Security: Fix React2Shell RCE by upgrading Next.js to 15.5.7

[Copilot]

Next.js 15.1.2 is vulnerable to React2Shell RCE (CVE affecting React flight protocol), DoS via cache poisoning, and authorization bypass in middleware.

Changes

• Upgraded next from 15.1.2 to 15.5.7 - patches all three vulnerabilities
• Upgraded @next/mdx to ^15.5.7 for version compatibility
• Added package-lock.json to .gitignore (project uses pnpm)

Vulnerabilities Fixed

Issue	Severity	Affected Versions	Status
React2Shell RCE	Critical	15.1.0-canary.0 to < 15.1.9	✅ Fixed
Cache poisoning DoS	High	15.0.4-canary.51 to < 15.1.8	✅ Fixed
Middleware auth bypass	High	15.0.0 to < 15.2.3	✅ Fixed

Verified with gh-advisory-database: Next.js 15.5.7 has no known vulnerabilities.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Need to check if vulnerable</issue_title>
<issue_description>

schdesign-web/package.json

Line 49 in a37770a

"next": "15.1.2",

</issue_description>

<agent_instructions>Check if next version is not vulnerable recently found React2Shell vulnerability</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Need to check if vulnerable #45

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.