Merge pull request #982 from cipherstash/fix/cip-4093-next

fix(deps): bump next to 15.5.24

Author: tobyhede

pnpm-lock.yaml

@@ -62,7 +62,7 @@ catalogs:
     '@vitest/coverage-v8': 3.2.7
   security:
     '@clerk/nextjs': 7.7.7
-    next: 15.5.23
+    next: 15.5.24
     vite: 8.2.1
 
 # Security overrides for Dependabot alerts on transitive deps that Dependabot
@@ -80,7 +80,8 @@ catalogs:
 overrides:
   # #96, #115-#127 — Next.js middleware bypass / SSRF / DoS / XSS batch
   # (GHSA-267c-6grr-h53f, GHSA-26hh-7cqf-hhc6, GHSA-36qx-fr4f-26g5, et al.)
-  'next@<15.5.18': '~15.5.18'
+  # #213, #214 GHSA-2xp9-vwfh-vxw4 / CVE-2026-75604 (CRITICAL) — patched 15.5.24.
+  'next@<15.5.24': '~15.5.24'
   # #87 GHSA-f23m-r3pf-42rh, #88 GHSA-r5fr-rjxr-66jc — lodash _.unset / _.template
   'lodash@<4.18.0': '^4.18.0'
   # #133 GHSA-qjx8-664m-686j — js-cookie attribute injection