@mojaloop/central-ledger 20.0.0-snapshot.0 → 20.1.1

package/.grype.yaml

@@ -0,0 +1,97 @@
+scan-type: source
+ignore:
+  - vulnerability: GHSA-3ppc-4f35-3m26
+    reason: minimatch upgrade breaks some dev tools so adding this to ignore list
+  - vulnerability: CVE-2025-60876
+    reason: No fix available as of 1.37.0-r30
+  - vulnerability: GHSA-83g3-92jg-28cx
+    include-aliases: true
+  - vulnerability: GHSA-34x7-hfp2-rc4v
+    include-aliases: true
+  - vulnerability: GHSA-5j98-mcp5-4vw2
+    include-aliases: true
+  - vulnerability: GHSA-8qq5-rm4j-mr97
+    include-aliases: true
+  - vulnerability: GHSA-r6q2-hw4h-h46w
+    include-aliases: true
+  - vulnerability: CVE-2025-15467
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (critical severity)"
+  - vulnerability: CVE-2025-69420
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (high severity)"
+  - vulnerability: CVE-2025-59465
+    include-aliases: true
+    reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-23 (high severity)"
+  - vulnerability: CVE-2025-69421
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (high severity)"
+  - vulnerability: CVE-2025-69419
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (high severity)"
+  - vulnerability: CVE-2026-22796
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (moderate severity)"
+  - vulnerability: CVE-2025-66199
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (moderate severity)"
+  - vulnerability: CVE-2025-15468
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (moderate severity)"
+  - vulnerability: CVE-2026-21637
+    include-aliases: true
+    reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-23 (high severity)"
+  - vulnerability: CVE-2025-55131
+    include-aliases: true
+    reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-23 (high severity)"
+  - vulnerability: CVE-2025-59466
+    include-aliases: true
+    reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-23 (high severity)"
+  - vulnerability: CVE-2025-55130
+    include-aliases: true
+    reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-23 (critical severity)"
+  - vulnerability: CVE-2026-22795
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (moderate severity)"
+  - vulnerability: CVE-2025-68160
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (moderate severity)"
+  - vulnerability: CVE-2025-11187
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (moderate severity)"
+  - vulnerability: GHSA-73rr-hh4g-fpgx
+    include-aliases: true
+    reason: >-
+      Base image npm package: diff - bundled in Node.js base image, not fixable via application dependencies as of
+      2026-02-23 (low severity)
+  - vulnerability: CVE-2025-55132
+    include-aliases: true
+    reason: "Node.js binary vulnerability: node - requires Node.js runtime update as of 2026-02-23 (moderate severity)"
+  - vulnerability: CVE-2026-27171
+    include-aliases: true
+    reason: "Alpine base image package (apk): zlib - no npm fix available as of 2026-02-23 (moderate severity)"
+  - vulnerability: CVE-2025-15469
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (moderate severity)"
+  - vulnerability: CVE-2025-69418
+    include-aliases: true
+    reason: "Alpine base image package (apk): libcrypto3 - no npm fix available as of 2026-02-23 (moderate severity)"
+  - vulnerability: GHSA-87r5-mp6g-5w5j
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: jsonpath (high severity) as of 2026-02-23"
+  - vulnerability: GHSA-378v-28hj-76wf
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: bn.js (moderate severity) as of 2026-02-23"
+  - vulnerability: GHSA-2g4f-4pwh-qvx6
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: ajv (moderate severity) as of 2026-02-23"
+  - vulnerability: GHSA-rpr9-rxv7-x643
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: sanitize-html (critical severity) as of 2026-05-18"
+output:
+  - table
+  - json
+search:
+  scope: squashed
+quiet: false
+check-for-app-update: false

package/.license-scanner.json

@@ -0,0 +1,16 @@
+{
+  "exceptions": {
+    "markdown-it-attrs@1.2.1": {
+      "reason": "MIT per https://www.npmjs.com/package/markdown-it-attrs#license; empty license field in package.json.",
+      "expires": "2027-01-01"
+    },
+    "pause-stream@0.0.11": {
+      "reason": "MIT/Apache 2.0 per https://github.com/dominictarr/pause-stream/blob/master/LICENSE.",
+      "expires": "2027-01-01"
+    },
+    "fsevents@2.3.3": {
+      "reason": "MIT per https://github.com/fsevents/fsevents/blob/master/LICENSE.",
+      "expires": "2027-01-01"
+    }
+  }
+}

