Fix security vulnerabilities and request handling bugs

- Move page cache out of the publicly served .bunext/public dir and hash cache keys
- Skip caching credentialed requests, non-2xx and Set-Cookie responses; cap entries
- Enforce API body size limit while reading; keep req body readable for handlers
- Hide error messages from clients in production
- Escape inline script JSON; strip cookies from HMR payloads
- Only trust X-Forwarded-Proto with trust_proxy config
- Fix console race in SSR, dotted page paths, middleware rewrites,
  excluded path status, encoded static file names, symlinked dirs
- Upgrade vulnerable deps, remove micromatch, pin bun versions, delete dead code

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/server/web-pages/generate-web-page-get-cache-page.tsx

@@ -29,6 +29,29 @@ export default async function generateWebPageGetCachePage({
 
     if (cache_page && routeParams?.url) {
         try {
+            const status = serverRes?.response_options?.status;
+
+            if (status && (status < 200 || status >= 300)) {
+                return false;
+            }
+
+            const res_headers = new Headers(
+                serverRes?.response_options?.headers,
+            );
+
+            if (res_headers.has("set-cookie")) {
+                return false;
+            }
+
+            const req_headers = routeParams.req.headers;
+
+            if (
+                !global.BUNEXT_CONFIG?.cache_credentialed_requests &&
+                (req_headers.has("cookie") || req_headers.has("authorization"))
+            ) {
+                return false;
+            }
+
             const is_cache =
                 typeof cache_page == "boolean"
                     ? cache_page