@suveren/gateway 0.38.0 → 0.40.0

package/node_modules/@modelcontextprotocol/sdk/node_modules/body-parser/lib/types/urlencoded.js

@@ -98,12 +98,12 @@ function createQueryParser (options) {
     try {
       return qs.parse(body, {
         allowPrototypes: true,
-        arrayLimit: arrayLimit,
-        depth: depth,
-        charsetSentinel: charsetSentinel,
-        interpretNumericEntities: interpretNumericEntities,
+        arrayLimit,
+        depth,
+        charsetSentinel,
+        interpretNumericEntities,
         charset: encoding,
-        parameterLimit: parameterLimit,
+        parameterLimit,
         strictDepth: true
       })
     } catch (err) {

package/node_modules/@modelcontextprotocol/sdk/node_modules/body-parser/lib/utils.js

@@ -5,31 +5,16 @@
  */
 
 const bytes = require('bytes')
-const contentType = require('content-type')
 const typeis = require('type-is')
 
 /**
  * Module exports.
  */
 module.exports = {
-  getCharset,
   normalizeOptions,
   passthrough
 }
 
-/**
- * Get the charset of a request.
- *
- * @param {Object} req
- * @returns {string | undefined}
- * @private
- */
-function getCharset (req) {
-  const header = req.headers['content-type']
-  if (!header) return undefined
-  return contentType.parse(header).parameters.charset?.toLowerCase()
-}
-
 /**
  * Get the simple type checker.
  *

package/node_modules/@modelcontextprotocol/sdk/node_modules/body-parser/package.json

@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
@@ -27,26 +27,21 @@
   },
   "dependencies": {
     "bytes": "^3.1.2",
-    "content-type": "^2.0.0",
+    "content-type": "^2.1.0",
     "debug": "^4.4.3",
     "http-errors": "^2.0.1",
-    "iconv-lite": "^0.7.2",
+    "iconv-lite": "^0.7.3",
     "on-finished": "^2.4.1",
-    "qs": "^6.15.2",
+    "qs": "^6.16.1",
     "raw-body": "^3.0.2",
     "type-is": "^2.1.0"
   },
   "devDependencies": {
-    "eslint": "^8.57.1",
-    "eslint-config-standard": "^14.1.1",
-    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-markdown": "^3.0.1",
-    "eslint-plugin-node": "^11.1.0",
-    "eslint-plugin-promise": "^6.6.0",
-    "eslint-plugin-standard": "^4.1.0",
+    "eslint": "^9.39.5",
     "mocha": "^11.7.6",
+    "neostandard": "^0.13.0",
     "nyc": "^17.1.0",
-    "supertest": "^7.2.2"
+    "supertest": "7.3.0"
   },
   "files": [
     "lib/",

package/node_modules/@modelcontextprotocol/sdk/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@modelcontextprotocol/sdk",
-    "version": "1.32.1",
+    "version": "1.32.2",
     "description": "Model Context Protocol implementation for TypeScript",
     "license": "MIT",
     "author": "Anthropic, PBC (https://anthropic.com)",

package/node_modules/body-parser/HISTORY.md

@@ -1,10 +1,15 @@
+1.20.9
+======
+
+* Security fix for [GHSA-27r3-jxmh-p828](https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828) (CVE-2026-111181)
+
 1.20.8
-===================
+======
 
 * Same code base as 1.20.7. This was created to test the new release process.
 
 1.20.7
-===================
+======
 
 * deps: qs@~6.16.0
 

package/node_modules/body-parser/README.md

@@ -98,7 +98,7 @@ argument. You can find more information on this argument
 
 ##### strict
 
-When set to `true`, will only accept arrays and objects; when `false` will
+When set to `true`, it will only accept arrays and objects; when `false`, it will
 accept anything `JSON.parse` accepts. Defaults to `true`.
 
