@suveren/gateway 0.2.12 → 0.3.0

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.12.23",
+  "version": "4.12.27",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",
@@ -31,7 +31,7 @@
     "watch": "bun run --shell bun remove-dist && bun ./build/build.ts --watch && bun run copy:package.cjs.json",
     "coverage": "vitest --run --coverage",
     "prerelease": "bun test:deno && bun run build",
-    "release": "np",
+    "release": "np --no-publish",
     "remove-dist": "rm -rf dist"
   },
   "exports": {
@@ -506,9 +506,18 @@
       "jsx/dom/server": [
         "./dist/types/jsx/dom/server.d.ts"
       ],
+      "jsx/dom/jsx-dev-runtime": [
+        "./dist/types/jsx/dom/jsx-dev-runtime.d.ts"
+      ],
+      "jsx/dom/jsx-runtime": [
+        "./dist/types/jsx/dom/jsx-runtime.d.ts"
+      ],
       "jwt": [
         "./dist/types/middleware/jwt"
       ],
+      "jwk": [
+        "./dist/types/middleware/jwk"
+      ],
       "timeout": [
         "./dist/types/middleware/timeout"
       ],
@@ -552,19 +561,19 @@
         "./dist/types/router.d.ts"
       ],
       "router/reg-exp-router": [
-        "./dist/types/router/reg-exp-router/router.d.ts"
+        "./dist/types/router/reg-exp-router"
       ],
       "router/smart-router": [
-        "./dist/types/router/smart-router/router.d.ts"
+        "./dist/types/router/smart-router"
       ],
       "router/trie-router": [
-        "./dist/types/router/trie-router/router.d.ts"
+        "./dist/types/router/trie-router"
       ],
       "router/pattern-router": [
-        "./dist/types/router/pattern-router/router.d.ts"
+        "./dist/types/router/pattern-router"
       ],
       "router/linear-router": [
-        "./dist/types/router/linear-router/router.d.ts"
+        "./dist/types/router/linear-router"
       ],
       "utils/jwt": [
         "./dist/types/utils/jwt/index.d.ts"
@@ -596,15 +605,15 @@
       "bun": [
         "./dist/types/adapter/bun"
       ],
-      "nextjs": [
-        "./dist/types/adapter/nextjs"
-      ],
       "aws-lambda": [
         "./dist/types/adapter/aws-lambda"
       ],
       "vercel": [
         "./dist/types/adapter/vercel"
       ],
+      "netlify": [
+        "./dist/types/adapter/netlify"
+      ],
       "lambda-edge": [
         "./dist/types/adapter/lambda-edge"
       ],
@@ -658,18 +667,15 @@
   "devDependencies": {
     "@hono/eslint-config": "^2.1.0",
     "@hono/node-server": "^2.0.2",
-    "@types/glob": "^9.0.0",
     "@types/jsdom": "^21.1.7",
     "@types/node": "^24.3.0",
     "@types/ws": "^8.18.1",
     "@typescript/native-preview": "7.0.0-dev.20260210.1",
     "@vitest/coverage-v8": "^4.1.7",
-    "arg": "^5.0.2",
     "bun-types": "^1.2.20",
     "editorconfig-checker": "6.1.1",
     "esbuild": "^0.27.1",
     "eslint": "^9.39.3",
-    "glob": "^11.0.0",
     "jsdom": "22.1.0",
     "msw": "^2.6.0",
     "np": "10.2.0",

package/node_modules/http-proxy-middleware/README.md

@@ -28,10 +28,8 @@ Proxy `/api` requests to `http://www.example.org`
 
 ```typescript
 // typescript
-
 import * as express from 'express';
-import type { Request, Response, NextFunction } from 'express';
-
+import type { NextFunction, Request, Response } from 'express';
 import { createProxyMiddleware } from 'http-proxy-middleware';
 import type { Filter, Options, RequestHandler } from 'http-proxy-middleware';
 
@@ -163,18 +161,15 @@ http-proxy-middleware options:
 Narrow down which requests should be proxied. The `path` used for filtering is the `request.url` pathname. In Express, this is the `path` relative to the mount-point of the proxy.
 
 - **path matching**
-
   - `createProxyMiddleware({...})` - matches any path, all requests will be proxied when `pathFilter` is not configured.
