ml-testing-toolkit 18.18.0 → 18.19.1

package/.grype.yaml

@@ -1,28 +1,24 @@
 ignore:
+  # fast-xml-parser vulnerability
   - vulnerability: GHSA-37qj-frw5-hhjh
-    reason: "fast-xml-parser 4.5.3→5.3.4"
+  # lodash vulnerabilities
   - vulnerability: GHSA-xxjr-mmjv-4gpg
-    reason: "lodash/lodash-es 4.17.21→4.17.23"
+  # @isaacs/brace-expansion vulnerability
   - vulnerability: GHSA-7h2j-956f-4vf2
-    reason: "@isaacs/brace-expansion 5.0.0→5.0.1"
+  # busybox vulnerabilities
   - vulnerability: CVE-2025-60876
-    reason: "busybox 1.37.0-r30 (busybox-binsh, ssl_client)"
+  # glob vulnerabilities
   - vulnerability: GHSA-5j98-mcp5-4vw2
-    include-aliases: true
-    reason: "glob 10.4.5→10.5.0 and 11.0.3→11.1.0"
+  # tar vulnerabilities
   - vulnerability: GHSA-34x7-hfp2-rc4v
-    reason: "tar 7.5.1→7.5.7"
-  - vulnerability: GHSA-73rr-hh4g-fpgx
-    reason: "diff 8.0.2→8.0.3"
   - vulnerability: GHSA-r6q2-hw4h-h46w
-    reason: "tar 7.5.1→7.5.4"
-  - vulnerability: GHSA-3966-f6p6-2qr9
-    reason: "npm 11.6.2"
   - vulnerability: GHSA-8qq5-rm4j-mr97
-    reason: "tar 7.5.1→7.5.3"
   - vulnerability: GHSA-29xp-372q-xqph
-    reason: "tar 7.5.1→7.5.2"
-
+  # diff vulnerability
+  - vulnerability: GHSA-73rr-hh4g-fpgx
+  # npm vulnerability
+  - vulnerability: GHSA-3966-f6p6-2qr9
+# Set output format defaults
 output:
   - "table"
   - "json"

package/CHANGELOG.md

@@ -1,4 +1,23 @@
 # Changelog: [mojaloop/thirdparty-api-svc](https://github.com/mojaloop/thirdparty-api-svc)
+### [18.19.1](https://github.com/mojaloop/ml-testing-toolkit/compare/v18.19.0...v18.19.1) (2026-02-12)
+
+
+### Bug Fixes
+
+* download spec files issue [#4197](https://github.com/mojaloop/ml-testing-toolkit/issues/4197) ([#371](https://github.com/mojaloop/ml-testing-toolkit/issues/371)) ([cefcbdd](https://github.com/mojaloop/ml-testing-toolkit/commit/cefcbdd9dba28eedad9b93d40415b67ab140c35b))
+
+
+### Chore
+
+* **sbom:** update sbom [skip ci] ([2078f44](https://github.com/mojaloop/ml-testing-toolkit/commit/2078f44a133fb1a82f890d4e1fb61b4b8371d8cf))
+
+## [18.19.0](https://github.com/mojaloop/ml-testing-toolkit/compare/v18.18.0...v18.19.0) (2026-02-06)
+
+
+### Features
+
+* revert performance-optimization ([#367](https://github.com/mojaloop/ml-testing-toolkit/issues/367)) ([5b7c6c5](https://github.com/mojaloop/ml-testing-toolkit/commit/5b7c6c52d8ffe949ca16fa8374bea3fbc08c1a0c)), closes [#366](https://github.com/mojaloop/ml-testing-toolkit/issues/366)
+
 ## [18.18.0](https://github.com/mojaloop/ml-testing-toolkit/compare/v18.17.3...v18.18.0) (2026-02-06)
 
