chore: update SDK dependencies

[prd-carapulse]

Summary

• Updated dependencies and devDependencies across the private root and non-deprecated workspaces.
• Skipped the frozen deprecated packages and preserved their package manifests, source, tests, docs, config, and release metadata unchanged.
• Kept TypeScript on 6.0.3, GraphQL on 16.14.2, and Biome on 2.5.2 because the newer candidates were incompatible with the current toolchain or failed linting.
• Migrated the existing ox compatibility patch from 0.14.29 to 0.14.30, required by the updated viem dependency graph.
• Regenerated pnpm-lock.yaml while preserving the repository supply-chain policy.
• Updated WDK wallet runtime dependencies in @morpho-org/wdk-protocol-lending-morpho-evm.

peerDependencies widened only when required: yes

No peer range required widening because every updated same-manifest devDependency remained accepted by its existing peer range.

Changesets markdown: .changeset/fresh-wdk-toolchain.md

Changesets release scope matches direct/peer/source-only criteria: yes

The changeset contains a patch release for exactly @morpho-org/wdk-protocol-lending-morpho-evm, whose direct runtime dependencies changed. DevDependency-only workspaces are excluded.

Frozen deprecated packages

The weekly freeze policy was enforced for:

• @morpho-org/liquidation-sdk-viem
• @morpho-org/bundler-sdk-viem
• @morpho-org/migration-sdk-viem
• @morpho-org/simulation-sdk
• @morpho-org/blue-sdk-wagmi
• @morpho-org/simulation-sdk-wagmi
• @morpho-org/test-wagmi

The deprecated-package path diff and deprecated-package changeset checks are both empty. No root exact override matched a root direct dependency, so no root pnpm.overrides synchronization was required.

Verification

• ✅ pnpm install --frozen-lockfile --ignore-scripts
• ✅ pnpm run build:ci
• ✅ pnpm run lint:ci
• ⚠️ pnpm run test:ci: 202 test files passed; 12 fork/RPC-backed files failed with zero-data/storage-slot errors. Focused failures in packages/blue-sdk-viem/test/Vault.test.ts and packages/test/test/utils.test.ts reproduce unchanged on origin/main with viem 2.54.2, confirming a local fork/RPC environment blocker rather than a dependency-update regression.
• ✅ pnpm exec changeset status --since=origin/main reports only @morpho-org/wdk-protocol-lending-morpho-evm at patch.
• ✅ git diff --check

Request Context

• Initiator: Romain (Rubilmax) / GitHub: @Rubilmax
• Initial Slack DM thread: thread_ts 1778485891.710059
• Additional context: scheduled weekly dependency update for morpho-org/sdks
• Rationale: Update all non-deprecated root/workspace runtime and development dependencies every Monday, preserve frozen deprecated packages, widen peers only when necessary, keep quality gates passing where the environment permits, and add Changesets metadata only for packages that need a release.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cf093a767f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep the ox 0.14.29 patch active

Because the regenerated lockfile still resolves the frozen deprecated workspaces' viem@2.52.2 to ox@0.14.29 while only ox@0.14.30 is patched, that remaining 0.14.29 copy loses the same TypeScript compatibility fix that previously existed. Any local build/typecheck path that still recurses those packages (for example the root pnpm build, even though build:ci excludes them) can now hit the unpatched ox source again. Please keep the old ox@0.14.29 patchedDependency alongside the new one until no importer resolves it.

Useful? React with 👍 / 👎.