   - `createProxyMiddleware({ pathFilter: '/api', ...})` - matches paths starting with `/api`
 
 - **multiple path matching**
-
   - `createProxyMiddleware({ pathFilter: ['/api', '/ajax', '/someotherpath'], ...})`
 
 - **wildcard path matching**
 
   For fine-grained control you can use wildcard matching. Glob pattern matching is done by _micromatch_. Visit [micromatch](https://www.npmjs.com/package/micromatch) or [glob](https://www.npmjs.com/package/glob) for more globbing examples.
-
   - `createProxyMiddleware({ pathFilter: '**', ...})` matches any path, all requests will be proxied.
   - `createProxyMiddleware({ pathFilter: '**/*.html', ...})` matches any path which ends with `.html`
   - `createProxyMiddleware({ pathFilter: '/*.html', ...})` matches paths directly under path-absolute
@@ -418,13 +413,12 @@ The following options are provided by the underlying [http-proxy](https://github
 - **option.autoRewrite**: rewrites the location host/port on (301/302/307/308) redirects based on requested host/port. Default: false.
 - **option.protocolRewrite**: rewrites the location protocol on (301/302/307/308) redirects to 'http' or 'https'. Default: null.
 - **option.cookieDomainRewrite**: rewrites domain of `set-cookie` headers. Possible values:
-
   - `false` (default): disable cookie rewriting
   - String: new domain, for example `cookieDomainRewrite: "new.domain"`. To remove the domain, use `cookieDomainRewrite: ""`.
   - Object: mapping of domains to new domains, use `"*"` to match all domains.  
     For example keep one domain unchanged, rewrite one domain and remove other domains:
 
-    ```json
+    ```jsonc
     cookieDomainRewrite: {
       "unchanged.domain": "unchanged.domain",
       "old.domain": "new.domain",
@@ -433,13 +427,12 @@ The following options are provided by the underlying [http-proxy](https://github
     ```
 
 - **option.cookiePathRewrite**: rewrites path of `set-cookie` headers. Possible values:
-
   - `false` (default): disable cookie rewriting
   - String: new path, for example `cookiePathRewrite: "/newPath/"`. To remove the path, use `cookiePathRewrite: ""`. To set path to root use `cookiePathRewrite: "/"`.
   - Object: mapping of paths to new paths, use `"*"` to match all paths.
     For example, to keep one path unchanged, rewrite one path and remove other paths:
 
-    ```json
+    ```jsonc
     cookiePathRewrite: {
       "/unchanged.path/": "/unchanged.path/",
       "/old.path/": "/new.path/",

package/node_modules/http-proxy-middleware/dist/errors.d.ts

@@ -4,3 +4,7 @@ export declare enum ERRORS {
     ERR_CONTEXT_MATCHER_INVALID_ARRAY = "[HPM] Invalid pathFilter. Plain paths (e.g. \"/api\") can not be mixed with globs (e.g. \"/api/**\"). Expecting something like: [\"/api\", \"/ajax\"] or [\"/api/**\", \"!**.html\"].",
     ERR_PATH_REWRITER_CONFIG = "[HPM] Invalid pathRewrite config. Expecting object with pathRewrite config or a rewrite function"
 }
+export declare class HttpProxyMiddlewareError extends Error {
+    code: string;
+    constructor(message: string, code: string);
+}

package/node_modules/http-proxy-middleware/dist/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ERRORS = void 0;
+exports.HttpProxyMiddlewareError = exports.ERRORS = void 0;
 var ERRORS;
 (function (ERRORS) {
     ERRORS["ERR_CONFIG_FACTORY_TARGET_MISSING"] = "[HPM] Missing \"target\" option. Example: {target: \"http://www.example.org\"}";
@@ -8,3 +8,18 @@ var ERRORS;
     ERRORS["ERR_CONTEXT_MATCHER_INVALID_ARRAY"] = "[HPM] Invalid pathFilter. Plain paths (e.g. \"/api\") can not be mixed with globs (e.g. \"/api/**\"). Expecting something like: [\"/api\", \"/ajax\"] or [\"/api/**\", \"!**.html\"].";
     ERRORS["ERR_PATH_REWRITER_CONFIG"] = "[HPM] Invalid pathRewrite config. Expecting object with pathRewrite config or a rewrite function";
 })(ERRORS || (exports.ERRORS = ERRORS = {}));
+class HttpProxyMiddlewareError extends Error {
+    constructor(message, code) {
+        super(message);
+        // add custom `code` property
