fix(security): resolve Dependabot alerts

.github/workflows/trivy.yaml

@@ -18,7 +18,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Run Trivy scanner in repo mode
-        uses: aquasecurity/trivy-action@0.33.1
+        uses: aquasecurity/trivy-action@0.35.0
         with:
           scan-type: "fs"
           ignore-unfixed: true

ReadMe.md

@@ -104,7 +104,7 @@ Publishing remains synchronous. A command that emits an event waits for Bus API
 
 ### Automated-test settings
 
-The existing test-only settings remain supported: `WAIT_TIME`, `MOCK_CHALLENGE_API_PORT`, `MOCK_API_PORT`, `AUTH_V2_URL`, `AUTH_V2_CLIENT_ID`, `AUTH_V3_URL`, the admin/copilot/user credential variables, `AUTOMATED_TESTING_REPORTERS_FORMAT`, and `AUTOMATED_TESTING_NAME_PREFIX`.
+The existing test-only settings remain supported: `WAIT_TIME`, `MOCK_CHALLENGE_API_PORT`, `MOCK_API_PORT`, `AUTH_V2_URL`, `AUTH_V2_CLIENT_ID`, `AUTH_V3_URL`, the administrator, copilot, and user credential variables, `AUTOMATED_TESTING_REPORTERS_FORMAT`, and `AUTOMATED_TESTING_NAME_PREFIX`. The runner exchanges all four token types referenced by the resource collection and its iteration-data fixtures: M2M, administrator, copilot, and user.
 
 ## Local database setup
 
@@ -159,6 +159,8 @@ pnpm run test:newman
 pnpm run test:newman:clear
 ```
 
+The Postman entrypoint uses Newman 6 directly and retains the existing token coverage, per-folder execution order, cleanup, and `newman/reports.html` CircleCI artifact. The `html` reporter name selects that local aggregate report; the supported `cli`, `json`, and `junit` reporter names are passed through to Newman.
+
 CircleCI performs the Docker build and deployment using the existing `APPNAME`, `DEPLOY_ENV`, and parameter-store paths. The automated-test workflow uses Node 26.5.0, pnpm 11.15.1, and the same deployment environment names.
 
 See `Verification.md` for the regression checklist.

Verification.md

@@ -91,4 +91,4 @@ On the `typescript` branch, confirm that:
 - Deployment still uses `APPNAME=resources-api-v6` and the existing DEV/PROD parameter-store paths.
 - Dependency setup removes the image's preconfigured Chrome and Docker APT sources before updating package indexes; both tools are already installed in that image.
 - The Newman job runs on Node 26.5.0 with pnpm 11.15.1 from the repository root.
-- The health wait succeeds before the Postman scripts run and Newman artifacts are retained.
+- The health wait succeeds before the Postman scripts run, Newman 6 executes every configured folder, and `newman/reports.html` is retained even though the obsolete shared test library and its unmaintained Request dependency are absent.

eslint.config.mjs

@@ -44,6 +44,7 @@ export default tseslint.config(
   {
     files: [
       'test/common/prepare.js',
+      'test/postman/newman.js',
       'test/unit/createResource.test.js',
       'test/unit/getResources.test.js'
     ],

package.json

@@ -11,7 +11,7 @@
     "start:debug": "nest start --debug --watch",
     "start:prod": "node dist/main.js",
     "postinstall": "pnpm run prisma:generate",
-    "lint": "eslint --no-error-on-unmatched-pattern \"*.ts\" \"src/**/*.ts\" \"prisma/**/*.ts\" \"test/**/*.ts\" \"test/common/prepare.js\" \"test/unit/createResource.test.js\" \"test/unit/getResources.test.js\"",
+    "lint": "eslint --no-error-on-unmatched-pattern \"*.ts\" \"src/**/*.ts\" \"prisma/**/*.ts\" \"test/**/*.ts\" \"test/common/prepare.js\" \"test/postman/newman.js\" \"test/unit/createResource.test.js\" \"test/unit/getResources.test.js\"",
     "lint:fix": "pnpm lint --fix",
     "format": "prettier --write \"*.ts\" \"src/**/*.ts\" \"prisma/**/*.ts\" \"test/**/*.ts\"",
     "prisma:generate:resource": "prisma generate --schema=./prisma/schema.prisma --generator client",
@@ -43,10 +43,10 @@
     "mocha": "^11.7.4",
     "nock": "^14.0.16",
     "nodemon": "^3.1.9",
+    "newman": "6.2.2",
     "nyc": "^17.1.0",
     "prettier": "^3.6.2",
     "should": "^13.2.3",
-    "tc-api-testing-lib": "https://codeload.github.com/topcoder-platform/api-automated-testing/tar.gz/dd0118f41612764bed344c31affb40b7448949c5",
     "ts-loader": "^9.5.2",
     "ts-node": "^10.9.2",
     "typescript": "5.9.3",
@@ -59,7 +59,7 @@
     "@prisma/adapter-pg": "7.8.0",
     "@prisma/client": "7.8.0",
     "bluebird": "^3.5.1",
-    "body-parser": "^1.15.1",
+    "body-parser": "1.20.6",
     "config": "^3.0.1",
     "cors": "^2.7.1",
     "dotenv": "^17.2.3",

pnpm-workspace.yaml

@@ -1,8 +1,22 @@
 overrides:
   '@topcoder-platform/topcoder-bus-api-wrapper>tc-core-library-js': https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4
-  '@hono/node-server@<1.19.13': 1.19.13
+  '@hono/node-server@<2.0.11': 2.0.11
+  'ajv@>=6.0.0 <6.14.0': 6.15.0
   'axios@<1.18.1': 1.18.1
-  'brace-expansion@1.1.12': 1.1.13
+  'body-parser@<1.20.6': 1.20.6
+  'brace-expansion@<1.1.16': 1.1.16
+  'diff@>=6.0.0 <8.0.3': 8.0.3
+  'fast-uri@>=3.0.0 <3.1.4': 3.1.4
+  'flatted@<3.4.2': 3.4.2
+  'handlebars@<4.7.9': 4.7.9
+  'jose@>=3.0.0 <4.15.5': 4.15.5
+  'js-yaml@>=3.0.0 <3.15.0': 3.15.0
+  'lodash@<4.18.1': 4.18.1
+  'node-forge@<1.4.0': 1.4.0
+  'picomatch@<2.3.2': 2.3.2
+  'serialize-javascript@>=5.0.0 <7.0.7': 7.0.7
+  'underscore@<1.13.8': 1.13.8
+  'uuid@<11.1.1': 11.1.1
   'follow-redirects@<1.16.0': 1.16.0
   'form-data@<4.0.6': 4.0.6
   'minimatch@3.1.2': 3.1.4

test/postman/README.md

@@ -7,6 +7,7 @@
 ## Running the tests locally
 
 - Follow the steps from the [Readme](../../ReadMe.md)
+- The runner requires the configured M2M client plus administrator, copilot, and user credentials. It uses Newman 6 directly and writes the aggregate HTML artifact to `newman/reports.html`.
 
 ## Running the tests on CircleCI