chore: security updates

.gitignore

@@ -151,7 +151,6 @@ dist
 
 # yarn v2
 .yarn/*
-!.yarn/releases
 !.yarn/plugins
 !.yarn/patches
 !.yarn/versions

.yarnrc.yml

@@ -1,5 +1,3 @@
 compressionLevel: mixed
 
 enableGlobalCache: false
-
-yarnPath: .yarn/releases/yarn-4.5.0.cjs

Dockerfile

@@ -24,30 +24,29 @@ RUN apk add --no-cache \
 
 WORKDIR ${DIR}
 
-COPY ./.yarn ${DIR}.yarn
 COPY ./package.json ./yarn.lock ./.yarnrc.yml ${DIR}/
 
 RUN chown -R node:node ${DIR}
 # Do not run service as root
 USER node
 
-RUN yarn workspaces focus --all --production
+RUN corepack yarn workspaces focus --all --production
 
 # Launch entrypoint with dumb-init
 # Remap SIGTERM to SIGINT https://github.com/Yelp/dumb-init#signal-rewriting
-ENTRYPOINT ["/usr/bin/dumb-init", "--rewrite", "15:2", "--", "yarn", "run"]
+ENTRYPOINT ["/usr/bin/dumb-init", "--rewrite", "15:2", "--", "corepack", "yarn", "run"]
 CMD ["start"]
 
 FROM base AS build
 ARG DIR
 
 # Install dev deps too
-RUN yarn install --immutable
+RUN corepack yarn install --immutable
 
 COPY . ${DIR}
 
 # Build code
-RUN yarn build --verbose
+RUN corepack yarn build --verbose
 
 FROM base AS production
 ARG DIR

package.json

@@ -51,11 +51,11 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@elastic/elasticsearch": "^8.15.1",
-    "@oada/client": "^5.2.3",
+    "@elastic/elasticsearch": "^8.16.1",
+    "@oada/client": "^5.2.6",
     "@oada/jobs": "^4.5.2",
     "@oada/lib-config": "^4.0.0",
-    "@oada/lib-prom": "^4.0.0",
+    "@oada/lib-prom": "^4.0.1",
     "@oada/list-lib": "^4.3.0",
     "@oada/pino-debug": "^4.0.1",
     "@oada/types": "^3.5.3",
@@ -66,53 +66,54 @@
     "js-sha256": "^0.11.0",
     "json-ptr": "^3.1.1",
     "match-json": "^1.3.7",
-    "tslib": "^2.7.0"
+    "tslib": "^2.8.1"
   },
   "devDependencies": {
     "@ava/typescript": "^5.0.0",
     "@tsconfig/node22": "^22.0.0",
     "@types/clone-deep": "^4.0.4",
     "@types/convict": "^6.1.6",
     "@types/debug": "^4.1.12",
-    "@types/lodash": "^4.17.10",
-    "@types/node": "^22.7.5",
+    "@types/lodash": "^4.17.13",
+    "@types/node": "^22.9.1",
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
     "@yarnpkg/sdks": "^3.2.0",
-    "ava": "6.1.3",
+    "ava": "6.2.0",
     "c8": "^10.1.2",
     "eslint": "^8.57.1",
     "eslint-config-prettier": "^9.1.0",
     "eslint-config-xo": "^0.45.0",
     "eslint-config-xo-typescript": "^4.0.0",
     "eslint-plugin-array-func": "^5.0.2",
     "eslint-plugin-ava": "^15.0.1",
-    "eslint-plugin-escompat": "^3.11.3",
+    "eslint-plugin-escompat": "^3.11.4",
     "eslint-plugin-eslint-comments": "^3.2.0",
     "eslint-plugin-filenames": "^1.3.2",
     "eslint-plugin-github": "^5.0.2",
     "eslint-plugin-i18n-text": "^1.0.1",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-no-constructor-bind": "^2.0.4",
     "eslint-plugin-no-only-tests": "^3.3.0",
-    "eslint-plugin-no-secrets": "^1.0.2",
+    "eslint-plugin-no-secrets": "^1.1.2",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-notice": "^1.0.0",
     "eslint-plugin-optimize-regex": "^1.2.1",
     "eslint-plugin-prettier": "^5.2.1",
     "eslint-plugin-promise": "^6.6.0",
-    "eslint-plugin-regexp": "^2.6.0",
+    "eslint-plugin-regexp": "^2.7.0",
     "eslint-plugin-security": "^3.0.1",
     "eslint-plugin-sonarjs": "^1.0.4",
     "eslint-plugin-unicorn": "^54.0.0",
     "prettier": "^3.3.3",
     "typescript": "^5.6.3"
   },
   "resolutions": {
+    "cross-spawn": "^7.0.5",
     "jsonpath-plus": "^10.0.0",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz"
   },
-  "packageManager": "[email protected].0",
+  "packageManager": "[email protected].1",
   "volta": {
     "node": "22.9.0"
   }

src/index.ts

@@ -20,6 +20,8 @@ import '@oada/pino-debug';
 
 import { config } from './config.js';
 
+import '@oada/lib-prom';
+
 // Import this first to setup the environment
 // import { assert as assertTP } from '@oada/types/trellis/trading-partners/trading-partner.js';