 ##### type
@@ -313,7 +313,7 @@ the entity value that failed parsing.
 ### entity verify failed
 
 This error will occur when the request contained an entity that could not be
-failed verification by the defined `verify` option. The `status` property is
+verified by the defined `verify` option. The `status` property is
 set to `403`, the `type` property is set to `'entity.verify.failed'`, and the
 `body` property is set to the entity value that failed verification.
 
@@ -380,7 +380,7 @@ property is set to the encoding that is unsupported.
 
 ### The input exceeded the depth
 
-This error occurs when using `bodyParser.urlencoded` with the `extended` property set to `true` and the input exceeds the configured `depth` option. The `status` property is set to `400`. It is recommended to review the `depth` option and evaluate if it requires a higher value. When the `depth` option is set to `32` (default value), the error will not be thrown.
+This error occurs when using `bodyParser.urlencoded` with the `extended` property set to `true` and the input exceeds the configured `depth` option. The `status` property is set to `400`. It is recommended to review the `depth` option and evaluate if it requires a higher value. With the default `depth` of `32`, an input with 33 or more levels of nesting gets this error.
 
 ## Examples
 

package/node_modules/body-parser/lib/read.js

@@ -51,6 +51,15 @@ function read (req, res, next, parse, debug, options) {
     : null
   var verify = opts.verify
 
+  // assert charset is supported before creating the decompression stream, so a
+  // 415 cannot leave a decoder piped with no error listener
+  if (verify && encoding !== null && !iconv.encodingExists(encoding)) {
+    return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', {
+      charset: encoding.toLowerCase(),
+      type: 'charset.unsupported'
+    }))
+  }
+
   try {
     // get the content stream
     stream = contentstream(req, debug, opts.inflate)
@@ -66,14 +75,6 @@ function read (req, res, next, parse, debug, options) {
     ? null
     : encoding
 
-  // assert charset is supported
-  if (opts.encoding === null && encoding !== null && !iconv.encodingExists(encoding)) {
-    return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', {
-      charset: encoding.toLowerCase(),
-      type: 'charset.unsupported'
-    }))
-  }
-
   // read body
   debug('read body')
   getBody(stream, opts, function (error, body) {
@@ -104,6 +105,23 @@ function read (req, res, next, parse, debug, options) {
       return
     }
 
+    // detach and destroy the decompression stream to avoid
+    // decompression errors on the finished stream
+    if (stream !== req) {
+      // only detach the decompression stream, keep other consumers piped
+      if (typeof req.unpipe === 'function') {
+        req.unpipe(stream)
+      } else {
+        // Node.js 0.8 streams have no unpipe(dest)
+        unpipe(req)
+      }
+      stream.on('error', function () {})
+      destroy(stream, true)
+
+      // consume any remaining bytes so the HTTP request can finish
+      req.resume()
+    }
+
     // verify
     if (verify) {
       try {

package/node_modules/body-parser/package.json

@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "1.20.8",
+  "version": "1.20.9",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"

package/node_modules/follow-redirects/README.md

@@ -1,4 +1,30 @@
-## Follow Redirects
+## _Follow Redirects_ is in need of funding
+
+> [!IMPORTANT]
+> **Maintenance paused until funding found.**
+>
+> follow-redirects is downloaded over 400 million times per month,
+> It has been maintained for over ten years by one volunteer,
+> who has no funds to provide update and security guarantees.
+>
+> **What this means for you:**
+> the package stays published and keeps working as it does today,
+> but there are no guarantees of bug fixes, security fixes,
+> or replies to issues and pull requests.
+> Security reports are handled best-effort only; see [SECURITY.md](SECURITY.md).
+>
+> **What can restart maintenance:**
+> Even if only 0.1% of downloads paid $0.01, we'd be fully funded
+> with $4000 per month.
+> That's not the case, and that's okay,
+> but unfortunately also insufficient to continue.
+> We need to cover security triage, CVE handling, fixes, and releases.
+> Progress toward that goal will be posted here.
+>
+> **If your company depends on follow-redirects,**
+> directly or another library,
+> please [sponsor on GitHub](https://github.com/sponsors/RubenVerborgh)
+> or email us for invoice-based funding or a security support agreement.
 
 Drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
 

package/node_modules/follow-redirects/index.js

@@ -311,7 +311,7 @@ RedirectableRequest.prototype._sanitizeOptions = function (options) {
     }
   }
   // Ensure sensitive headers are always present
-  if (!isArray(options.sensitiveHeaders)) {
+  if (!Array.isArray(options.sensitiveHeaders)) {
     options.sensitiveHeaders = [];
   }
 
@@ -689,10 +689,6 @@ function isSubdomain(subdomain, domain) {
   return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
 }
 
-function isArray(value) {
-  return value instanceof Array;
-}
-
 function isString(value) {
   return typeof value === "string" || value instanceof String;
 }

package/node_modules/follow-redirects/package.json

@@ -1,6 +1,6 @@
 {
   "name": "follow-redirects",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "description": "HTTP and HTTPS modules that follow redirects.",
   "license": "MIT",
   "main": "index.js",

package/node_modules/hono/README.md

@@ -17,7 +17,6 @@
 [![GitHub last commit](https://img.shields.io/github/last-commit/honojs/hono)](https://github.com/honojs/hono/commits/main)
 [![codecov](https://codecov.io/github/honojs/hono/graph/badge.svg)](https://codecov.io/github/honojs/hono)
 [![Discord badge](https://img.shields.io/discord/1011308539819597844?label=Discord&logo=Discord)](https://discord.gg/KMh2eNSdxV)
-[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/honojs/hono)
 
 Hono - _**means flame🔥 in Japanese**_ - is a small, simple, and ultrafast web framework built on Web Standards. It works on any JavaScript runtime: Cloudflare Workers, Fastly Compute, Deno, Bun, Vercel, AWS Lambda, Lambda@Edge, and Node.js.
 
@@ -63,9 +62,9 @@ The migration guide is available on [docs/MIGRATION.md](docs/MIGRATION.md).
 Contributions Welcome! You can contribute in the following ways.
 
 - Create an Issue - Propose a new feature. Report a bug.
-- Pull Request - Fix a bug or typo. Refactor the code.
-- Create third-party middleware - See [Third-party middleware](docs/CONTRIBUTING.md#third-party-middleware).
+- Build middleware and libraries - Grow the Hono ecosystem.
 - Share - Share your thoughts on the Blog, X, and others.
+- Sponsor - Support the maintainers through GitHub Sponsors: [@yusukebe](https://github.com/sponsors/yusukebe) and [@usualoma](https://github.com/sponsors/usualoma).
 - Make your application - Please try to use Hono.
 
 For more details, see [docs/CONTRIBUTING.md](docs/CONTRIBUTING.md).

package/node_modules/hono/dist/cjs/helper/css/common.js

@@ -46,7 +46,11 @@ const isValidKeyframeName = (name) => isValidClassName(name) && !RESERVED_KEYFRA
 const defaultOnInvalidSlug = (slug) => {
 	console.warn(`Invalid slug: ${slug}`);
 };
-const cssStringReStr = ["\"(?:(?:\\\\[\\s\\S]|[^\"\\\\])*)\"", "'(?:(?:\\\\[\\s\\S]|[^'\\\\])*)'"].join("|");
+const cssStringReStr = [
+	"\"(?:(?:\\\\[\\s\\S]|[^\"\\\\])*)\"",
+	"'(?:(?:\\\\[\\s\\S]|[^'\\\\])*)'",
+	"url\\(\\s*[^)\"'\\s]*\\s*\\)"
+].join("|");
 const minifyCssRe = new RegExp([
 	"(" + cssStringReStr + ")",
 	"(?:" + [
@@ -56,11 +60,12 @@ const minifyCssRe = new RegExp([
 		"\\s+$"
 	].join("|") + ")",
 	"\\s*;\\s*(}|$)\\s*",
-	"\\s*([{};:,])\\s*",
+	"\\s*([{};,])\\s*",
+	"(:)\\s*",
 	"(\\s)\\s+"
 ].join("|"), "g");
 const minify = (css) => {
-	return css.replace(minifyCssRe, (_, $1, $2, $3, $4) => $1 || $2 || $3 || $4 || "");
+	return css.replace(minifyCssRe, (_, $1, $2, $3, $4, $5) => $1 || $2 || $3 || $4 || $5 || "");
 };
 const buildStyleString = (strings, values) => {
 	const selectors = [];

