@mojaloop/central-services-shared 18.35.3 → 18.35.5

package/.circleci/config.yml

@@ -20,7 +20,7 @@ version: 2.1
 setup: true
 
 orbs:
-  build: mojaloop/build@1.1.9
+  build: mojaloop/build@1.1.15
 
 workflows:
   setup:

package/.grype.yaml

@@ -1,40 +1,21 @@
-# Grype vulnerability scanning configuration for central-services-shared
-# This is a library project without Docker images, so we use source scanning
 scan-type: source
-
-# Enable vulnerability scanning
 disabled: false
-
-# Vulnerability ignore rules
-# Add specific CVEs here if they are false positives or acceptable risks
 ignore:
-  # Example format for ignoring specific vulnerabilities:
-  # - vulnerability: "CVE-2023-xxxxx"
-  #   reason: "False positive in dev dependency that doesn't affect production"
-  # - vulnerability: "GHSA-xxxx-xxxx-xxxx"
-  #   package:
-  #     name: "package-name"
-  #     version: "1.0.0"
-  #   reason: "Not exploitable in our usage context"
-
-# Output formats for scan results
+  - vulnerability: GHSA-2g4f-4pwh-qvx6
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: ajv ReDoS (moderate) as of 2026-02-19"
+  - vulnerability: GHSA-3ppc-4f35-3m26
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: minimatch ReDoS - fix requires v10 major version break as of 2026-02-19"
 output:
-  - "table"  # Human-readable table format
-  - "json"   # Machine-readable JSON for further processing
-
-# Grype configuration options
-quiet: false                    # Show progress and status messages
-check-for-app-update: false     # Don't check for Grype updates during CI
-only-fixed: false               # Show all vulnerabilities, not just those with fixes
-add-cpes-if-none: false         # Don't add CPEs if none are found
-by-cve: false                   # Group by vulnerability rather than CVE
-
-# Database settings
+  - table
+  - json
+quiet: false
+check-for-app-update: false
+only-fixed: false
+add-cpes-if-none: false
+by-cve: false
 db:
-  auto-update: true             # Auto-update the vulnerability database
-  validate-age: true            # Validate the age of the vulnerability database
-  max-allowed-built-age: 120h   # Maximum age of the vulnerability database (5 days)
-
-# Severity thresholds (handled by the orb, but documented here for clarity)
-# The build will fail on Critical, High, or Medium severity vulnerabilities
-# Low and Negligible severities are reported but won't fail the build
+  auto-update: true
+  validate-age: true
+  max-allowed-built-age: 120h

package/.nvmrc

@@ -1 +1 @@
-22.15.1
+22.22.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [18.35.5](https://github.com/mojaloop/central-services-shared/compare/v18.35.4...v18.35.5) (2026-02-20)
+
+
+### Chore
+
+* update orb and dep ver ([#509](https://github.com/mojaloop/central-services-shared/issues/509)) ([7293cff](https://github.com/mojaloop/central-services-shared/commit/7293cffea15145d115b25625eb4352ceb651bb35))
+
+### [18.35.4](https://github.com/mojaloop/central-services-shared/compare/v18.35.3...v18.35.4) (2026-02-19)
+
+
+### Chore
+
+* update dependencies, node.js 22.22.0, and security patches ([#508](https://github.com/mojaloop/central-services-shared/issues/508)) ([51281d8](https://github.com/mojaloop/central-services-shared/commit/51281d8eaaa8b9da53214f2b6543d1aef165a682))
+
 ### [18.35.3](https://github.com/mojaloop/central-services-shared/compare/v18.35.2...v18.35.3) (2026-02-06)
 
 

package/audit-ci.jsonc

@@ -4,6 +4,7 @@
   // Only use one of ["low": true, "moderate": true, "high": true, "critical": true]
   "moderate": true,
   "allowlist": [ // NOTE: Please add as much information as possible to any items added to the allowList
-    // e.g. Currently no fixes available for the following
+    "GHSA-2g4f-4pwh-qvx6",
+    "GHSA-3ppc-4f35-3m26" // minimatch ReDoS - fix requires v10 (major version break), unfixable via override
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mojaloop/central-services-shared",
-  "version": "18.35.3",
+  "version": "18.35.5",
   "description": "Shared code for mojaloop central services",
   "license": "Apache-2.0",
   "author": "ModusBox",
@@ -67,16 +67,16 @@
   "dependencies": {
     "@hapi/catbox": "12.1.1",
     "@hapi/catbox-memory": "5.0.1",
-    "@hapi/hapi": "21.4.4",
+    "@hapi/hapi": "21.4.6",
     "@hapi/joi-date": "2.0.1",
     "@mojaloop/inter-scheme-proxy-cache-lib": "2.9.0",
     "@opentelemetry/api": "1.9.0",
     "async-exit-hook": "2.0.1",
     "async-retry": "1.3.3",
-    "axios": "1.13.4",
+    "axios": "1.13.5",
     "clone": "2.1.2",
     "convict": "^6.2.4",
-    "dotenv": "17.2.3",
+    "dotenv": "17.3.1",
     "env-var": "7.5.0",
     "event-stream": "4.0.1",
     "fast-safe-stringify": "2.1.1",
@@ -96,20 +96,20 @@
     "yaml": "2.8.2"
   },
   "devDependencies": {
-    "@mojaloop/central-services-error-handling": "13.1.5",
-    "@mojaloop/central-services-logger": "11.10.3",
-    "@mojaloop/central-services-metrics": "12.8.3",
-    "@mojaloop/event-sdk": "14.8.2",
-    "@mojaloop/sdk-standard-components": "19.18.6",
-    "@opentelemetry/auto-instrumentations-node": "^0.69.0",
+    "@mojaloop/central-services-error-handling": "13.1.6",
+    "@mojaloop/central-services-logger": "11.10.4",
+    "@mojaloop/central-services-metrics": "12.8.5",
+    "@mojaloop/event-sdk": "14.8.3",
+    "@mojaloop/sdk-standard-components": "19.18.7",
+    "@opentelemetry/auto-instrumentations-node": "^0.70.0",
     "@types/hapi__joi": "17.1.15",
-    "ajv": "^8.17.1",
+    "ajv": "8.18.0",
     "ajv-formats": "^3.0.1",
     "ajv-keywords": "^5.1.0",
     "audit-ci": "7.1.0",
     "base64url": "3.0.1",
     "chance": "1.1.13",
-    "npm-check-updates": "19.3.2",
+    "npm-check-updates": "19.4.1",
     "nyc": "17.1.0",
     "portfinder": "1.0.38",
     "pre-commit": "1.2.2",
@@ -125,10 +125,10 @@
     "tapes": "4.1.0"
   },
   "overrides": {
-    "axios": "1.13.4",
-    "qs": "6.14.1",
+    "axios": "1.13.5",
+    "qs": "6.14.2",
     "brace-expansion": "2.0.2",
-    "form-data": "4.0.4",
+    "form-data": "4.0.5",
     "nanoid": "5.1.5",
     "postcss": {
       "nanoid": "5.1.5"
@@ -145,7 +145,7 @@
       "swagger2openapi": "7.0.8"
     },
     "markdown-it": "12.3.2",
-    "fast-xml-parser": "5.3.4",
+    "fast-xml-parser": "5.3.6",
     "trim": "0.0.3",
     "cross-spawn": "7.0.6",
     "yargs-parser": "21.1.1",