+        // so this can be used in src/plugins/default/error-response-plugin.ts to determine the status code to return
+        this.code = code;
+        // set the correct name for the error class
+        this.name = this.constructor.name;
+        // maintain proper stack trace (V8 environments)
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+    }
+}
+exports.HttpProxyMiddlewareError = HttpProxyMiddlewareError;

package/node_modules/http-proxy-middleware/dist/factory.d.ts

@@ -1,3 +1,3 @@
-import type { Options, RequestHandler, NextFunction } from './types';
-import type * as http from 'http';
+import type * as http from 'node:http';
+import type { NextFunction, Options, RequestHandler } from './types';
 export declare function createProxyMiddleware<TReq = http.IncomingMessage, TRes = http.ServerResponse, TNext = NextFunction>(options: Options<TReq, TRes>): RequestHandler<TReq, TRes, TNext>;

package/node_modules/http-proxy-middleware/dist/handlers/fix-request-body-utils/stringify-form-data.d.ts

@@ -0,0 +1,7 @@
+/**
+ * stringify FormData data
+ * @param contentType
+ * @param data
+ * @returns
+ */
+export declare function stringifyFormData(contentType: string, data: object): string;

package/node_modules/http-proxy-middleware/dist/handlers/fix-request-body-utils/stringify-form-data.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stringifyFormData = stringifyFormData;
+const errors_1 = require("../../errors");
+const CR_OR_LF = /[\r\n]/;
+const ERROR_CODE_PREFIX = 'HPM_ERR_INVALID_MULTIPART';
+/**
+ * stringify FormData data
+ * @param contentType
+ * @param data
+ * @returns
+ */
+function stringifyFormData(contentType, data) {
+    const boundary = getMultipartBoundary(contentType);
+    let str = '';
+    for (const [key, value] of Object.entries(data)) {
+        const normalizedKey = String(key);
+        const normalizedValue = String(value);
+        // Reject potentially dangerous sequences to prevent multipart header/body injection.
+        validateMultipartField(normalizedKey, normalizedValue, boundary);
+        str += `--${boundary}\r\nContent-Disposition: form-data; name="${escapeMultipartFieldName(normalizedKey)}"\r\n\r\n${normalizedValue}\r\n`;
+    }
+    return str;
+}
+function getMultipartBoundary(contentType) {
+    const boundaryMatch = /(?:^|;)\s*boundary=(?:"([^"]+)"|([^;]+))/i.exec(contentType);
+    // Keep backward-compatible behavior when boundary is omitted: fall back to legacy extraction.
+    const boundary = (boundaryMatch?.[1] ?? boundaryMatch?.[2] ?? contentType).trim();
+    if (!boundary || CR_OR_LF.test(boundary)) {
+        throw new errors_1.HttpProxyMiddlewareError('[HPM] invalid multipart boundary detected.', `${ERROR_CODE_PREFIX}_BOUNDARY`);
+    }
+    return boundary;
+}
+function validateMultipartField(fieldName, fieldValue, boundary) {
+    const boundaryDelimiter = `--${boundary}`;
+    if (CR_OR_LF.test(fieldName)) {
+        throw new errors_1.HttpProxyMiddlewareError(`[HPM] invalid multipart field name "${fieldName}" detected.`, `${ERROR_CODE_PREFIX}_FIELD_NAME`);
+    }
+    if (CR_OR_LF.test(fieldValue) || fieldValue.includes(boundaryDelimiter)) {
+        throw new errors_1.HttpProxyMiddlewareError(`[HPM] invalid multipart field value for "${fieldName}" detected.`, `${ERROR_CODE_PREFIX}_FIELD_VALUE`);
+    }
+}
+function escapeMultipartFieldName(fieldName) {
+    return fieldName.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}

package/node_modules/http-proxy-middleware/dist/handlers/fix-request-body.d.ts

@@ -1,4 +1,4 @@
-import type * as http from 'http';
+import type * as http from 'node:http';
 export type BodyParserLikeRequest = http.IncomingMessage & {
     body?: any;
 };

package/node_modules/http-proxy-middleware/dist/handlers/fix-request-body.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fixRequestBody = fixRequestBody;
-const querystring = require("querystring");
+const querystring = require("node:querystring");
+const stringify_form_data_1 = require("./fix-request-body-utils/stringify-form-data");
 /**
  * Fix proxied body if bodyParser is involved.