package/node_modules/hono/dist/cjs/helper/css/index.js

@@ -21,7 +21,7 @@ const createCssContext = ({ id, classNameSlug, onInvalidSlug }) => {
 	const [cssJsxDomObject, StyleRenderToDom] = require_jsx_dom_css.createCssJsxDomObjects({ id });
 	const contextMap = /* @__PURE__ */ new WeakMap();
 	const nonceMap = /* @__PURE__ */ new WeakMap();
-	const replaceStyleRe = new RegExp(`(<style id="${id}"(?: nonce="[^"]*")?>.*?)(</style>)`);
+	const replaceStyleRe = new RegExp(`(<style id="${id}"(?: nonce="[^"]*")?>.*?)(</style>)`, "s");
 	const newCssClassNameObject = (cssClassName) => {
 		const appendStyle = ({ buffer, context }) => {
 			const [toAdd, added] = contextMap.get(context);

package/node_modules/hono/dist/cjs/helper/route/index.js

@@ -111,7 +111,9 @@ const basePath = (c, index) => {
 			const pattern = require_utils_url.getPattern(paths[i], paths[i + 1]);
 			if (pattern) {
 				const re = pattern[2] === true || pattern === "*" ? /[^\/]+/ : pattern[2];
-				basePathLength += reqPath.substring(basePathLength + 1).match(re)?.[0].length || 0;
+				const restPath = reqPath.substring(basePathLength + 1);
+				const segment = restPath.split("/", 1)[0];
+				basePathLength += (restPath.match(re)?.[0] ?? (re.test(segment) ? segment : "")).length;
 			} else basePathLength += paths[i].length;
 			basePathLength += 1;
 		}

package/node_modules/hono/dist/cjs/jsx/base.js

@@ -240,7 +240,7 @@ const cloneElement = (element, props, ...children) => {
 	if (children.length > 0) childrenToClone = children;
 	else {
 		const c = element.props.children;
-		childrenToClone = Array.isArray(c) ? c : [c];
+		childrenToClone = c !== void 0 ? Array.isArray(c) ? c : [c] : [];
 	}
 	return jsx(element.tag, {
 		...element.props,

package/node_modules/hono/dist/cjs/middleware/bearer-auth/index.js

@@ -53,6 +53,14 @@ const bearerAuth = (options) => {
 		const wwwAuthenticateHeaderValue = typeof wwwAuthenticateHeader === "function" ? await wwwAuthenticateHeader(c) : wwwAuthenticateHeader;
 		const headers = { "WWW-Authenticate": typeof wwwAuthenticateHeaderValue === "string" ? wwwAuthenticateHeaderValue : `${wwwAuthenticatePrefix}${Object.entries(wwwAuthenticateHeaderValue).map(([key, value]) => `${key}="${value}"`).join(",")}` };
 		const responseMessage = typeof messageOption === "function" ? await messageOption(c) : messageOption;
+		if (responseMessage instanceof Response) {
+			const resHeaders = new Headers(responseMessage.headers);
+			if (!resHeaders.has("WWW-Authenticate")) resHeaders.set("WWW-Authenticate", headers["WWW-Authenticate"]);
+			throw new require_http_exception.HTTPException(responseMessage.status, { res: new Response(responseMessage.body, {
+				status: responseMessage.status,
+				headers: resHeaders
+			}) });
+		}
 		const res = typeof responseMessage === "string" ? new Response(responseMessage, {
 			status,
 			headers

