chore: update dependencies in package.json

[lichdu29]

• upgraded @cosmjs/stargate from ^0.33.0 to ^0.39.0
• downgraded @socialgouv/matomo-next from ^1.6.1 to ^1.2.1
• downgraded ethereumjs-util from ^7.1.5 to ^7.0.2
• upgraded @graphql-codegen packages to major versions:
  • @graphql-codegen/cli from ^5.0.5 to ^7.1.2
  • @graphql-codegen/client-preset from ^3.0.1 to ^6.0.1
  • @graphql-codegen/fragment-matcher from ^4.0.1 to ^7.0.1
  • @graphql-codegen/typescript from ^3.0.4 to ^6.0.2
  • @graphql-codegen/typescript-operations from ^3.0.4 to ^6.0.3
  • @graphql-codegen/typescript-react-apollo from ^3.3.7 to ^4.4.2

[karlkeppner1]

Pushed a commit aligning this PR with chains/realio-testnet, where the same upgrades landed as #61 and have now soaked. @lichdu29 — flagging two changes I reverted, in case they were deliberate.

Reverted (looked unintentional — both moved backwards)

package	this PR had	restored to
ethereumjs-util	^7.0.2	^7.1.5
@socialgouv/matomo-next	^1.2.1	^1.6.1

Moving backwards on a range can reintroduce advisories a later release fixed. If these were intentional, say so and I'll put them back.

Unchanged

The seven genuine upgrades are exactly as you had them, and now match testnet: @cosmjs/stargate ^0.39.0 plus the six @graphql-codegen majors.

Added

chains/realio never received the security fixes that landed on testnet as #60, and without them npm audit --audit-level=critical fails on this base (2 critical). Carried over:

• overrides.tar ^7.5.22 — GHSA-r292-9mhp-454m and others
• overrides.shell-quote ^1.10.0 — command injection
• next ^15.5.22 — GHSA-9qr9-h5gf-34mp, RCE in the React flight protocol

package.json is now identical to chains/realio-testnet for all ten entries plus overrides.

Verification

Lockfile regenerated on the chains/realio base with npm 11.19.0, so the min-release-age=3 cooldown in .npmrc actually applies (it needs npm >= 11.10.0 and is silently ignored below that).

• npm ci --dry-run under npm 10.9.2 — the npm that node-version: 23 ships in common-test → exit 0
• npm audit --audit-level=critical → exit 0 (0 critical / 15 high, was 2 critical / 16 high)
• Full docker build including npm run build:next → succeeds, so the six codegen majors don't break the Next.js build

⚠️ Before merging

chains/realio's Dockerfile has the same unpinned npm i -g npm@latest that just broke the testnet build (run 31193609639) — npm@latest is now 12.0.2, which dropped node 23, and this image is node:23-alpine with engine-strict=true.

common-test doesn't run a Docker build on PRs, so this PR will go green and the mainnet build will fail after merge. #62 fixes it for testnet; chains/realio needs the same pin. I left it out here to keep this PR scoped to dependencies — happy to add it if you'd rather land both together.