fix: update next to resolve CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

• Dependency: next updated from ^15.5.22 to ^15.5.24
• Advisories:
  • CVE-2026-75604 — Unauthenticated RCE on windows-hosted servers: GHSA-p293-qw3h-jr36
  • GHSA-2xp9-vwfh-vxw4 — Unauthenticated RCE in Image Optimization API when AVIF files are used: GHSA-2xp9-vwfh-vxw4
• Dependabot alerts:
  • https://github.com/warpdotdev/do-things/security/dependabot/39
  • https://github.com/warpdotdev/do-things/security/dependabot/40
• Verification: npm audit no longer reports next; npm run build succeeds (compiles, lints, types check, generates pages).

Highlight the risky code / where the dependency was used

This is a Next.js app (app/), so the framework upgrade touches the whole app. No custom Next config changes needed; patch release, no breaking API changes expected.

Special instructions for this PR

None — straightforward patch bump within the ^15.5.x range already declared in package.json.

AFTER YOU MERGE

None.