package/node_modules/hono/dist/cjs/middleware/serve-static/index.js

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_utils_url = require("../../utils/url.js");
+const require_utils_accept = require("../../utils/accept.js");
 const require_utils_compress = require("../../utils/compress.js");
 const require_utils_mime = require("../../utils/mime.js");
 const require_middleware_serve_static_path = require("./path.js");
@@ -20,6 +21,7 @@ const serveStatic = (options) => {
 	const join = options.join ?? require_middleware_serve_static_path.defaultJoin;
 	return async (c, next) => {
 		if (c.finalized) return next();
+		if (c.req.method !== "GET" && c.req.method !== "HEAD") return next();
 		let filename;
 		if (options.path) filename = options.path;
 		else try {
@@ -39,7 +41,7 @@ const serveStatic = (options) => {
 			const mimeType = options.mimes && require_utils_mime.getMimeType(path, options.mimes) || require_utils_mime.getMimeType(path);
 			c.header("Content-Type", mimeType || "application/octet-stream");
 			if (options.precompressed && (!mimeType || require_utils_compress.COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
-				const acceptEncodingSet = new Set(c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim()));
+				const acceptEncodingSet = new Set(require_utils_accept.parseAccept(c.req.header("Accept-Encoding") ?? "").filter((encoding) => encoding.q > 0).map((encoding) => encoding.type));
 				for (const encoding of ENCODINGS_ORDERED_KEYS) {
 					if (!acceptEncodingSet.has(encoding)) continue;
 					const compressedContent = await getContent(path + ENCODINGS[encoding], c);

package/node_modules/hono/dist/cjs/router/trie-router/node.js

@@ -98,7 +98,7 @@ var Node = class Node {
 						const restPathString = path.slice(partOffsets[i]);
 						const m = matcher.exec(restPathString);
 						if (m) {
-							params[name] = m[0];
+							if (!Object.hasOwn(params, name)) params[name] = m[0];
 							this.#pushHandlerSets(handlerSets, child, method, node.#params, params);
 							if (m[0].length === restPathString.length && child.#children["*"]) this.#pushHandlerSets(handlerSets, child.#children["*"], method, node.#params, params);
 							for (const _ in child.#children) {
@@ -111,7 +111,7 @@ var Node = class Node {
 						}
 					}
 					if (matcher === true || matcher.test(part)) {
-						params[name] = part;
+						if (!Object.hasOwn(params, name)) params[name] = part;
 						if (isLast) {
 							this.#pushHandlerSets(handlerSets, child, method, params, node.#params);
 							if (child.#children["*"]) this.#pushHandlerSets(handlerSets, child.#children["*"], method, params, node.#params);

package/node_modules/hono/dist/cjs/utils/url.js

@@ -154,16 +154,21 @@ const _getQueryParam = (url, key, multiple) => {
 	if (hashIndex !== -1) url = url.slice(0, hashIndex);
 	let encoded;
 	if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
-		let keyIndex = url.indexOf("?", 8);
+		const queryIndex = url.indexOf("?", 8);
+		let keyIndex = queryIndex;
 		if (keyIndex === -1) return;
 		if (!url.startsWith(key, keyIndex + 1)) keyIndex = url.indexOf(`&${key}`, keyIndex + 1);
 		while (keyIndex !== -1) {
 			const trailingKeyCode = url.charCodeAt(keyIndex + key.length + 1);
-			if (trailingKeyCode === 61) {
-				const valueIndex = keyIndex + key.length + 2;
-				const endIndex = url.indexOf("&", valueIndex);
-				return _decodeURI(url.slice(valueIndex, endIndex === -1 ? void 0 : endIndex));
-			} else if (trailingKeyCode == 38 || isNaN(trailingKeyCode)) return "";
+			if (trailingKeyCode === 61 || trailingKeyCode === 38 || isNaN(trailingKeyCode)) {
+				if (keyIndex > queryIndex && /(?:^|&)[^=&]*[%+]/.test(url.slice(queryIndex + 1, keyIndex))) break;
+				if (trailingKeyCode === 61) {
+					const valueIndex = keyIndex + key.length + 2;
+					const endIndex = url.indexOf("&", valueIndex);
+					return _decodeURI(url.slice(valueIndex, endIndex === -1 ? void 0 : endIndex));
+				}
+				return "";
+			}
 			keyIndex = url.indexOf(`&${key}`, keyIndex + 1);
 		}
 		encoded = /[%+]/.test(url);

