@mojaloop/object-store-lib
Advanced tools
Common object persistence store lib for Mojaloop services.
This repository uses the mojaloop/build CircleCI orb for standardized CI/CD workflows, including automated Grype vulnerability scanning for source code security.
We use audit-ci along with npm audit to check dependencies for node vulnerabilities, and keep track of resolved dependencies with an audit-ci.jsonc file.
To start a new resolution process, run:
npm run audit:fix
You can then check to see if the CI will pass based on the current dependencies with:
npm run audit:check
The audit-ci.jsonc contains any audit-exceptions that cannot be fixed to ensure that CircleCI will build correctly. Please use in conjunction with .grype.yaml to ignore vulnerability when the patched depdendency breaks functionality.
As part of our CI/CD process, we use a combination of CircleCI, standard-version npm package and github-release CircleCI orb to automatically trigger our releases and image builds. This process essentially mimics a manual tag and release.
On a merge to main, CircleCI is configured to use the mojaloopci github account to push the latest generated CHANGELOG and package version number.
Once those changes are pushed, CircleCI will pull the updated main, tag and push a release triggering another subsequent build that also publishes a docker image.
There is a case where the merge to main workflow will resolve successfully, triggering a release. Then that tagged release workflow subsequently failing due to the image scan, audit check, vulnerability check or other "live" checks.
This will leave main without an associated published build. Fixes that require a new merge will essentially cause a skip in version number or require a clean up of the main branch to the commit before the CHANGELOG and bump.
This may be resolved by relying solely on the previous checks of the merge to main workflow to assume that our tagged release is of sound quality. We are still mulling over this solution since catching bugs/vulnerabilities/etc earlier is a boon.
It is unknown if a race condition might occur with multiple merges with main in quick succession, but this is a suspected edge case.
FAQs
Mojaloop library for common object store
The npm package @mojaloop/object-store-lib receives a total of 119 weekly downloads. As such, @mojaloop/object-store-lib popularity was classified as not popular.
We found that @mojaloop/object-store-lib demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.