 

package/audit-ci.jsonc

@@ -4,7 +4,5 @@
   // Only use one of ["low": true, "moderate": true, "high": true, "critical": true]
   "moderate": true,
   "allowlist": [
-    "GHSA-37qj-frw5-hhjh",
-    "GHSA-xxjr-mmjv-4gpg"
   ]
 }

package/examples/collections/dfsp/p2p_fx_happy_path.json

@@ -159,6 +159,13 @@
                   "expect(callback.headers['Content-Length']).to.not.equal('0')"
                 ]
               },
+              {
+                "id": 4,
+                "description": "Callback FSP Destination equal to request FSP Source",
+                "exec": [
+                  "expect(callback.headers['fspiop-destination']).to.equal('{$request.headers['FSPIOP-Source']}')"
+                ]
+              },
               {
                 "id": 5,
                 "description": "Callback body should contain conversionTerms",
@@ -204,8 +211,8 @@
           "operationPath": "/quotes",
           "method": "post",
           "headers": {
-            "Accept": "{$inputs.acceptQuotes}",
-            "Content-Type": "{$inputs.contentTypeQuotes}",
+            "Accept": "application/vnd.interoperability.quotes+json;version=1.0",
+            "Content-Type": "application/vnd.interoperability.quotes+json;version=1.0",
             "Date": "{$function.generic.curDate}",
             "FSPIOP-Source": "{$inputs.fromFspId}",
             "FSPIOP-Destination": "{$prev.1.callback.body.party.partyIdInfo.fspId}"
@@ -269,6 +276,13 @@
                   "expect(callback.headers['Content-Length']).to.not.equal('0')"
                 ]
               },
+              {
+                "id": 4,
+                "description": "Callback FSP Destination equal to request FSP Source",
+                "exec": [
+                  "expect(callback.headers['fspiop-destination']).to.equal('{$request.headers['FSPIOP-Source']}')"
+                ]
+              },
               {
                 "id": 5,
                 "description": "Callback body should contain transferAmount",
@@ -334,8 +348,8 @@
           "path": "/fxTransfers",
           "method": "post",
           "headers": {
-            "Accept": "application/vnd.interoperability.fxTransfers+json;version=2.0",
-            "Content-Type": "application/vnd.interoperability.fxTransfers+json;version=2.0",
+            "Accept": "application/vnd.interoperability.fxTransfers+json;version=1.0",
+            "Content-Type": "application/vnd.interoperability.fxTransfers+json;version=1.0",
             "Date": "{$function.generic.curDate}",
             "FSPIOP-Source": "{$inputs.fromFspId}"
           },
@@ -378,6 +392,13 @@
                 "exec": [
                   "expect(callback.headers['Content-Length']).to.not.equal('0')"
                 ]
+              },
+              {
+                "id": 4,
+                "description": "Callback FSP Destination equal to request FSP Source",
+                "exec": [
+                  "expect(callback.headers['fspiop-destination']).to.equal('{$request.headers['FSPIOP-Source']}')"
+                ]
               }
             ]
           },
@@ -395,8 +416,8 @@
           "operationPath": "/transfers",
           "method": "post",
           "headers": {
-            "Accept": "{$inputs.acceptTransfers}",
-            "Content-Type": "{$inputs.contentTransfers}",
+            "Accept": "application/vnd.interoperability.transfers+json;version=1.0",
+            "Content-Type": "application/vnd.interoperability.transfers+json;version=1.0",
             "Date": "{$function.generic.curDate}",
             "FSPIOP-Source": "{$inputs.fromFspId}"
           },
@@ -435,6 +456,13 @@
                   "expect(callback.headers['Content-Length']).to.not.equal('0')"
                 ]
               },
+              {
+                "id": 4,
+                "description": "Callback FSP Destination equal to request FSP Source",
+                "exec": [
+                  "expect(callback.headers['fspiop-destination']).to.equal('{$request.headers['FSPIOP-Source']}')"
+                ]
+              },
               {
                 "id": 5,
                 "description": "Callback transferState to be COMMITTED",