package/node_modules/hono/dist/helper/css/common.js

@@ -45,7 +45,11 @@ const isValidKeyframeName = (name) => isValidClassName(name) && !RESERVED_KEYFRA
 const defaultOnInvalidSlug = (slug) => {
 	console.warn(`Invalid slug: ${slug}`);
 };
-const cssStringReStr = ["\"(?:(?:\\\\[\\s\\S]|[^\"\\\\])*)\"", "'(?:(?:\\\\[\\s\\S]|[^'\\\\])*)'"].join("|");
+const cssStringReStr = [
+	"\"(?:(?:\\\\[\\s\\S]|[^\"\\\\])*)\"",
+	"'(?:(?:\\\\[\\s\\S]|[^'\\\\])*)'",
+	"url\\(\\s*[^)\"'\\s]*\\s*\\)"
+].join("|");
 const minifyCssRe = new RegExp([
 	"(" + cssStringReStr + ")",
 	"(?:" + [
@@ -55,11 +59,12 @@ const minifyCssRe = new RegExp([
 		"\\s+$"
 	].join("|") + ")",
 	"\\s*;\\s*(}|$)\\s*",
-	"\\s*([{};:,])\\s*",
+	"\\s*([{};,])\\s*",
+	"(:)\\s*",
 	"(\\s)\\s+"
 ].join("|"), "g");
 const minify = (css) => {
-	return css.replace(minifyCssRe, (_, $1, $2, $3, $4) => $1 || $2 || $3 || $4 || "");
+	return css.replace(minifyCssRe, (_, $1, $2, $3, $4, $5) => $1 || $2 || $3 || $4 || $5 || "");
 };
 const buildStyleString = (strings, values) => {
 	const selectors = [];

package/node_modules/hono/dist/helper/css/index.js

@@ -20,7 +20,7 @@ const createCssContext = ({ id, classNameSlug, onInvalidSlug }) => {
 	const [cssJsxDomObject, StyleRenderToDom] = createCssJsxDomObjects({ id });
 	const contextMap = /* @__PURE__ */ new WeakMap();
 	const nonceMap = /* @__PURE__ */ new WeakMap();
-	const replaceStyleRe = new RegExp(`(<style id="${id}"(?: nonce="[^"]*")?>.*?)(</style>)`);
+	const replaceStyleRe = new RegExp(`(<style id="${id}"(?: nonce="[^"]*")?>.*?)(</style>)`, "s");
 	const newCssClassNameObject = (cssClassName) => {
 		const appendStyle = ({ buffer, context }) => {
 			const [toAdd, added] = contextMap.get(context);

package/node_modules/hono/dist/helper/route/index.js

@@ -110,7 +110,9 @@ const basePath = (c, index) => {
 			const pattern = getPattern(paths[i], paths[i + 1]);
 			if (pattern) {
 				const re = pattern[2] === true || pattern === "*" ? /[^\/]+/ : pattern[2];
-				basePathLength += reqPath.substring(basePathLength + 1).match(re)?.[0].length || 0;
+				const restPath = reqPath.substring(basePathLength + 1);
+				const segment = restPath.split("/", 1)[0];
+				basePathLength += (restPath.match(re)?.[0] ?? (re.test(segment) ? segment : "")).length;
 			} else basePathLength += paths[i].length;
 			basePathLength += 1;
 		}

