security: patch all dependency vulnerabilities (8 high → 0)

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -18,7 +19,8 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 20.19
+          check-latest: true
           cache: npm
 
       - name: Install

README.md

@@ -57,7 +57,7 @@ common path:
 
 1. Push the repo to GitHub (or fork this one).
 2. Go to [vercel.com/new](https://vercel.com/new) and import the repo.
-   Next.js 14 is auto-detected — leave the build/output settings on default.
+   Next.js 15 is auto-detected — leave the build/output settings on default.
 3. Click **Deploy**. First build takes ~30 seconds.
 4. Visit your `*.vercel.app` URL. All four tools should work immediately.
 
@@ -257,7 +257,7 @@ push and pull request.
 
 ## Stack
 
-- **Next.js 14** (App Router) on **Vercel**
+- **Next.js 15** (App Router) on **Vercel**
 - **TypeScript 5** strict mode
 - **Tailwind 3** with a small dark palette (`ink-*` + `accent-*`)
 - **Web Crypto API** for the JWT crack (no Node crypto in the browser)

app/layout.tsx

@@ -27,8 +27,8 @@ export const metadata: Metadata = {
   robots: { index: true, follow: true },
 };
 
-export default function RootLayout({ children }: { children: React.ReactNode }) {
-  const nonce = headers().get("x-nonce") ?? undefined;
+export default async function RootLayout({ children }: { children: React.ReactNode }) {
+  const nonce = (await headers()).get("x-nonce") ?? undefined;
   return (
     <html lang="en">
       <body className="font-sans antialiased" data-nonce={nonce}>