Lock file maintenance

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "before 4am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Caution

[High Risk] Instance replacements will change internal host IPs and break private consumers bound to those addresses

The change replaces inventory-api, payments-api, core-api, fraud_processor, and two public AWS API hosts, but several of those replacements are not pinned to their current internal addresses. In particular, the GCP instances change network_interface.network_ip from fixed current values to (known after apply), and the AWS instance replacements also drop concrete private_ip, private_dns, and ENI identifiers to computed values. That means these hosts will come back with new internal identities unless a separate static address resource preserves them.

Consumers that rely on the current private IPs or the IP-derived private DNS names will lose connectivity after the replacement. This is most acute for the private GCP endpoints behind 10.10.0.2 and 10.10.0.3, and for private AWS integrations like the fraud/core-api path currently tied to 10.50.101.95 and 10.0.101.34. Public reachability for the one AWS host protected by Elastic IP 13.134.236.98 is likely preserved, and the monitoring policies are being updated, but internal-address-dependent integrations will break.
_{View reasoning tree here.}

Signals

Routine → Multiple compute and monitoring resources showing unusual infrequent updates at 1 event/week for the last 2-5 months, with additional infrastructure resources changing only 2-3 events/week for the last 5 months, which is rare compared to typical patterns.

_{Additional Change Details:} Items 94 Edges 193 model|risks_v6 ✨Encryption Key State Risk ✨KMS Key Creation

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: modules/api-server/demo-app/package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-05T13_57_23_350Z-debug-0.log