package/node_modules/hono/dist/jsx/base.js

@@ -239,7 +239,7 @@ const cloneElement = (element, props, ...children) => {
 	if (children.length > 0) childrenToClone = children;
 	else {
 		const c = element.props.children;
-		childrenToClone = Array.isArray(c) ? c : [c];
+		childrenToClone = c !== void 0 ? Array.isArray(c) ? c : [c] : [];
 	}
 	return jsx(element.tag, {
 		...element.props,

package/node_modules/hono/dist/middleware/bearer-auth/index.js

@@ -52,6 +52,14 @@ const bearerAuth = (options) => {
 		const wwwAuthenticateHeaderValue = typeof wwwAuthenticateHeader === "function" ? await wwwAuthenticateHeader(c) : wwwAuthenticateHeader;
 		const headers = { "WWW-Authenticate": typeof wwwAuthenticateHeaderValue === "string" ? wwwAuthenticateHeaderValue : `${wwwAuthenticatePrefix}${Object.entries(wwwAuthenticateHeaderValue).map(([key, value]) => `${key}="${value}"`).join(",")}` };
 		const responseMessage = typeof messageOption === "function" ? await messageOption(c) : messageOption;
+		if (responseMessage instanceof Response) {
+			const resHeaders = new Headers(responseMessage.headers);
+			if (!resHeaders.has("WWW-Authenticate")) resHeaders.set("WWW-Authenticate", headers["WWW-Authenticate"]);
+			throw new HTTPException(responseMessage.status, { res: new Response(responseMessage.body, {
+				status: responseMessage.status,
+				headers: resHeaders
+			}) });
+		}
 		const res = typeof responseMessage === "string" ? new Response(responseMessage, {
 			status,
 			headers

package/node_modules/hono/dist/middleware/serve-static/index.js

@@ -1,4 +1,5 @@
 import { tryDecodeURI } from "../../utils/url.js";
+import { parseAccept } from "../../utils/accept.js";
 import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from "../../utils/compress.js";
 import { getMimeType } from "../../utils/mime.js";
 import { defaultJoin } from "./path.js";
@@ -19,6 +20,7 @@ const serveStatic = (options) => {
 	const join = options.join ?? defaultJoin;
 	return async (c, next) => {
 		if (c.finalized) return next();
+		if (c.req.method !== "GET" && c.req.method !== "HEAD") return next();
 		let filename;
 		if (options.path) filename = options.path;
 		else try {
@@ -38,7 +40,7 @@ const serveStatic = (options) => {
 			const mimeType = options.mimes && getMimeType(path, options.mimes) || getMimeType(path);
 			c.header("Content-Type", mimeType || "application/octet-stream");
 			if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
-				const acceptEncodingSet = new Set(c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim()));
+				const acceptEncodingSet = new Set(parseAccept(c.req.header("Accept-Encoding") ?? "").filter((encoding) => encoding.q > 0).map((encoding) => encoding.type));
 				for (const encoding of ENCODINGS_ORDERED_KEYS) {
 					if (!acceptEncodingSet.has(encoding)) continue;
 					const compressedContent = await getContent(path + ENCODINGS[encoding], c);

package/node_modules/hono/dist/router/trie-router/node.js

@@ -97,7 +97,7 @@ var Node = class Node {
 						const restPathString = path.slice(partOffsets[i]);
 						const m = matcher.exec(restPathString);
 						if (m) {
-							params[name] = m[0];
+							if (!Object.hasOwn(params, name)) params[name] = m[0];
 							this.#pushHandlerSets(handlerSets, child, method, node.#params, params);
 							if (m[0].length === restPathString.length && child.#children["*"]) this.#pushHandlerSets(handlerSets, child.#children["*"], method, node.#params, params);
 							for (const _ in child.#children) {
@@ -110,7 +110,7 @@ var Node = class Node {
 						}
 					}
 					if (matcher === true || matcher.test(part)) {
-						params[name] = part;
+						if (!Object.hasOwn(params, name)) params[name] = part;
 						if (isLast) {
 							this.#pushHandlerSets(handlerSets, child, method, params, node.#params);
 							if (child.#children["*"]) this.#pushHandlerSets(handlerSets, child.#children["*"], method, params, node.#params);

