Fix security vulnerabilities and request handling bugs

- Move page cache out of the publicly served .bunext/public dir and hash cache keys
- Skip caching credentialed requests, non-2xx and Set-Cookie responses; cap entries
- Enforce API body size limit while reading; keep req body readable for handlers
- Hide error messages from clients in production
- Escape inline script JSON; strip cookies from HMR payloads
- Only trust X-Forwarded-Proto with trust_proxy config
- Fix console race in SSR, dotted page paths, middleware rewrites,
  excluded path status, encoded static file names, symlinked dirs
- Upgrade vulnerable deps, remove micromatch, pin bun versions, delete dead code

Co-Authored-By: Claude Opus 5.5 <[email protected]>

This commit is contained in:

tben

2026-10-13 15:48:08 +01:00

co-authored by

Claude Opus 5.5

parent 4238d9a4ea

commit 74103a19c9

37 changed files with 708 additions and 573 deletions

									
										.github/workflows/publish.yml
									
		+1
		-1
	
												View File
												
				@@ -15,7 +15,7 @@ jobs:

				      - uses: oven-sh/setup-bun@v2

				        with:

				          bun-version: latest

				          bun-version: 1.3.14

				      - name: Install dependencies

				        run: bun install --frozen-lockfile