@mojaloop/central-services-shared 18.35.3 → 18.35.6

package/.circleci/config.yml

@@ -20,7 +20,7 @@ version: 2.1
 setup: true
 
 orbs:
-  build: mojaloop/build@1.1.9
+  build: mojaloop/build@1.1.15
 
 workflows:
   setup:

package/.grype.yaml

@@ -1,40 +1,21 @@
-# Grype vulnerability scanning configuration for central-services-shared
-# This is a library project without Docker images, so we use source scanning
 scan-type: source
-
-# Enable vulnerability scanning
 disabled: false
-
-# Vulnerability ignore rules
-# Add specific CVEs here if they are false positives or acceptable risks
 ignore:
-  # Example format for ignoring specific vulnerabilities:
-  # - vulnerability: "CVE-2023-xxxxx"
-  #   reason: "False positive in dev dependency that doesn't affect production"
-  # - vulnerability: "GHSA-xxxx-xxxx-xxxx"
-  #   package:
-  #     name: "package-name"
-  #     version: "1.0.0"
-  #   reason: "Not exploitable in our usage context"
-
-# Output formats for scan results
+  - vulnerability: GHSA-2g4f-4pwh-qvx6
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: ajv ReDoS (moderate) as of 2026-02-19"
+  - vulnerability: GHSA-3ppc-4f35-3m26
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: minimatch ReDoS - fix requires v10 major version break as of 2026-02-19"
 output:
-  - "table"  # Human-readable table format
-  - "json"   # Machine-readable JSON for further processing
-
-# Grype configuration options
-quiet: false                    # Show progress and status messages
-check-for-app-update: false     # Don't check for Grype updates during CI
-only-fixed: false               # Show all vulnerabilities, not just those with fixes
-add-cpes-if-none: false         # Don't add CPEs if none are found
-by-cve: false                   # Group by vulnerability rather than CVE
-
-# Database settings
+  - table
+  - json
+quiet: false
+check-for-app-update: false
+only-fixed: false
+add-cpes-if-none: false
+by-cve: false
 db:
-  auto-update: true             # Auto-update the vulnerability database
-  validate-age: true            # Validate the age of the vulnerability database
-  max-allowed-built-age: 120h   # Maximum age of the vulnerability database (5 days)
-
-# Severity thresholds (handled by the orb, but documented here for clarity)
-# The build will fail on Critical, High, or Medium severity vulnerabilities
-# Low and Negligible severities are reported but won't fail the build
+  auto-update: true
+  validate-age: true
+  max-allowed-built-age: 120h

package/.nvmrc

@@ -1 +1 @@
-22.15.1
+22.22.0

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [18.35.6](https://github.com/mojaloop/central-services-shared/compare/v18.35.5...v18.35.6) (2026-02-26)
+
+
+### Chore
+
+* rm circular dependency on sdk-standard-components ([#510](https://github.com/mojaloop/central-services-shared/issues/510)) ([7346920](https://github.com/mojaloop/central-services-shared/commit/7346920e3c3e0996aeebfd7cce4e24ac54d59313))
+
+### [18.35.5](https://github.com/mojaloop/central-services-shared/compare/v18.35.4...v18.35.5) (2026-02-20)
+
+
+### Chore
+
+* update orb and dep ver ([#509](https://github.com/mojaloop/central-services-shared/issues/509)) ([7293cff](https://github.com/mojaloop/central-services-shared/commit/7293cffea15145d115b25625eb4352ceb651bb35))
+
+### [18.35.4](https://github.com/mojaloop/central-services-shared/compare/v18.35.3...v18.35.4) (2026-02-19)
+
+
+### Chore
+
+* update dependencies, node.js 22.22.0, and security patches ([#508](https://github.com/mojaloop/central-services-shared/issues/508)) ([51281d8](https://github.com/mojaloop/central-services-shared/commit/51281d8eaaa8b9da53214f2b6543d1aef165a682))
+
 ### [18.35.3](https://github.com/mojaloop/central-services-shared/compare/v18.35.2...v18.35.3) (2026-02-06)
 
