chore: fix TS build, security updates, and CI config

[gibaros]

Summary

• Fix pre-existing TypeScript compilation errors in HttpServer.ts — cast Hapi Request.headers (Record<string, string | string[] | undefined>) to Headers (Record<string, string>) at lines 112 and 129
• Update all dependencies via ncu (sdk-standard-components 19.18.8, axios 1.13.5, typescript-eslint 8.56.1, npm-check-updates 19.5.0, etc.)
• Add npm overrides for transitive vulnerabilities: axios 1.13.5, fast-xml-parser 5.3.6, cross-spawn 7.0.6, undici 6.23.0, lodash 4.17.23, qs 6.14.2
• Update Dockerfile ARG NODE_VERSION to 22.22.0-alpine3.23
• Update .nvmrc to 22.22.0
• Update CircleCI orb mojaloop/build from 1.1.10 to 1.1.16
• Add scan-type: source to .grype.yaml (prevents grype image scan CI failure when Docker tar not available)
• Clean .grype.yaml: remove stale entries (glob, old zlib), add current base image ignores (tar, minimatch, diff, busybox, zlib)
• Clean audit-ci.jsonc: 14 entries → 3 (only unfixable: ajv, minimatch, lodash-es)

Test plan

• TypeScript build (npm run build) succeeds — no more TS2345 errors
• All 44 unit tests pass across 7 test suites
• npx audit-ci --config ./audit-ci.jsonc passes
• npm run dep:check shows all dependencies up to date
• CircleCI Grype scan passes with scan-type: source
• Docker build succeeds with 22.22.0-alpine3.23

🤖 Generated with Claude Code

[gibaros]

Regarding the code changes, they are required due to:

A breaking change on the patch update to @hapi/hapi

PR #4562 by damusix, titled "fix: auth typings and reduced type
ambiguity", was merged on 2026-02-18 and released in v21.4.5.

The PR description says: "Remove ambiguous types" — which is exactly
what happened. It replaced permissive any types with stricter ones.

The exact diff in lib/types/request.d.ts

The key change (v21.4.4...v21.4.5 comparison):

• Headers: Record<string, any>;

• Headers: Record<string, string | string[] | undefined>;

• Params: Record<string, any>;

• Params: Record<string, string>;

export interface RequestQuery {

• key: string: string | string[] | undefined;
  }

Why it's breaking

• In 21.4.4, request.headers['X-Something'] returned any, so const
  foo: string = request.headers['X-Something'] compiled with no
  complaints.
• In 21.4.5+, it returns string | string[] | undefined, so the same
  line is now a TypeScript error — you need a cast or type guard.

This is a narrowing of a public type contract in a patch release,
which violates semver. Patch versions should be backwards-compatible
bug fixes.

Links

• PR: fix: auth typings and reduced type ambiguity hapijs/hapi#4562
• Commit diff:
  hapijs/hapi@v21.4.4...v21.4.5
• Related issue (the auth regression it fixed):
  Possible typing regression between v21.3.12 and v21.4.4 hapijs/hapi#4561
• Related issue: Incorrect / overly strict types in 21.4.5 hapijs/hapi#4565
• Related issue: Patch 21.4.5 introduces TypeScript compile-time breaking change hapijs/hapi#4563

[elnyry-sam-k]

👍