Enforce nextjs peerDependency to 14.2.25 and 15.2.3

[frederikprijck]

📋 Changes

With this PR, I am proposing to update the peerDependencies to ensure users use a version of NextJS that isn't vulnerable to GHSA-f82v-jwr5-mffw.

Looking at the advisory, we can see the issue is fixed in nextjs 14.2.25 and 15.2.3

This would technically be a breaking change, but as this SDK relies on authorization in middleware, I think we should release this as a minor version bump.

A more in-depth write-up of the issue is available here.

If upgrading NextJS version to any non-vulnerable version is not possible in your application, ensure to add the recommended protection:

export function middleware(request: NextRequest) {
  if (request.headers.has('x-middleware-subrequest')) {
    return new Response('Unauthorized', { status: 401 });
  }
  return NextResponse.next();
}

For more on why this code helps prevent the issue, read the in-depth write up.

📎 References

GHSA-f82v-jwr5-mffw
https://zeropath.com/blog/nextjs-middleware-cve-2025-29927-auth-bypass

🎯 Testing

N/A

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 76.16%. Comparing base (fd3ed1e) to head (48f623d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1988   +/-   ##
=======================================
  Coverage   76.16%   76.16%           
=======================================
  Files          21       21           
  Lines        1523     1523           
  Branches      242      242           
=======================================
  Hits         1160     1160           
  Misses        356      356           
  Partials        7        7           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[arpit-jn]

LGTM