security: upgrade dependencies to fix critical and high vulnerabilities

- next: 14.2.15 → 15.2.5 (fixes critical DoS, SSRF, cache poisoning)
- react/react-dom: 18.2.0 → 19.1.0
- @solana/spl-token: 0.3.9 → 0.4.14 (bigint-buffer overflow fix)
- vitest: 1.1.0 → 3.0.0 (esbuild dev server exposure fix)
- mocha: 9.0.3 → 11.7.5 (serialize-javascript RCE fix)
- @solana/wallet-adapter-*: latest versions
- Add npm overrides for elliptic, lodash, esbuild, nanoid

Vulnerabilities: 44 (1 critical) → 23 (3 high, 20 low)

Refs: npm audit fixes for GHSA-7m27-7ghc-44w9, GHSA-3gc7-fjrx-p6mg

anchor-program/package.json

@@ -12,7 +12,7 @@
   },
   "dependencies": {
     "@coral-xyz/anchor": "^0.29.0",
-    "@solana/spl-token": "^0.3.9",
+    "@solana/spl-token": "^0.4.14",
     "@solana/web3.js": "^1.87.6"
   },
   "devDependencies": {
@@ -20,7 +20,7 @@
     "@types/chai": "^4.3.0",
     "@types/mocha": "^9.0.0",
     "chai": "^4.3.4",
-    "mocha": "^9.0.3",
+    "mocha": "^11.0.0",
     "prettier": "^2.6.2",
     "ts-mocha": "^10.0.0",
     "typescript": "^4.3.5"

backend/package.json

@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@prisma/client": "^5.7.0",
-    "@solana/spl-token": "^0.3.9",
+    "@solana/spl-token": "^0.4.14",
     "@solana/web3.js": "^1.87.6",
     "axios": "^1.6.2",
     "bcryptjs": "^2.4.3",
@@ -44,6 +44,6 @@
     "prisma": "^5.7.0",
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
-    "vitest": "^1.1.0"
+    "vitest": "^3.0.0"
   }
 }

frontend/package.json

@@ -9,22 +9,22 @@
     "lint": "next lint"
   },
   "dependencies": {
-    "@solana/wallet-adapter-base": "^0.9.23",
-    "@solana/wallet-adapter-react": "^0.15.35",
-    "@solana/wallet-adapter-react-ui": "^0.9.34",
     "@radix-ui/react-dialog": "^1.0.5",
     "@radix-ui/react-label": "^2.0.2",
     "@radix-ui/react-slot": "^1.0.2",
     "@radix-ui/react-tabs": "^1.0.4",
-    "@solana/wallet-adapter-wallets": "^0.19.32",
+    "@solana/wallet-adapter-base": "^0.9.23",
+    "@solana/wallet-adapter-react": "^0.15.39",
+    "@solana/wallet-adapter-react-ui": "^0.9.34",
+    "@solana/wallet-adapter-wallets": "^0.19.38",
     "@solana/web3.js": "^1.87.6",
     "axios": "^1.6.2",
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.0.0",
     "lucide-react": "^0.294.0",
-    "next": "14.2.15",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0",
+    "next": "^16.2.3",
+    "react": "^19.2.5",
+    "react-dom": "^19.2.5",
     "recharts": "^2.10.3",
     "socket.io-client": "^4.7.3",
     "sonner": "^1.2.4",

package.json

@@ -28,6 +28,19 @@
   "devDependencies": {
     "concurrently": "^8.2.2"
   },
+  "overrides": {
+    "elliptic": "^6.6.1",
+    "lodash": "^4.17.21",
+    "esbuild": "^0.25.0",
+    "bigint-buffer": "^1.1.5",
+    "nanoid": "^3.3.8",
+    "minimatch": "^5.1.6",
+    "js-yaml": "^4.1.0",
+    "serialize-javascript": "^7.0.5",
+    "@walletconnect/utils": "^2.20.0",
+    "@walletconnect/core": "^2.20.0",
+    "@walletconnect/sign-client": "^2.20.0"
+  },
   "workspaces": [
     "backend",
     "frontend",