  */
@@ -22,29 +23,28 @@ function fixRequestBody(proxyReq, req) {
         proxyReq.setHeader('Content-Length', Buffer.byteLength(bodyData));
         proxyReq.write(bodyData);
     };
-    // Use if-elseif to prevent multiple writeBody/setHeader calls:
-    // Error: "Cannot set headers after they are sent to the client"
-    if (contentType.includes('application/json') || contentType.includes('+json')) {
-        writeBody(JSON.stringify(requestBody));
+    try {
+        // Use if-elseif to prevent multiple writeBody/setHeader calls:
+        // Error: "Cannot set headers after they are sent to the client"
+        if (contentType.includes('application/json') || contentType.includes('+json')) {
+            writeBody(JSON.stringify(requestBody));
+        }
+        else if (contentType.includes('application/x-www-form-urlencoded')) {
+            writeBody(querystring.stringify(requestBody));
+        }
+        else if (contentType.includes('multipart/form-data')) {
+            writeBody((0, stringify_form_data_1.stringifyFormData)(contentType, requestBody));
+        }
+        else if (contentType.includes('text/plain')) {
+            writeBody(requestBody);
+        }
     }
-    else if (contentType.includes('application/x-www-form-urlencoded')) {
-        writeBody(querystring.stringify(requestBody));
-    }
-    else if (contentType.includes('multipart/form-data')) {
-        writeBody(handlerFormDataBodyData(contentType, requestBody));
+    catch (error) {
+        // proxyReq listeners run outside the middleware try/catch path; re-throwing here can bubble as
+        // an unhandled exception in consumers, so destroy() is used to fail closed through proxy error handling.
+        proxyReq.destroy(toError(error));
     }
 }
-/**
- * format FormData data
- * @param contentType
- * @param data
- * @returns
- */
-function handlerFormDataBodyData(contentType, data) {
-    const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1');
-    let str = '';
-    for (const [key, value] of Object.entries(data)) {
-        str += `--${boundary}\r\nContent-Disposition: form-data; name="${key}"\r\n\r\n${value}\r\n`;
-    }
-    return str;
+function toError(error) {
+    return error instanceof Error ? error : new Error(String(error));
 }

package/node_modules/http-proxy-middleware/dist/handlers/response-interceptor.d.ts

@@ -1,4 +1,4 @@
-import type * as http from 'http';
+import type * as http from 'node:http';
 type Interceptor<TReq = http.IncomingMessage, TRes = http.ServerResponse> = (buffer: Buffer, proxyRes: TReq, req: TReq, res: TRes) => Promise<Buffer | string>;
 /**
  * Intercept responses from upstream.

package/node_modules/http-proxy-middleware/dist/handlers/response-interceptor.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.responseInterceptor = responseInterceptor;
-const zlib = require("zlib");
+const zlib = require("node:zlib");
 const debug_1 = require("../debug");
 const function_1 = require("../utils/function");
 const debug = debug_1.Debug.extend('response-interceptor');

package/node_modules/http-proxy-middleware/dist/http-proxy-middleware.d.ts

@@ -1,4 +1,4 @@
-import type { RequestHandler, Options } from './types';
+import type { Options, RequestHandler } from './types';
 export declare class HttpProxyMiddleware<TReq, TRes> {
     private wsInternalSubscribed;
     private serverOnCloseSubscribed;

package/node_modules/http-proxy-middleware/dist/http-proxy-middleware.js

@@ -3,13 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.HttpProxyMiddleware = void 0;
 const httpProxy = require("http-proxy");
 const configuration_1 = require("./configuration");
+const debug_1 = require("./debug");
 const get_plugins_1 = require("./get-plugins");
+const logger_1 = require("./logger");
 const path_filter_1 = require("./path-filter");
 const PathRewriter = require("./path-rewriter");
 const Router = require("./router");
-const debug_1 = require("./debug");
 const function_1 = require("./utils/function");
-const logger_1 = require("./logger");
 class HttpProxyMiddleware {
     constructor(options) {
         this.wsInternalSubscribed = false;

package/node_modules/http-proxy-middleware/dist/legacy/create-proxy-middleware.d.ts

@@ -1,6 +1,6 @@
+import type * as http from 'node:http';
 import { Filter, RequestHandler } from '../types';
 import { LegacyOptions } from './types';
-import type * as http from 'http';
 /**
  * @deprecated
  * This function is deprecated and will be removed in a future version.

package/node_modules/http-proxy-middleware/dist/legacy/create-proxy-middleware.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.legacyCreateProxyMiddleware = legacyCreateProxyMiddleware;
-const factory_1 = require("../factory");
 const debug_1 = require("../debug");
+const factory_1 = require("../factory");
 const options_adapter_1 = require("./options-adapter");
 const debug = debug_1.Debug.extend('legacy-create-proxy-middleware');
 function legacyCreateProxyMiddleware(legacyContext, legacyOptions) {

package/node_modules/http-proxy-middleware/dist/legacy/options-adapter.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.legacyOptionsAdapter = legacyOptionsAdapter;
-const url = require("url");
+const url = require("node:url");
 const debug_1 = require("../debug");
 const logger_1 = require("../logger");
 const debug = debug_1.Debug.extend('legacy-options-adapter');

package/node_modules/http-proxy-middleware/dist/legacy/types.d.ts

@@ -1,4 +1,4 @@
-import type * as http from 'http';
+import type * as http from 'node:http';
 import { Options } from '../types';
 /**
  * @deprecated

package/node_modules/http-proxy-middleware/dist/path-filter.d.ts

@@ -1,3 +1,3 @@
+import type * as http from 'node:http';
 import type { Filter } from './types';
-import type * as http from 'http';
 export declare function matchPathFilter<TReq = http.IncomingMessage>(pathFilter: Filter<TReq> | undefined, uri: string | undefined, req: http.IncomingMessage): boolean;

package/node_modules/http-proxy-middleware/dist/path-filter.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.matchPathFilter = matchPathFilter;
+const url = require("node:url");
 const isGlob = require("is-glob");
 const micromatch = require("micromatch");
-const url = require("url");
 const errors_1 = require("./errors");
 function matchPathFilter(pathFilter = '/', uri, req) {
     // single path

package/node_modules/http-proxy-middleware/dist/path-rewriter.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createPathRewriter = createPathRewriter;
 const is_plain_object_1 = require("is-plain-object");
-const errors_1 = require("./errors");
 const debug_1 = require("./debug");
+const errors_1 = require("./errors");
 const debug = debug_1.Debug.extend('path-rewriter');
 /**
  * Create rewrite function, to cache parsed rewrite rules.

package/node_modules/http-proxy-middleware/dist/plugins/default/error-response-plugin.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.errorResponsePlugin = void 0;
 const status_code_1 = require("../../status-code");
+const sanitize_1 = require("../../utils/sanitize");
 function isResponseLike(obj) {
     return obj && typeof obj.writeHead === 'function';
 }
@@ -20,7 +21,7 @@ const errorResponsePlugin = (proxyServer, options) => {
                 res.writeHead(statusCode);
             }
             const host = req.headers && req.headers.host;
-            res.end(`Error occurred while trying to proxy: ${host}${req.url}`);
+            res.end(`Error occurred while trying to proxy: ${(0, sanitize_1.sanitize)(host)}${(0, sanitize_1.sanitize)(req.url)}`);
         }
         else if (isSocketLike(res)) {
             res.destroy();

package/node_modules/http-proxy-middleware/dist/plugins/default/logger-plugin.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loggerPlugin = void 0;
-const url_1 = require("url");
+const node_url_1 = require("node:url");
 const logger_1 = require("../../logger");
 const logger_plugin_1 = require("../../utils/logger-plugin");
 const loggerPlugin = (proxyServer, options) => {
@@ -34,7 +34,7 @@ const loggerPlugin = (proxyServer, options) => {
                 host: proxyRes.req.host,
                 pathname: proxyRes.req.path,
             };
-            target = new url_1.URL(`${obj.protocol}//${obj.host}${obj.pathname}`);
+            target = new node_url_1.URL(`${obj.protocol}//${obj.host}${obj.pathname}`);
             if (port) {
                 target.port = port;
             }
@@ -43,7 +43,7 @@ const loggerPlugin = (proxyServer, options) => {
         catch (err) {
             // nock issue (https://github.com/chimurai/http-proxy-middleware/issues/1035)
             // fallback to old implementation (less correct - without port)
-            target = new url_1.URL(options.target);
+            target = new node_url_1.URL(options.target);
             target.pathname = proxyRes.req.path;
         }
         const targetUrl = target.toString();

package/node_modules/http-proxy-middleware/dist/router.js

@@ -17,16 +17,27 @@ async function getTarget(req, config) {
 }
 function getTargetFromProxyTable(req, table) {
     let result;
-    const host = req.headers.host;
-    const path = req.url;
-    const hostAndPath = host + path;
+    const host = req.headers.host || '';
+    const path = req.url || '';
     for (const [key, value] of Object.entries(table)) {
         if (containsPath(key)) {
-            if (hostAndPath.indexOf(key) > -1) {
-                // match 'localhost:3000/api'
-                result = value;
-                debug('match: "%s" -> "%s"', key, result);
-                break;
+            if (isHostAndPathKey(key)) {
+                const [keyHost, keyPath] = splitHostAndPathKey(key);
+                // SECURITY: host+path keys must match exact host + path prefix.
+                if (host === keyHost && path.startsWith(keyPath)) {
+                    // match 'localhost:3000/api'
+                    result = value;
+                    debug('match: "%s" -> "%s"', key, result);
+                    break;
+                }
+            }
+            else {
+                if (path.startsWith(key)) {
+                    // match '/api'
+                    result = value;
+                    debug('match: "%s" -> "%s"', key, result);
+                    break;
+                }
             }
         }
         else {
@@ -43,3 +54,10 @@ function getTargetFromProxyTable(req, table) {
 function containsPath(v) {
     return v.indexOf('/') > -1;
 }
+function isHostAndPathKey(v) {
+    return containsPath(v) && !v.startsWith('/');
+}
+function splitHostAndPathKey(v) {
+    const firstSlash = v.indexOf('/');
+    return [v.slice(0, firstSlash), v.slice(firstSlash)];
+}

package/node_modules/http-proxy-middleware/dist/status-code.js

@@ -5,19 +5,22 @@ function getStatusCode(errorCode) {
     let statusCode;
     if (/HPE_INVALID/.test(errorCode)) {
         statusCode = 502;
+        return statusCode;
     }
-    else {
-        switch (errorCode) {
-            case 'ECONNRESET':
-            case 'ENOTFOUND':
-            case 'ECONNREFUSED':
-            case 'ETIMEDOUT':
-                statusCode = 504;
-                break;
-            default:
-                statusCode = 500;
-                break;
-        }
+    if (/HPM_ERR_INVALID_MULTIPART_/.test(errorCode)) {
+        statusCode = 400;
+        return statusCode;
+    }
+    switch (errorCode) {
+        case 'ECONNRESET':
+        case 'ENOTFOUND':
+        case 'ECONNREFUSED':
+        case 'ETIMEDOUT':
+            statusCode = 504;
+            break;
+        default:
+            statusCode = 500;
+            break;
     }
     return statusCode;
 }

package/node_modules/http-proxy-middleware/dist/types.d.ts

@@ -2,9 +2,9 @@
  * Based on definition by DefinitelyTyped:
  * https://github.com/DefinitelyTyped/DefinitelyTyped/blob/6f529c6c67a447190f86bfbf894d1061e41e07b7/types/http-proxy-middleware/index.d.ts
  */
-import type * as http from 'http';
+import type * as http from 'node:http';
+import type * as net from 'node:net';
 import type * as httpProxy from 'http-proxy';
-import type * as net from 'net';
 export type NextFunction<T = (err?: any) => void> = T;
 export interface RequestHandler<TReq = http.IncomingMessage, TRes = http.ServerResponse, TNext = NextFunction> {
     (req: TReq, res: TRes, next?: TNext): Promise<void>;
@@ -118,5 +118,5 @@ export interface Options<TReq = http.IncomingMessage, TRes = http.ServerResponse
      * @link https://github.com/chimurai/http-proxy-middleware/blob/master/recipes/logger.md
      * @since v3.0.0
      */
-    logger?: Logger | any;
+    logger?: Logger;
 }

package/node_modules/http-proxy-middleware/dist/types.js

@@ -1,6 +1,2 @@
 "use strict";
-/**
- * Based on definition by DefinitelyTyped:
- * https://github.com/DefinitelyTyped/DefinitelyTyped/blob/6f529c6c67a447190f86bfbf894d1061e41e07b7/types/http-proxy-middleware/index.d.ts
- */
 Object.defineProperty(exports, "__esModule", { value: true });

package/node_modules/http-proxy-middleware/dist/utils/sanitize.d.ts

@@ -0,0 +1 @@
+export declare function sanitize(input: string | undefined): string;

package/node_modules/http-proxy-middleware/dist/utils/sanitize.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitize = sanitize;
+function sanitize(input) {
+    return input?.replace(/[<>]/g, (i) => encodeURIComponent(i)) ?? '';
+}