fix(security): patch 6 vulnerabilities + update deps, orb

[gibaros]

🔒 Security & Dependency Updates

---

Summary

This PR updates dependencies and applies security patches to address vulnerabilities.

Confidence Score: 65% ⚠️ (Draft PR - requires review)

• ✅ All tests passing

---

📦 Dependency Updates (5 packages)

Updated all dependencies to latest versions via npm run dep:update:

Package	From	To	Type
@mojaloop/central-services-error-handling	13.1.7	13.2.0	minor
jest	^30.4.2	^30.5.1	minor
mysql2	^3.22.6	^3.24.4	minor
sinon	22.0.0	22.1.0	minor
npm-check-updates	22.2.9	23.1.0	major

---

🔄 CircleCI Orb Update

Updated the Mojaloop CI/CD orb to the latest version:

Component	From	To
mojaloop/build	2.1.3	2.1.7

Source: mojaloop/ci-config-orb-build

---

🛡️ Security Patches (6 vulnerabilities fixed)

Applied targeted security fixes for remaining vulnerabilities:

High Severity

• brace-expansion - brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

  • Fixed: 2.0.0 - 2.1.3 → 2.1.4 (npm override)
  • GHSA-rgw5-rvv9-x895

• browserslist - Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

  • Fixed: <=4.28.6 → 4.28.7 (npm override)
  • GHSA-c83g-rgw3-j3cx

• js-yaml - js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

  • Fixed: >= 4.0.0, < 4.3.2 → 4.3.2 (npm override)
  • GHSA-2883-xcg3-v3hh | CVE-2026-84375

Moderate Severity

• mysql2 - MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

  • Fixed: <= 3.23.0 → 3.23.1
  • GHSA-rgwj-5xj2-c3m3

• baseline-browser-mapping - baseline-browser-mapping process termination on invalid input causes denial of service

  • Fixed: >= 2.0.0, < 2.11.0 → 2.11.0 (npm override)
  • GHSA-w5vr-8v7q-w6rv | CVE-2026-45819

Low Severity

• @babel/core - @babel/core: Arbitrary File Read via sourceMappingURL Comment
  • Fixed: <= 7.29.0 → 7.29.6 (npm override)
  • GHSA-4x5r-pxfx-6jf8 | CVE-2026-49356

---

✅ Validation Results

Baseline Validation (before changes)

• Tests: ✅ Passed

Tests (after changes)

• Status: ✅ Passed
• Command: npm test

---

🤖 Automated Changes

This PR was automatically generated by ml-repo-maintenance.

Changed Files:

• package.json - Updated dependency versions and added npm overrides
• .circleci/config.yml - Updated orb version
• .nvmrc - Updated Node.js version: 24.18.0 → 24.21.0

Review Checklist:

• Review dependency updates for breaking changes
• Review security patches
• Review CircleCI orb update
• Check test coverage
• Verify build artifacts

---

🤖 Generated with ml-repo-maintenance

Co-Authored-By: ml-repo-maintenance noreply@mojaloop.org

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud