Fix security vulnerabilities and request handling bugs

- Move page cache out of the publicly served .bunext/public dir and hash cache keys
- Skip caching credentialed requests, non-2xx and Set-Cookie responses; cap entries
- Enforce API body size limit while reading; keep req body readable for handlers
- Hide error messages from clients in production
- Escape inline script JSON; strip cookies from HMR payloads
- Only trust X-Forwarded-Proto with trust_proxy config
- Fix console race in SSR, dotted page paths, middleware rewrites,
  excluded path status, encoded static file names, symlinked dirs
- Upgrade vulnerable deps, remove micromatch, pin bun versions, delete dead code

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/types/index.ts

@@ -63,6 +63,23 @@ export type BunextConfig = {
         | Request
         | undefined;
     default_cache_expiry?: number;
+    /**
+     * Maximum number of cached pages kept on disk. New pages are not
+     * cached once this is reached. Defaults to 1000.
+     */
+    max_cache_entries?: number;
+    /**
+     * By default, pages are not written to the cache when the request
+     * carries a `Cookie` or `Authorization` header, so one user's page is
+     * never served to everyone. Set this to `true` only if your cached
+     * pages never render per-user content.
+     */
+    cache_credentialed_requests?: boolean;
+    /**
+     * Trust the `X-Forwarded-Proto` header (set this when running behind a
+     * reverse proxy that sets it). Defaults to `false`.
+     */
+    trust_proxy?: boolean;
     websocket?: WebSocketHandler<any>;
     server_options?: Omit<Bun.Serve.Options<any>, "fetch" | "routes">;
     /**
@@ -354,7 +371,6 @@ export type BundlerCTXMap = {
     url_path: string;
     file_name: string;
     css_path?: string;
-    req_url?: string;
 };
 
 export type GlobalHMRControllerObject = {