fix(security): patch 5 vulnerabilities + update deps, orb

[gibaros]

🔒 Security & Dependency Updates

---

Summary

This PR updates dependencies and applies security patches to address vulnerabilities.

Confidence Score: 65% ⚠️ (Draft PR - requires review)

• ✅ All tests passing

---

📦 Dependency Updates (6 packages)

Updated all dependencies to latest versions via npm run dep:update:

Package	From	To	Type
eslint	10.6.0	10.10.0	minor
eslint-plugin-jest	^29.15.4	^29.16.6	minor
globals	^17.7.0	^17.12.0	minor
jest	30.4.2	30.5.1	minor
mongoose	^9.7.4	^9.10.1	minor

View all 6 dependency updates

Dependencies

• eslint: 10.6.0 → 10.10.0 (minor)
• eslint-plugin-jest: ^29.15.4 → ^29.16.6 (minor)
• globals: ^17.7.0 → ^17.12.0 (minor)
• jest: 30.4.2 → 30.5.1 (minor)
• mongoose: ^9.7.4 → ^9.10.1 (minor)
• npm-check-updates: 22.2.9 → 23.1.0 (major)

---

🔄 CircleCI Orb Update

Updated the Mojaloop CI/CD orb to the latest version:

Component	From	To
mojaloop/build	2.1.3	2.1.7

Source: mojaloop/ci-config-orb-build

---

🛡️ Security Patches (5 vulnerabilities fixed)

Applied targeted security fixes for remaining vulnerabilities:

High Severity

• brace-expansion - brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

  • Fixed: 2.0.0 - 2.1.3 → 2.1.4 (npm override)
  • GHSA-rgw5-rvv9-x895

• browserslist - Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

  • Fixed: <=4.28.6 → 4.28.7 (npm override)
  • GHSA-c83g-rgw3-j3cx

• js-yaml - js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

  • Fixed: >= 4.0.0, < 4.3.2 → 4.3.2 (npm override)
  • GHSA-2883-xcg3-v3hh | CVE-2026-84375

Moderate Severity

• @humanfs/node - humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

  • Fixed: < 0.16.8 → 0.16.8 (npm override)
  • GHSA-p498-v437-472g

• baseline-browser-mapping - baseline-browser-mapping process termination on invalid input causes denial of service

  • Fixed: >= 2.0.0, < 2.11.0 → 2.11.0 (npm override)
  • GHSA-w5vr-8v7q-w6rv | CVE-2026-45819

---

✅ Validation Results

Baseline Validation (before changes)

• Tests: ✅ Passed

Tests (after changes)

• Status: ✅ Passed
• Command: npm test

---

🤖 Automated Changes

This PR was automatically generated by ml-repo-maintenance.

Changed Files:

• package.json - Updated dependency versions and added npm overrides
• .circleci/config.yml - Updated orb version
• .nvmrc - Updated Node.js version: 24.18.0 → 24.21.0

Review Checklist:

• Review dependency updates for breaking changes
• Review security patches
• Review CircleCI orb update
• Check test coverage
• Verify build artifacts

---

🤖 Generated with ml-repo-maintenance

Co-Authored-By: ml-repo-maintenance noreply@mojaloop.org

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud