[Snyk] Fix for 2 vulnerabilities

[rasputtintin]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-ASYNC-2441827	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @mojaloop/central-services-shared

The new version differs by 92 commits.

• 14f0b3e feat(2151)!: helm-release-v12.1.0 (#297)
• a5d9141 chore: fix service type typescript enum (#296)
• 5aaf087 fix(#2182)!: regex validations against swagger interface spec no longer working (#295)
• 0e538d8 chore: bump package version (#294)
• fc4fe7e chore: add 'example' as whitelisted keyword (#293)
• 6f9496d chore: address vulnerabilities (#291)
• 6275eb0 chore: add services endpoints (#290)
• 5860510 feat(#2119): fixes for updated for AJV error objects change (#289)
• b83a8bd fixed typo (#288)
• aee59ed Feature/#2057 refactoring for cs ([Snyk] Security upgrade @mojaloop/central-services-health from 8.3.0 to 10.6.0 #3) (#284)
• 082d373 chore: add PATCH consentRequests endpoint (#279)
• 7702879 chore: add enums to interface (#278)
• 5dcbe73 chore: add consent and consent request events and patch action (#277)
• 9f8713f chore: add accounts callback endpoints (#275)
• 5e49222 chore: add enums and bump package (#274)
• f6009d7 chore: 1975 update deps (#273)
• f678b43 [Security] Bump axios from 0.21.0 to 0.21.1 (#269)
• a8bfb9c Bump urijs from 1.19.2 to 1.19.5 (#270)
• 7b00ed8 [Security] Bump urijs from 1.19.2 to 1.19.5 (#268)
• 46d88e6 #1885: Fix for "multiple servers per repo" use case (#267)
• cbd0434 Hotfix: Fix dependencies for API documentation (#264)
• 327a51c chore: update license file (#265)
• df81389 #1885: Add API documentation utility, plugin, and endpoints (#263)
• 9c88000 Add FSPIOP headers validation for bulk transfers (#262)

See the full diff

Package name: @mojaloop/central-services-stream

The new version differs by 19 commits.

• bf597c5 chore(release): 11.0.0 [skip ci]
• f22ece0 fix: updated peerDependencies as NPM v7+ handles their resolution for us
• 35313c3 feat(mojaloop/#2092)!: upgrade nodeJS version for core services (Bump @mojaloop/central-services-shared from 8.7.1 to 8.8.0 mojaloop/central-event-processor#125)
• d07dd2e fix: Bump lodash from 4.17.19 to 4.17.21 (Bump sinon from 7.5.0 to 8.0.1 mojaloop/central-event-processor#117)
• 41a0b5e fix: [Security] Bump glob-parent from 5.1.1 to 5.1.2 (Bump mongoose from 5.8.0 to 5.8.3 mojaloop/central-event-processor#118)
• ff3fbea fix: Bump normalize-url from 4.5.0 to 4.5.1 (Bump rxjs from 6.5.3 to 6.5.4 mojaloop/central-event-processor#119)
• 4a6dc3b feat(2151): helm-release-v12.1.0 (Bump tape from 4.11.0 to 4.12.1 mojaloop/central-event-processor#116)
• c4903f0 [Security] Bump ini from 1.3.5 to 1.3.8 (Upgraded central-services-stream for #1114KafkaErrorLocalQueuefull fix mojaloop/central-event-processor#109)
• 65913b6 Updated dependencies (Bump mongoose from 5.7.8 to 5.7.14 mojaloop/central-event-processor#106)
• d64d4b2 make audit resolver run on production only by default, bump package to 10.2.0 (Bump @mojaloop/central-services-error-handling from 8.3.0 to 8.6.2 mojaloop/central-event-processor#100)
• b1c5d75 #1289 Log optimisation (Bump mongoose from 5.7.8 to 5.7.9 mojaloop/central-event-processor#91)
• 398c429 Update version to v9.2.0 (Bump mongodb-memory-server from 5.2.6 to 6.0.1 mojaloop/central-event-processor#81)
• be4acac Added updated Mojaloop license (Bump nodemon from 1.19.3 to 1.19.4 mojaloop/central-event-processor#78)
• 1c70e43 Added updated Mojaloop license ([Security] Bump mongoose from 5.7.3 to 5.7.5 mojaloop/central-event-processor#77)
• 0f2dfc1 updated dependencies and node version to latest LTS version (Bump @mojaloop/central-services-shared from 8.1.5 to 8.2.0 mojaloop/central-event-processor#75)
• 7b2f9f1 reduced log verbosity (Bump mongodb-memory-server from 5.2.0 to 5.2.3 mojaloop/central-event-processor#59)
• bcd2456 removed unnecessary logger (Bump mongoose from 5.6.9 to 5.6.13 mojaloop/central-event-processor#58)
• 623d5c1 Bug/1114 kafka queue full (Bump @mojaloop/central-services-error-handling from 7.3.0 to 7.4.5 mojaloop/central-event-processor#57)
• 90bd4b8 Remove unused code and dependencies (Bump @mojaloop/central-services-shared from 7.2.0 to 7.5.0 mojaloop/central-event-processor#56)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Directory Traversal