security: update Next.js to 15.5.18 to address critical vulnerabilities (#1507)

Updates Next.js from 15.5.15 to 15.5.18 to patch multiple high-severity
security vulnerabilities disclosed in May 2026:

- CVE-2025-66478: Middleware/Proxy bypass via dynamic route parameter
  injection (CVSS 8.1) - affected versions 15.4.0-15.5.15
- DoS via connection exhaustion in Cache Components (CVSS 7.5) -
  affected versions 15.0.0-15.5.15
- 5 additional high-severity issues including DoS with Server Components,
  middleware bypasses, and SSRF in WebSocket upgrades

Also updates related packages:
- @next/mdx: 15.5.5 → 15.5.18
- eslint-config-next: 15.5.9 → 15.5.18

All security patches are included in version 15.5.16+. This update to
15.5.18 ensures the latest fixes and improvements.

Build verified successfully with no breaking changes.

References:
- GHSA-492v-c6pp-mqqv
- GHSA-mg66-mrh9-m8jx
- https://github.com/vercel/next.js/releases/tag/v15.5.16

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: BekahHW

package.json

@@ -28,7 +28,7 @@
 		"@imgix/js-core": "^3.8.0",
 		"@mdx-js/loader": "^3.1.1",
 		"@mdx-js/react": "^3.1.1",
-		"@next/mdx": "15.5.5",
+		"@next/mdx": "15.5.18",
 		"@sindresorhus/slugify": "^2.2.1",
 		"@types/mdx": "^2.0.13",
 		"airtable": "^0.12.2",
@@ -44,7 +44,7 @@
 		"luxon": "^3.7.2",
 		"markdown-it": "^14.1.1",
 		"mdast-util-toc": "^7.1.0",
-		"next": "^15.5.15",
+		"next": "15.5.18",
 		"npm-watch": "^0.13.0",
 		"react": "^19.2.3",
 		"react-dom": "^19.2.3",
@@ -79,7 +79,7 @@
 		"cross-env": "^10.1.0",
 		"esbuild": "^0.25.12",
 		"eslint": "^9.39.2",
-		"eslint-config-next": "^15.5.9",
+		"eslint-config-next": "15.5.18",
 		"netlify-cli": "^23.13.0",
 		"postcss": "^8.5.10",
 		"prettier": "^3.7.4",