fix(security): patch 47 vulnerabilities + update deps, orb, docker

.circleci/config.yml

@@ -1,7 +1,7 @@
 version: 2.1
 setup: true
 orbs:
-  build: mojaloop/build@1.1.19
+  build: mojaloop/build@2.1.7
 workflows:
   setup:
     jobs:

.grype.yaml

@@ -2,7 +2,7 @@ scan-type: source
 ignore:
   - vulnerability: CVE-2025-60876
     include-aliases: true
-    reason: "Alpine base image package (apk): busybox - no npm fix available as of 2026-02-06 (moderate severity)"
+    reason: 'Alpine base image package (apk): busybox - no npm fix available as of 2026-02-06 (moderate severity)'
   - vulnerability: GHSA-34x7-hfp2-rc4v
     include-aliases: true
     reason: >-
@@ -35,13 +35,52 @@ ignore:
       2026-02-23 (low severity)
   - vulnerability: CVE-2026-27171
     include-aliases: true
-    reason: "Alpine base image package (apk): zlib - no npm fix available as of 2026-02-23 (moderate severity)"
-  - vulnerability: GHSA-87r5-mp6g-5w5j
+    reason: 'Alpine base image package (apk): zlib - no npm fix available as of 2026-02-23 (moderate severity)'
+  - vulnerability: GHSA-mh99-v99m-4gvg
     include-aliases: true
-    reason: "Unfixable npm transitive vulnerability: jsonpath (high severity) as of 2026-02-23"
-  - vulnerability: GHSA-2g4f-4pwh-qvx6
+    reason: >-
+      Base image npm package: brace-expansion - bundled in Node.js base image, not fixable via application dependencies
+      as of 2026-09-18 (high severity)
+  - vulnerability: GHSA-rgw5-rvv9-x895
+    include-aliases: true
+    reason: >-
+      Base image npm package: brace-expansion - bundled in Node.js base image, not fixable via application dependencies
+      as of 2026-09-18 (high severity)
+  - vulnerability: GHSA-r292-9mhp-454m
     include-aliases: true
-    reason: "Unfixable npm transitive vulnerability: unknown (unknown severity) as of 2026-02-23"
+    reason: >-
+      Base image npm package: tar - bundled in Node.js base image, not fixable via application dependencies as of
+      2026-09-18 (high severity)
+  - vulnerability: GHSA-mwp4-54f8-5fhr
+    include-aliases: true
+    reason: >-
+      Base image npm package: ip-address - bundled in Node.js base image, not fixable via application dependencies as of
+      2026-09-18 (high severity)
+  - vulnerability: GHSA-4xrf-jv44-h6hh
+    include-aliases: true
+    reason: >-
+      Base image npm package: ip-address - bundled in Node.js base image, not fixable via application dependencies as of
+      2026-09-18 (moderate severity)
+  - vulnerability: GHSA-22jq-vg5j-6vgg
+    include-aliases: true
+    reason: >-
+      Base image npm package: ip-address - bundled in Node.js base image, not fixable via application dependencies as of
+      2026-09-18 (moderate severity)
+  - vulnerability: GHSA-v3r7-h72x-cjcm
+    include-aliases: true
+    reason: >-
+      Base image npm package: undici - bundled in Node.js base image, not fixable via application dependencies as of
+      2026-09-18 (moderate severity)
+  - vulnerability: GHSA-m8rv-5g2x-5cg5
+    include-aliases: true
+    reason: >-
+      Base image npm package: undici - bundled in Node.js base image, not fixable via application dependencies as of
+      2026-09-18 (moderate severity)
+  - vulnerability: GHSA-8xcm-r25x-g524
+    include-aliases: true
+    reason: >-
+      Base image npm package: undici - bundled in Node.js base image, not fixable via application dependencies as of
+      2026-09-18 (moderate severity)
 output:
   - table
   - json

.nvmrc

@@ -1 +1 @@
-22.22.1
+24.21.0

Dockerfile

@@ -1,5 +1,5 @@
 # Arguments
-ARG NODE_VERSION="22.22.0-alpine3.23"
+ARG NODE_VERSION="24.21.0-alpine3.24"
 # NOTE: Ensure you set NODE_VERSION Build Argument as follows...
 #
 #  export NODE_VERSION="$(cat .nvmrc)-alpine" \