chore(deps): bump github.com/moov-io/ach from 1.62.1 to 1.63.1

[dependabot]

Bumps github.com/moov-io/ach from 1.62.1 to 1.63.1.

Release notes

Sourced from github.com/moov-io/ach's releases.

v1.63.1

What's Changed

Bug Fixes — File merging

• MergeDir stability: complete via channel close and drain instead of cancel-only shutdown, so in-flight parsers are not left blocked on errors (no deadlock when ADV/corrupt files appear among valid inputs). File header / validate opts are set on the merge goroutine to avoid races with parser workers.
• MaxDollarAmount is per side: debit and credit totals are limited independently to match NACHA file control totals. Mixed debit+credit files under a shared cap may now stay in one file when each side is under the limit (previously a combined running total could split incorrectly).
• walkDir: subdirectories are no longer enqueued as merge inputs after recursion (only their files are).
• Parse workers: default concurrency is adaptive (4 * GOMAXPROCS, clamped 8–50) instead of a fixed 50.
• Tests: expanded merge coverage (IAT limits, error/cancel paths, entry-loss checks) and split into merge_test.go, merge_dir_test.go, merge_iat_test.go, and merge_internal_test.go.

Commits since v1.63.0

• 471afd2 fix(merge): stabilize MergeDir and track debit/credit limits separately (#1823)
• 969b02f test(merge): expand coverage and split merge tests into focused files
• a38725d chore: updating wasm webui [skip ci]

Full Changelog: moov-io/ach@v1.63.0...v1.63.1

v1.63.0

What's Changed

Security — CORS origin allowlist via moov-io/base v0.63.0

Bump github.com/moov-io/base to v0.63.0.

Credentialed CORS no longer reflects arbitrary https:// Origins with Access-Control-Allow-Credentials: true. Existing AddCORSHandler / SetAccessControlAllowHeaders / Wrap call sites now honor base's shared allowlist.

Deploy / upgrade

• Set MOOV_CORS_ALLOW_ORIGINS to a comma-separated list of exact browser Origins where credentialed cross-origin calls are expected (e.g. https://moov.io,https://dashboard.moov.io).
• Loopback HTTP origins remain allowed for local development (http://localhost[:port], http://127.0.0.1[:port]).
• Server-to-server / non-browser clients are unaffected (CORS is browser-enforced).
• Unlisted Origins receive no Access-Control-Allow-Origin / credentials headers.

Thanks to @​SashaMIT for the CORS allowlist work.

Full Changelog: moov-io/ach@v1.62.1...v1.63.0

Commits

• 969b02f test(merge): expand coverage and split merge tests into focused files
• 471afd2 fix(merge): stabilize MergeDir and track debit/credit limits separately (#1823)
• a38725d chore: updating wasm webui [skip ci]
• e65734f fix(deps): bump moov-io/base to v0.63.0 for CORS origin allowlist (#1831)
• b4f5a7e chore: updating wasm webui [skip ci]
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #319.