Fix next.js vulnerability in onchain-app-template: upgrade to ^15.2.9

[Copilot]

next ^14.2.35 falls within the vulnerable range >= 13.0.0, < 15.0.8 for an HTTP request deserialization DoS (insecure React Server Components). Minimum safe version is 15.0.8; bumped to ^15.2.9 which has no known vulnerabilities.

Changes

• onchain-app-template/package.json
  • next: ^14.2.35 → ^15.2.9
  • resolutions retained for transitive dependency fixes (cross-spawn, sha.js, node-forge, bn.js, glob, h3, lodash, minimatch)
  • @wagmi/cli pinned at 2.10.0 (picks up patched esbuild)

"dependencies": {
  "next": "^15.2.9"
},
"resolutions": {
  "cross-spawn": "^7.0.5",
  "sha.js": "^2.4.12",
  "node-forge": "^1.3.3",
  "bn.js": "^5.2.3",
  "glob": "^10.5.0",
  "h3": "^1.15.5",
  "lodash": "^4.17.23",
  "minimatch": "^10.2.1"
}

Original prompt

Reference: 2cddc04

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.