package/.ncurc.yaml

@@ -1,15 +1,23 @@
-## Add a TODO comment indicating the reason for each rejected dependency upgrade added to this list, and what should be done to resolve it (i.e. handle it through a story, etc).
+## Add a comment indicating the reason for each rejected dependency upgrade added to this list.
 reject: [
-  # Tests fail when tape is upgraded.
-  # Issue is tracked here: https://github.com/mojaloop/project/issues/3616
+  # central-services-shared 18.38.x ships two behavioural regressions in a minor release, both
+  # reproduced here on 2026-08-19: (1) Util.omitNil/mergeAndOmitNil were de-lodashed and the
+  # replacement filters only null, so undefined-valued keys survive - TransformService.toTransfer
+  # gains an "expiration: undefined" key and 3 unit tests fail (test/unit/domain/transfer/
+  # transform.test.js); (2) the APIDocumentation plugin option was renamed documentPath ->
+  # pathToSwaggerFile, breaking plugin registration. Hold at 18.37.0 (same as main) until a
+  # shared release restores omitNil nil-semantics; then re-apply the option rename with the bump.
+  "@mojaloop/central-services-shared",
+  # tape 5.x enforces strict .end()/plan semantics that break this repo's stream-style event tests
+  # (verified against the tape 5.10.x line); the suite also runs under the tapes wrapper, which is bound to tape 4.
   "tape",
-  # TODO: New versions from 2.2.0 onwards introduce a newer incompatible version of the ILP-Packet that is not compatible with the Mojaloop Specification
+  # ilp-packet >2.2.0 (3.x is currently an alpha prerelease) implements a newer ILP packet format
+  # that is not compatible with the Mojaloop Specification.
   "ilp-packet",
-  # v6+ (ref: https://github.com/sindresorhus/get-port/releases/tag/v6.0.0) is an ESM library and thus not compatible with CommonJS. Future story needed to resolve.
-  "get-port",
-  # sinon v17.0.1 causes 58 tests to fail. This will need to be resolved in a future story.
-  # Issue is tracked here: https://github.com/mojaloop/project/issues/3616
-  "sinon",
-  # glob >= 11 requires node >= 20
-  "glob"
+  # database-lib 11.3.8 regression (verified 2026-07-07): Table._addWhere now runs `assert(value)` on every
+  # criteria value, so legitimate falsy filters throw, e.g. transferExtension.getByTransferId's
+  # { isFulfilment: false, isError: false } fails with "AssertionError [ERR_ASSERTION]: The expression
+  # evaluated to a falsy value: assert(value)" (@mojaloop/database-lib/src/table.js:111). Hold at 11.3.7
+  # until the upstream assert is fixed to allow falsy (non-undefined/null) criteria values.
+  "@mojaloop/database-lib"
 ]

package/.nvmrc

@@ -1 +1 @@
-18.20.4
+24.18.0

package/.nycrc.yml

@@ -1,4 +1,6 @@
 temp-directory: "./.nyc_output"
+# Cache must be disabled for ts-node transpilation to work correctly with nyc.
+cache: false
 check-coverage: true
 per-file: true
 lines: 90
@@ -7,7 +9,12 @@ functions: 90
 branches: 90
 all: true
 include: [
-  "src/**/*.js"
+  "src/**/*.js",
+  "src/**/*.ts"
+]
+extension: [
+  ".js",
+  ".ts"
 ]
 reporter: [
   "lcov",
@@ -31,6 +38,11 @@ exclude: [
   'src/models/participant/externalParticipantCached.js', # todo: figure out why it shows only 50% coverage in Branch
   'src/models/transfer/facade.js', ## add more test coverage
   'src/shared/fspiopErrorFactory.js',
-  'src/lib/proxyCache.js' # todo: remove this line after adding test coverage
+  'src/lib/proxyCache.js', # todo: remove this line after adding test coverage
+  'src/seeds/**',
+  'src/**/*.test.ts',
+  'src/testing/**',     # Test runner.
+  'src/**/*.unit.ts',   # Unit test files.
+  'src/**/*.int.ts'    # Integration test tests.
 ]
 ## todo: increase test coverage before merging feat/fx-impl to main branch