package/examples/collections/dfsp/p2p_happy_path.json

@@ -1,5 +1,26 @@
 {
   "name": "dfsp-p2p-tests",
+  "inputValues": {
+    "fromIdType": "MSISDN",
+    "fromIdValue": "44123456789",
+    "fromFirstName": "Firstname-Test",
+    "fromLastName": "Lastname-Test",
+    "fromDOB": "1984-01-01",
+    "note": "Test Payment",
+    "currency": "USD",
+    "amount": "100",
+    "homeTransactionId": "123ABC",
+    "fromFspId": "testingtoolkitdfsp",
+    "accept": "application/vnd.interoperability.parties+json;version=1.0",
+    "contentType": "application/vnd.interoperability.parties+json;version=1.0",
+    "toIdValue": "9876543210",
+    "toIdType": "MSISDN",
+    "toFspId": "userdfsp",
+    "acceptQuotes": "application/vnd.interoperability.quotes+json;version=1.0",
+    "contentTypeQuotes": "application/vnd.interoperability.quotes+json;version=1.0",
+    "acceptTransfers": "application/vnd.interoperability.transfers+json;version=1.0",
+    "contentTransfers": "application/vnd.interoperability.transfers+json;version=1.0"
+  },
   "test_cases": [
     {
       "id": 1,
@@ -100,8 +121,8 @@
           "operationPath": "/quotes",
           "method": "post",
           "headers": {
-            "Accept": "{$inputs.acceptQuotes}",
-            "Content-Type": "{$inputs.contentTypeQuotes}",
+            "Accept": "application/vnd.interoperability.quotes+json;version=1.0",
+            "Content-Type": "application/vnd.interoperability.quotes+json;version=1.0",
             "Date": "{$function.generic.curDate}",
             "FSPIOP-Source": "{$inputs.fromFspId}",
             "FSPIOP-Destination": "{$prev.1.callback.body.party.partyIdInfo.fspId}"
@@ -187,6 +208,13 @@
                   "expect(callback.body.transferAmount.currency).to.equal('{$request.body.amount.currency}')"
                 ]
               },
+              {
+                "id": 7,
+                "description": "Callback content-type to be quotes",
+                "exec": [
+                  "expect(callback.headers['content-type']).to.equal('application/vnd.interoperability.quotes+json;version=1.0')"
+                ]
+              },
               {
                 "id": 8,
                 "description": "Request amountType to be SEND",
@@ -230,8 +258,8 @@
           "operationPath": "/transfers",
           "method": "post",
           "headers": {
-            "Accept": "{$inputs.acceptTransfers}",
-            "Content-Type": "{$inputs.contentTransfers}",
+            "Accept": "application/vnd.interoperability.transfers+json;version=1.0",
+            "Content-Type": "application/vnd.interoperability.transfers+json;version=1.0",
             "Date": "{$function.generic.curDate}",
             "FSPIOP-Source": "{$inputs.fromFspId}"
           },
@@ -284,6 +312,13 @@
                   "expect(callback.body.transferState).to.equal('COMMITTED')"
                 ]
               },
+              {
+                "id": 6,
+                "description": "Callback content-type to be transfers",
+                "exec": [
+                  "expect(callback.headers['content-type']).to.equal('application/vnd.interoperability.transfers+json;version=1.0')"
+                ]
+              },
               {
                 "id": 7,
                 "description": "Request transferId same as quote request transferId",

