chore: update reported packages

[maxim-inj]

Updated dependencies and lockfile, keeping Vite on 8.1.4 and setting node >=24.0.0. Added overrides for vulnerable transitive packages, including CosmJS, ws, axios, hono, vite, etc. Also adjusted the EIP-712 test mocks in so they work with Vitest 4 constructor mocking.

Verification:

• socket npm i: passed, “found no new risks”
• npm audit --json: 0 vulnerabilities

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Toolchain and EVM test updates

Layer / File(s)	Summary
Dependency and runtime requirements package.json	Runtime, development, and override package versions were refreshed, and the minimum Node.js version was raised to 24.
EVM test mock declarations src/evm/eip712.test.ts	SDK and ethers mocks now use function declarations while preserving their mocked payloads and return values.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the dependency and package override updates in the pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/update-pkgs

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​2.1.9 ⏵ 4.1.10	+1	+75	+1
	@​types/​node@​22.7.9 ⏵ 24.13.3			+1	+1
	@​injectivelabs/​networks@​1.17.8 ⏵ 1.20.23				+1
	@​injectivelabs/​utils@​1.17.8 ⏵ 1.20.23	+1		+1	+1
	@​modelcontextprotocol/​sdk@​1.26.0 ⏵ 1.29.0
	@​injectivelabs/​sdk-ts@​1.17.8 ⏵ 1.20.23	+1		+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/vitest@4.1.10 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @injectivelabs/core-proto-ts-v2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@injectivelabs/sdk-ts@1.20.23 → npm/@injectivelabs/core-proto-ts-v2@1.20.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@injectivelabs/core-proto-ts-v2@1.20.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

This PR refreshes the project’s dependency set (and lockfile) to newer versions, adds npm overrides to pin vulnerable transitive packages, and updates EIP-712 unit test mocks to remain compatible with Vitest 4’s constructor-mocking behavior.

Changes:

• Bumped runtime and dev dependencies (notably @injectivelabs/*, @modelcontextprotocol/sdk, typescript, vitest).
• Added overrides to pin specific transitive package versions (e.g., CosmJS, axios, ws, hono, vite).
• Updated src/evm/eip712.test.ts mocks to use function constructors (instead of arrow/mockImplementation) for classes instantiated via new.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
src/evm/eip712.test.ts	Adjusts mocked constructors (Wallet, ChainRest*Api) to work with Vitest 4 when code calls them with new.
package.json	Updates dependency versions, adds overrides, and bumps Node engine requirement to >=24.0.0.
package-lock.json	Reflects the updated dependency graph and the new pinned transitive versions from overrides.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.