^1.2.2",
|
|
140
159
|
"rewire": "9.0.1",
|
|
141
|
-
"sinon": "21.0.
|
|
142
|
-
"standard": "17.1.2",
|
|
160
|
+
"sinon": "21.0.1",
|
|
143
161
|
"standard-version": "^9.5.0",
|
|
144
162
|
"swagmock": "1.0.0",
|
|
145
163
|
"tap-spec": "^5.0.0",
|