@suveren/gateway 0.39.0 → 0.41.0

package/node_modules/encodeurl/README.md

@@ -1,5 +1,10 @@
 # Encode URL
 
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Build Status][ci-image]][ci-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
 Encode a URL to a percent-encoded form, excluding already-encoded sequences.
 
 ## Installation
@@ -107,3 +112,12 @@ $ npm run lint
 ## License
 
 [MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/encodeurl
+[npm-url]: https://npmjs.org/package/encodeurl
+[downloads-image]: https://img.shields.io/npm/dm/encodeurl
+[downloads-url]: https://npmcharts.com/compare/encodeurl?minimal=true
+[ci-image]: https://img.shields.io/github/actions/workflow/status/pillarjs/encodeurl/ci.yml?branch=master
+[ci-url]: https://github.com/pillarjs/encodeurl/actions/workflows/ci.yml
+[coveralls-image]: https://img.shields.io/coverallsCoverage/github/pillarjs/encodeurl?branch=master
+[coveralls-url]: https://coveralls.io/r/pillarjs/encodeurl?branch=master

package/node_modules/encodeurl/index.js

@@ -22,18 +22,11 @@ module.exports = encodeUrl
 var ENCODE_CHARS_REGEXP = /(?:[^\x21\x23-\x3B\x3D\x3F-\x5F\x61-\x7A\x7C\x7E]|%(?:[^0-9A-Fa-f]|[0-9A-Fa-f][^0-9A-Fa-f]|$))+/g
 
 /**
- * RegExp to match unmatched surrogate pair.
+ * RegExp to match surrogate pairs and unpaired surrogates.
  * @private
  */
 
-var UNMATCHED_SURROGATE_PAIR_REGEXP = /(^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]|[\uD800-\uDBFF]([^\uDC00-\uDFFF]|$)/g
-
-/**
- * String to replace unmatched surrogate pair with.
- * @private
- */
-
-var UNMATCHED_SURROGATE_PAIR_REPLACE = '$1\uFFFD$2'
+var SURROGATE_REGEXP = /([\uD800-\uDBFF][\uDC00-\uDFFF])|[\uD800-\uDFFF]/g
 
 /**
  * Encode a URL to a percent-encoded form, excluding already-encoded sequences.
@@ -55,6 +48,8 @@ var UNMATCHED_SURROGATE_PAIR_REPLACE = '$1\uFFFD$2'
 
 function encodeUrl (url) {
   return String(url)
-    .replace(UNMATCHED_SURROGATE_PAIR_REGEXP, UNMATCHED_SURROGATE_PAIR_REPLACE)
+    .replace(SURROGATE_REGEXP, function (_, pair) {
+      return pair || '\uFFFD'
+    })
     .replace(ENCODE_CHARS_REGEXP, encodeURI)
 }

package/node_modules/encodeurl/package.json

@@ -1,7 +1,7 @@
 {
   "name": "encodeurl",
   "description": "Encode a URL to a percent-encoded form, excluding already-encoded sequences",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>"
   ],
@@ -12,6 +12,10 @@
     "url"
   ],
   "repository": "pillarjs/encodeurl",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
   "devDependencies": {
     "eslint": "5.11.1",
     "eslint-config-standard": "12.0.0",
@@ -19,8 +23,8 @@
     "eslint-plugin-node": "7.0.1",
     "eslint-plugin-promise": "4.0.1",
     "eslint-plugin-standard": "4.0.0",
-    "istanbul": "0.4.5",
-    "mocha": "2.5.3"
+    "mocha": "~11.7.0",
+    "nyc": "~17.1.0"
   },
   "files": [
     "LICENSE",
@@ -33,8 +37,8 @@
   },
   "scripts": {
     "lint": "eslint .",
-    "test": "mocha --reporter spec --bail --check-leaks test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/"
+    "test": "mocha --check-leaks --reporter spec",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
   }
 }

package/node_modules/express-rate-limit/dist/index.cjs

@@ -182,7 +182,7 @@ var MemoryStore = class {
    */
   resetClient(client, now = Date.now()) {
     client.totalHits = 0;
-    client.resetTime.setTime(now + this.windowMs);
+    client.resetTime = new Date(now + this.windowMs);
     return client;
   }
   /**
@@ -931,7 +931,11 @@ var rateLimit = (passedOptions) => {
       try {
         const incrementResult = await config.store.increment(key);
         totalHits = incrementResult.totalHits;
-        resetTime = incrementResult.resetTime;
+        if (incrementResult.resetTime && (config.skipFailedRequests || config.skipSuccessfulRequests)) {
+          resetTime = new Date(incrementResult.resetTime.getTime());
+        } else {
+          resetTime = incrementResult.resetTime;
+        }
       } catch (error) {
         if (config.passOnStoreError) {
           config.logger.error(
@@ -1057,7 +1061,7 @@ var rateLimit = (passedOptions) => {
           const retryAfter = await retrieveRetryAfter;
           setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
-        config.handler(request, response, next, options);
+        await config.handler(request, response, next, options);
         return;
       }
       next();

package/node_modules/express-rate-limit/dist/index.mjs

@@ -139,7 +139,7 @@ var MemoryStore = class {
    */
   resetClient(client, now = Date.now()) {
     client.totalHits = 0;
-    client.resetTime.setTime(now + this.windowMs);
+    client.resetTime = new Date(now + this.windowMs);
     return client;
   }
   /**
@@ -888,7 +888,11 @@ var rateLimit = (passedOptions) => {
       try {
         const incrementResult = await config.store.increment(key);
         totalHits = incrementResult.totalHits;
-        resetTime = incrementResult.resetTime;
+        if (incrementResult.resetTime && (config.skipFailedRequests || config.skipSuccessfulRequests)) {
+          resetTime = new Date(incrementResult.resetTime.getTime());
+        } else {
+          resetTime = incrementResult.resetTime;
+        }
       } catch (error) {
         if (config.passOnStoreError) {
           config.logger.error(
@@ -1014,7 +1018,7 @@ var rateLimit = (passedOptions) => {
           const retryAfter = await retrieveRetryAfter;
           setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
-        config.handler(request, response, next, options);
+        await config.handler(request, response, next, options);
         return;
       }
       next();