package/examples/environments/dfsp_local_environment.json

@@ -9,15 +9,15 @@
     "HOST_SIMULATOR": "http://moja-simulator.local",
     "HOST_TRANSACTION_REQUESTS_SERVICE": "http://transaction-request-service.local",
     "HUB_OPERATOR_BEARER_TOKEN": "NOT_APPLICABLE",
-    "accept": "application/vnd.interoperability.parties+json;version=2.0",
-    "acceptQuotes": "application/vnd.interoperability.quotes+json;version=2.0",
-    "acceptTransfers": "application/vnd.interoperability.transfers+json;version=2.0",
+    "accept": "application/vnd.interoperability.parties+json;version=1.0",
+    "acceptQuotes": "application/vnd.interoperability.quotes+json;version=1.0",
+    "acceptTransfers": "application/vnd.interoperability.transfers+json;version=1.0",
     "accountId": "6",
     "amount": "100",
     "condition": "HOr22-H3AfTDHrSkPjJtVPRdKouuMkDXTR4ejlQa8Ks",
-    "contentTransfers": "application/vnd.interoperability.transfers+json;version=2.0",
-    "contentType": "application/vnd.interoperability.parties+json;version=2.0",
-    "contentTypeQuotes": "application/vnd.interoperability.quotes+json;version=2.0",
+    "contentTransfers": "application/vnd.interoperability.transfers+json;version=1.0",
+    "contentType": "application/vnd.interoperability.parties+json;version=1.0",
+    "contentTypeQuotes": "application/vnd.interoperability.quotes+json;version=1.0",
     "currency": "USD",
     "fromDOB": "1984-01-01",
     "fromFirstName": "Firstname-Test",

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "ml-testing-toolkit",
   "description": "Testing Toolkit for Mojaloop implementations",
-  "version": "18.18.0",
+  "version": "18.19.1",
   "license": "Apache-2.0",
   "author": "Vijaya Kumar Guthi, ModusBox Inc. ",
   "contributors": [
     "Georgi Logodazhki <georgi.logodazhki@modusbox.com>",
     "Sam Kummary <sam@modusbox.com>",
     "Steven Oderayi <steven.oderayi@modusbox.com>",
-    "Vijay Kumar <vijaya.guthi@modusbox.com>"
+    "Vijay Kumar <vijaya.guthi@modusbox.com>",
+    "Shashikant Hirugade <shashi.mojaloop@gmail.com>"
   ],
   "engines": {
     "node": ">=22.x"
@@ -71,7 +72,7 @@
     "genexec": "pkg -t node8-win ."
   },
   "dependencies": {
-    "@elastic/elasticsearch": "9.3.0",
+    "@elastic/elasticsearch": "9.3.1",
     "@hapi/basic": "7.0.2",
     "@hapi/boom": "10.0.1",
     "@hapi/good": "9.0.1",
@@ -88,7 +89,7 @@
     "adm-zip": "0.5.16",
     "ajv-formats": "3.0.1",
     "atob": "2.1.2",
-    "axios": "1.13.4",
+    "axios": "1.13.5",
     "chai": "4.4.1",
     "connection-string": "^5.0.0",
     "cookie-parser": "1.4.7",
@@ -97,7 +98,6 @@
     "dotenv": "17.2.4",
     "express": "5.2.1",
     "express-validator": "7.3.1",
-    "fs": "0.0.1-security",
     "handlebars": "4.7.8",
     "hapi-auth-bearer-token": "8.0.0",
     "hapi-openapi": "3.0.0",
@@ -108,7 +108,7 @@
     "json-rules-engine": "7.3.1",
     "jsonwebtoken": "9.0.3",
     "lodash": "4.17.23",
-    "mongoose": "9.1.6",
+    "mongoose": "9.2.1",
     "multer": "2.0.2",
     "mustache": "4.2.0",
     "mv": "2.1.1",
@@ -169,6 +169,7 @@
     }
   },
   "overrides": {
+    "axios": "1.13.5",
     "form-data": "4.0.4",
     "brace-expansion": "2.0.2",
     "npm-check-updates": {
@@ -178,6 +179,8 @@
       "read-package-json": "6.0.0",
       "cacache": "17.0.4"
     },
+    "lodash": "4.17.23",
+    "lodash-es": "4.17.23",
     "make-fetch-happen": {
       "cacache": "17.0.4"
     },