Fix security vulnerabilities and request handling bugs

- Move page cache out of the publicly served .bunext/public dir and hash cache keys
- Skip caching credentialed requests, non-2xx and Set-Cookie responses; cap entries
- Enforce API body size limit while reading; keep req body readable for handlers
- Hide error messages from clients in production
- Escape inline script JSON; strip cookies from HMR payloads
- Only trust X-Forwarded-Proto with trust_proxy config
- Fix console race in SSR, dotted page paths, middleware rewrites,
  excluded path status, encoded static file names, symlinked dirs
- Upgrade vulnerable deps, remove micromatch, pin bun versions, delete dead code

Co-Authored-By: Claude Opus 5.5 <[email protected]>

package.json

@@ -4,34 +4,32 @@
     "main": "dist/index.js",
     "module": "index.ts",
     "dependencies": {
-        "@tailwindcss/postcss": "^4.2.2",
-        "@types/bun": "latest",
+        "@tailwindcss/postcss": "^4.3.3",
+        "@types/bun": "1.3.14",
         "@types/node": "^24.10.0",
-        "@types/react": "^19.2.2",
-        "@types/react-dom": "^19.2.2",
+        "@types/react": "^19.3.0",
+        "@types/react-dom": "^19.3.0",
         "bun-plugin-tailwind": "^0.1.2",
         "chalk": "^5.6.2",
         "chokidar": "^5.0.0",
         "commander": "^14.0.2",
         "esbuild": "^0.28.2",
         "lightningcss-wasm": "^1.32.0",
-        "lodash": "^4.17.23",
-        "micromatch": "^4.0.8",
+        "lodash": "^4.18.1",
         "ora": "^9.0.0",
-        "postcss": "^8.5.8",
-        "react": "^19.2.4",
-        "react-dom": "^19.2.4",
-        "tailwindcss": "^4.2.2",
+        "postcss": "^8.5.30",
+        "react": "^19.3.0",
+        "react-dom": "^19.3.0",
+        "tailwindcss": "^4.3.3",
         "typescript": "^5.0.0",
         "uuid": "^14.0.2"
     },
     "devDependencies": {
         "@testing-library/dom": "^10.4.1",
         "@types/chokidar": "^2.1.7",
-        "@types/lodash": "^4.17.24",
-        "@types/micromatch": "^4.0.10",
+        "@types/lodash": "^4.17.26",
         "@types/uuid": "^11.0.0",
-        "happy-dom": "^20.8.4"
+        "happy-dom": "^20.14.6"
     },
     "exports": {
         ".": {