package/node_modules/hono/dist/types/adapter/aws-lambda/conninfo.d.ts

@@ -1,4 +1,4 @@
-import { GetConnInfo } from "../../helper/conninfo/types.js";
+import { GetConnInfo } from "../../helper/conninfo/index.js";
 //#region src/adapter/aws-lambda/conninfo.d.ts
 /**
  * Get connection information from AWS Lambda

package/node_modules/hono/dist/types/adapter/bun/conninfo.d.ts

@@ -1,4 +1,4 @@
-import { GetConnInfo } from "../../helper/conninfo/types.js";
+import { GetConnInfo } from "../../helper/conninfo/index.js";
 //#region src/adapter/bun/conninfo.d.ts
 /**
  * Get ConnInfo with Bun

package/node_modules/hono/dist/types/adapter/bun/ssg.d.ts

@@ -1,4 +1,4 @@
-import { FileSystemModule, ToSSGAdaptorInterface } from "../../helper/ssg/ssg.js";
+import { FileSystemModule, ToSSGAdaptorInterface } from "../../helper/ssg/index.js";
 //#region src/adapter/bun/ssg.d.ts
 /**
  * @experimental

package/node_modules/hono/dist/types/adapter/cloudflare-pages/conninfo.d.ts

@@ -1,4 +1,4 @@
-import { GetConnInfo } from "../../helper/conninfo/types.js";
+import { GetConnInfo } from "../../helper/conninfo/index.js";
 //#region src/adapter/cloudflare-pages/conninfo.d.ts
 /**
  * Get connection information from Cloudflare Pages

package/node_modules/hono/dist/types/adapter/cloudflare-workers/conninfo.d.ts

@@ -1,4 +1,4 @@
-import { GetConnInfo } from "../../helper/conninfo/types.js";
+import { GetConnInfo } from "../../helper/conninfo/index.js";
 //#region src/adapter/cloudflare-workers/conninfo.d.ts
 /**
  * @deprecated `hono/cloudflare-workers` will be removed in v5. Install `@hono/cloudflare-workers` and import from there instead.

package/node_modules/hono/dist/types/adapter/deno/conninfo.d.ts

@@ -1,4 +1,4 @@
-import { GetConnInfo } from "../../helper/conninfo/types.js";
+import { GetConnInfo } from "../../helper/conninfo/index.js";
 //#region src/adapter/deno/conninfo.d.ts
 /**
  * Get conninfo with Deno

package/node_modules/hono/dist/types/adapter/deno/ssg.d.ts

@@ -1,4 +1,4 @@
-import { FileSystemModule, ToSSGAdaptorInterface } from "../../helper/ssg/ssg.js";
+import { FileSystemModule, ToSSGAdaptorInterface } from "../../helper/ssg/index.js";
 //#region src/adapter/deno/ssg.d.ts
 /**
  * @experimental

package/node_modules/hono/dist/types/adapter/lambda-edge/conninfo.d.ts

@@ -1,4 +1,4 @@
-import { GetConnInfo } from "../../helper/conninfo/types.js";
+import { GetConnInfo } from "../../helper/conninfo/index.js";
 //#region src/adapter/lambda-edge/conninfo.d.ts
 /**
  * @deprecated `hono/lambda-edge` will be removed in v5. Install `@hono/lambda-edge` and import from there instead.

package/node_modules/hono/dist/types/adapter/netlify/conninfo.d.ts

@@ -1,4 +1,4 @@
-import { GetConnInfo } from "../../helper/conninfo/types.js";
+import { GetConnInfo } from "../../helper/conninfo/index.js";
 //#region src/adapter/netlify/conninfo.d.ts
 /**
  * Get connection information from Netlify