chore: maintenance updates

[gibaros]

🔒 Security & Dependency Updates

---

Summary

This PR updates dependencies and applies security patches to address vulnerabilities.

Confidence Score: 100% ✅ (Standard PR - ready for review)

---

🐳 Docker Image Updates

Docker CVE Suppressions

Added 3 Docker-specific vulnerability suppression(s) to .grype.yaml.
These are Alpine (apk), Node.js binary, or base image npm vulnerabilities that cannot be fixed via application dependencies.

Docker Image Scan Results

Category	Count
npm (application)	0
npm (base image)	15
Alpine (apk)	4
Binary (Node.js)	0
Total	19

---

📋 Audit CI Allowlist Updates

Added 4 unfixable vulnerability ID(s) to audit-ci.jsonc allowlist.
These are transitive vulnerabilities in upstream dependencies that cannot be resolved here.

GHSA ID
GHSA-m7jm-9gc2-mpf2
GHSA-jmr7-xgp7-cmfj
GHSA-2g4f-4pwh-qvx6
GHSA-3ppc-4f35-3m26

---

🔍 Grype npm Vulnerability Ignores

Added 4 unfixable npm vulnerability ignore(s) to .grype.yaml.
These are transitive npm vulnerabilities that are also checked by Grype CI scans.

GHSA/CVE ID	Package
GHSA-m7jm-9gc2-mpf2	fast-xml-parser
GHSA-jmr7-xgp7-cmfj	fast-xml-parser
GHSA-2g4f-4pwh-qvx6	unknown
GHSA-9965-vmph-33xx	unknown

---

✅ Validation Results

No validation checks were run.

---

🤖 Automated Changes

This PR was automatically generated by ml-repo-maintenance.

Changed Files:

• package.json - Updated dependency versions and added npm overrides
• .grype.yaml - Added Docker vulnerability suppressions and npm vulnerability ignores

Review Checklist:

• Review dependency updates for breaking changes
• Review security patches
• Check test coverage
• Verify build artifacts

---

🤖 Generated with ml-repo-maintenance

Co-Authored-By: ml-repo-maintenance noreply@mojaloop.org

[gibaros]

Regarding the code changes, they are required due to:

A breaking change on the patch update to @hapi/hapi

PR #4562 by damusix, titled "fix: auth typings and reduced type
ambiguity", was merged on 2026-02-18 and released in v21.4.5.

The PR description says: "Remove ambiguous types" — which is exactly
what happened. It replaced permissive any types with stricter ones.

The exact diff in lib/types/request.d.ts

The key change (v21.4.4...v21.4.5 comparison):

• Headers: Record<string, any>;

• Headers: Record<string, string | string[] | undefined>;

• Params: Record<string, any>;

• Params: Record<string, string>;

export interface RequestQuery {

• key: string: string | string[] | undefined;
  }

Why it's breaking

• In 21.4.4, request.headers['X-Something'] returned any, so const
  foo: string = request.headers['X-Something'] compiled with no
  complaints.
• In 21.4.5+, it returns string | string[] | undefined, so the same
  line is now a TypeScript error — you need a cast or type guard.

This is a narrowing of a public type contract in a patch release,
which violates semver. Patch versions should be backwards-compatible
bug fixes.

Links

• PR: fix: auth typings and reduced type ambiguity hapijs/hapi#4562
• Commit diff:
  hapijs/hapi@v21.4.4...v21.4.5
• Related issue (the auth regression it fixed):
  Possible typing regression between v21.3.12 and v21.4.4 hapijs/hapi#4561
• Related issue: Incorrect / overly strict types in 21.4.5 hapijs/hapi#4565
• Related issue: Patch 21.4.5 introduces TypeScript compile-time breaking change hapijs/hapi#4563

[elnyry-sam-k]

👍