 

package/audit-ci.jsonc

@@ -4,6 +4,7 @@
   // Only use one of ["low": true, "moderate": true, "high": true, "critical": true]
   "moderate": true,
   "allowlist": [ // NOTE: Please add as much information as possible to any items added to the allowList
-    // e.g. Currently no fixes available for the following
+    "GHSA-2g4f-4pwh-qvx6",
+    "GHSA-3ppc-4f35-3m26" // minimatch ReDoS - fix requires v10 (major version break), unfixable via override
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mojaloop/central-services-shared",
-  "version": "18.35.3",
+  "version": "18.35.6",
   "description": "Shared code for mojaloop central services",
   "license": "Apache-2.0",
   "author": "ModusBox",
@@ -67,16 +67,16 @@
   "dependencies": {
     "@hapi/catbox": "12.1.1",
     "@hapi/catbox-memory": "5.0.1",
-    "@hapi/hapi": "21.4.4",
+    "@hapi/hapi": "21.4.6",
     "@hapi/joi-date": "2.0.1",
     "@mojaloop/inter-scheme-proxy-cache-lib": "2.9.0",
     "@opentelemetry/api": "1.9.0",
     "async-exit-hook": "2.0.1",
     "async-retry": "1.3.3",
-    "axios": "1.13.4",
+    "axios": "1.13.5",
     "clone": "2.1.2",
     "convict": "^6.2.4",
-    "dotenv": "17.2.3",
+    "dotenv": "17.3.1",
     "env-var": "7.5.0",
     "event-stream": "4.0.1",
     "fast-safe-stringify": "2.1.1",
@@ -85,7 +85,7 @@
     "joi": "18.0.2",
     "lodash": "4.17.23",
     "mustache": "4.2.0",
-    "openapi-backend": "5.15.0",
+    "openapi-backend": "5.16.1",
     "raw-body": "3.0.2",
     "rc": "1.2.8",
     "redlock": "5.0.0-beta.2",
@@ -96,21 +96,20 @@
     "yaml": "2.8.2"
   },
   "devDependencies": {
-    "@mojaloop/central-services-error-handling": "13.1.5",
-    "@mojaloop/central-services-logger": "11.10.3",
-    "@mojaloop/central-services-metrics": "12.8.3",
-    "@mojaloop/event-sdk": "14.8.2",
-    "@mojaloop/sdk-standard-components": "19.18.6",
-    "@opentelemetry/auto-instrumentations-node": "^0.69.0",
+    "@mojaloop/central-services-error-handling": "13.1.6",
+    "@mojaloop/central-services-logger": "11.10.4",
+    "@mojaloop/central-services-metrics": "12.8.5",
+    "@mojaloop/event-sdk": "14.8.3",
+    "@opentelemetry/auto-instrumentations-node": "^0.70.1",
     "@types/hapi__joi": "17.1.15",
-    "ajv": "^8.17.1",
+    "ajv": "8.18.0",
     "ajv-formats": "^3.0.1",
     "ajv-keywords": "^5.1.0",
     "audit-ci": "7.1.0",
     "base64url": "3.0.1",
     "chance": "1.1.13",
-    "npm-check-updates": "19.3.2",
-    "nyc": "17.1.0",
+    "npm-check-updates": "19.5.0",
+    "nyc": "18.0.0",
     "portfinder": "1.0.38",
     "pre-commit": "1.2.2",
     "proxyquire": "2.1.3",
@@ -125,10 +124,10 @@
     "tapes": "4.1.0"
   },
   "overrides": {
-    "axios": "1.13.4",
-    "qs": "6.14.1",
+    "axios": "1.13.5",
+    "qs": "6.14.2",
     "brace-expansion": "2.0.2",
-    "form-data": "4.0.4",
+    "form-data": "4.0.5",
     "nanoid": "5.1.5",
     "postcss": {
       "nanoid": "5.1.5"
@@ -145,7 +144,7 @@
       "swagger2openapi": "7.0.8"
     },
     "markdown-it": "12.3.2",
-    "fast-xml-parser": "5.3.4",
+    "fast-xml-parser": "5.3.6",
     "trim": "0.0.3",
     "cross-spawn": "7.0.6",
     "yargs-parser": "21.1.1",

package/test/unit/util/request.test.js

@@ -10,35 +10,6 @@ const Enum = require('../../../src/enums')
 const Helper = require('../../util/helper')
 const Metrics = require('@mojaloop/central-services-metrics')
 const Uuid = require('uuid4')
-const JwsSigner = require('@mojaloop/sdk-standard-components').Jws.signer
-
-const signingKey = `-----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEA0eJEh3Op5p6x137lRkAsvmEBbd32dbRChrCUItZbtxjf/qfB
-yD5k8Hn4n4vbqzP8XSGS0f6KmNC+iRaP74HVgzAqc4Uid4J8dtSBq3VmucYQYzLc
-101QjuvD+SKmZwlw/q0PtulmqlASI2SbMfwcAraMi6ab7v5W4EGNeIPLEIo3BXsQ
-DTCWqiZb7aXkHkcY7sOjAzK/2bNGYFmAthdYrHzvCkqnJ7LAHX3Oj7rJea5MqtuN
-B9POZYaD10n9JuYWdwPqLrw6/hVgPSFEy+ulrVbXf54ZH0dfMThAYRvFrT81yulk
-H95JhXWGdi6cTp6t8LVOKFhnNfxjWw0Jayj9xwIDAQABAoIBADB2u/Y/CgNbr5sg
-DRccqHhJdAgHkep59kadrYch0knEL6zg1clERxCUSYmlxNKSjXp/zyQ4T46b3PNQ
-x2m5pDDHxXWpT10jP1Q9G7gYwuCw0IXnb8EzdB+cZ0M28g+myXW1RoSo/nDjTlzn
-1UJEgb9Kocd5cFZOWocr+9vRKumlZULMsA8yiNwlAfJHcMBM7acsa3myCqVhLyWt
-4BQylVuLFa+A6QzpMXEwFCq8EOXf07gl1XVzC6LJ1fTa9gVM3N+YE+oEXKrsHCxG
-/ACgKsjepL27QjJ7qvecWPP0F2LxEZYOm5tbXaKJTobzQUJHgUokanZMhjYprDsZ
-zumLw9kCgYEA/DUWcnLeImlfq/EYdhejkl3J+WX3vhS23OqVgY1amu7CZzaai6vt
-H0TRc8Zsbi4jgmFDU8PFzytP6qz6Tgom4R736z6oBi7bjnGyN17/NSbf+DaRVcM6
-vnZr7jNC2FJlECmIN+dkwUA/YCr2SA7hxZXM9mIYSc+6+glDiIO5Cf0CgYEA1Qo/
-uQbVHhW+Cp8H0kdMuhwUbkBquRrxRZlXS1Vrf3f9me9JLUy9UPWb3y3sKVurG5+O
-SIlr4hDcZyXdE198MtDMhBIGqU9ORSjppJDNDVvtt+n2FD4XmWIU70vKBJBivX0+
-Bow6yduis+p12fuvpvpnKCz8UjOgOQJhLZ4GQBMCgYBP6gpozVjxkm4ML2LO2IKt
-+CXtbo/nnOysZ3BkEoQpH4pd5gFmTF3gUJAFnVPyPZBm2abZvejJ0jGKbLELVVAo
-eQWZdssK2oIbSo9r2CAJmX3SSogWorvUafWdDoUZwlHfoylUfW+BhHgQYsyS3JRR
-ZTwCveZwTPA0FgdeFE7niQKBgQCHaD8+ZFhbCejDqXb4MXdUJ3rY5Lqwsq491YwF
-huKPn32iNNQnJcqCxclv3iln1Cr6oLx34Fig1KSyLv/IS32OcuY635Y6UPznumxe
-u+aJIjADIILXNOwdAplZy6s4oWkRFaSx1rmbCa3tew2zImTv1eJxR76MpOGmupt3
-uiQw3wKBgFjBT/aVKdBeHeP1rIHHldQV5QQxZNkc6D3qn/oAFcwpj9vcGfRjQWjO
-ARzXM2vUWEet4OVn3DXyOdaWFR1ppehz7rAWBiPgsMg4fjAusYb9Mft1GMxMzuwT
-Oyqsp6pzAWFrCD3JAoTLxClV+j5m+SXZ/ItD6ziGpl/h7DyayrFZ
------END RSA PRIVATE KEY-----`
 
 Test('ParticipantEndpoint Model Test', modelTest => {
   let sandbox
@@ -483,10 +454,9 @@ Test('ParticipantEndpoint Model Test', modelTest => {
         method: 'post',
         headers: Helper.defaultHeaders(fsp, Enum.Http.HeaderResources.PARTICIPANTS, payeefsp)
       }
-      const jwsSigner = new JwsSigner({
-        logger: null,
-        signingKey
-      })
+      const jwsSigner = {
+        getSignature: () => 'mock-jws-signature'
+      }
       request = sandbox.stub().returns({ status: 200 })
       Model = proxyquire('../../../src/util/request', { axios: request })
       const signSpy = Sinon.spy(jwsSigner, 'getSignature')
@@ -517,10 +487,9 @@ Test('ParticipantEndpoint Model Test', modelTest => {
         method: 'post',
         headers: Helper.defaultHeaders(fsp, Enum.Http.HeaderResources.PARTICIPANTS, payeefsp)
       }
-      const jwsSigner = new JwsSigner({
-        logger: null,
-        signingKey
-      })
+      const jwsSigner = {
+        getSignature: () => 'mock-jws-signature'
+      }
       request = sandbox.stub().returns({ status: 200 })
       Model = proxyquire('../../../src/util/request', { axios: request })
       const signSpy = Sinon.spy(jwsSigner, 'getSignature')