package/node_modules/express-rate-limit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.7.1",
+	"version": "8.7.3",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",
@@ -86,25 +86,25 @@
 		"@biomejs/biome": "2.4.6",
 		"@express-rate-limit/prettier": "1.1.1",
 		"@express-rate-limit/tsconfig": "1.0.5",
-		"@jest/globals": "30.5.1",
+		"@jest/globals": "30.5.2",
 		"@types/debug": "4.1.13",
 		"@types/express": "5.0.6",
 		"@types/jest": "30.0.0",
-		"@types/node": "26.4.1",
+		"@types/node": "26.6.4",
 		"@types/supertest": "7.2.1",
 		"del-cli": "7.0.0",
 		"dts-bundle-generator": "8.1.2",
 		"esbuild": "0.28.2",
 		"express": "5.2.1",
 		"husky": "9.1.7",
-		"jest": "30.5.1",
-		"lint-staged": "17.4.1",
-		"mintlify": "4.2.874",
+		"jest": "30.5.2",
+		"lint-staged": "17.6.0",
+		"mintlify": "4.2.988",
 		"npm-run-all": "4.1.5",
-		"prettier": "3.9.6",
-		"ratelimit-header-parser": "0.1.0",
-		"supertest": "7.2.2",
-		"ts-jest": "29.4.12",
+		"prettier": "3.9.9",
+		"ratelimit-header-parser": "0.2.1",
+		"supertest": "7.3.1",
+		"ts-jest": "29.4.14",
 		"ts-node": "10.9.2",
 		"typescript": "5.9.3"
 	},

package/node_modules/follow-redirects/README.md

@@ -1,4 +1,30 @@
-## Follow Redirects
+## _Follow Redirects_ is in need of funding
+
+> [!IMPORTANT]
+> **Maintenance paused until funding found.**
+>
+> follow-redirects is downloaded over 400 million times per month,
+> It has been maintained for over ten years by one volunteer,
+> who has no funds to provide update and security guarantees.
+>
+> **What this means for you:**
+> the package stays published and keeps working as it does today,
+> but there are no guarantees of bug fixes, security fixes,
+> or replies to issues and pull requests.
+> Security reports are handled best-effort only; see [SECURITY.md](SECURITY.md).
+>
+> **What can restart maintenance:**
+> Even if only 0.1% of downloads paid $0.01, we'd be fully funded
+> with $4000 per month.
+> That's not the case, and that's okay,
+> but unfortunately also insufficient to continue.
+> We need to cover security triage, CVE handling, fixes, and releases.
+> Progress toward that goal will be posted here.
+>
+> **If your company depends on follow-redirects,**
+> directly or another library,
+> please [sponsor on GitHub](https://github.com/sponsors/RubenVerborgh)
+> or email us for invoice-based funding or a security support agreement.
 
 Drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
 

package/node_modules/follow-redirects/index.js

@@ -311,7 +311,7 @@ RedirectableRequest.prototype._sanitizeOptions = function (options) {
     }
   }
   // Ensure sensitive headers are always present
-  if (!isArray(options.sensitiveHeaders)) {
+  if (!Array.isArray(options.sensitiveHeaders)) {
     options.sensitiveHeaders = [];
   }
 
@@ -689,10 +689,6 @@ function isSubdomain(subdomain, domain) {
   return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
 }
 
-function isArray(value) {
-  return value instanceof Array;
-}
-
 function isString(value) {
   return typeof value === "string" || value instanceof String;
 }

package/node_modules/follow-redirects/package.json

@@ -1,6 +1,6 @@
 {
   "name": "follow-redirects",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "description": "HTTP and HTTPS modules that follow redirects.",
   "license": "MIT",
   "main": "index.js",

package/node_modules/hono/README.md

@@ -17,7 +17,6 @@
 [![GitHub last commit](https://img.shields.io/github/last-commit/honojs/hono)](https://github.com/honojs/hono/commits/main)
 [![codecov](https://codecov.io/github/honojs/hono/graph/badge.svg)](https://codecov.io/github/honojs/hono)
 [![Discord badge](https://img.shields.io/discord/1011308539819597844?label=Discord&logo=Discord)](https://discord.gg/KMh2eNSdxV)
-[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/honojs/hono)
 
 Hono - _**means flame🔥 in Japanese**_ - is a small, simple, and ultrafast web framework built on Web Standards. It works on any JavaScript runtime: Cloudflare Workers, Fastly Compute, Deno, Bun, Vercel, AWS Lambda, Lambda@Edge, and Node.js.
 
@@ -63,9 +62,9 @@ The migration guide is available on [docs/MIGRATION.md](docs/MIGRATION.md).
 Contributions Welcome! You can contribute in the following ways.
 
 - Create an Issue - Propose a new feature. Report a bug.
-- Pull Request - Fix a bug or typo. Refactor the code.
-- Create third-party middleware - See [Third-party middleware](docs/CONTRIBUTING.md#third-party-middleware).
+- Build middleware and libraries - Grow the Hono ecosystem.
 - Share - Share your thoughts on the Blog, X, and others.
+- Sponsor - Support the maintainers through GitHub Sponsors: [@yusukebe](https://github.com/sponsors/yusukebe) and [@usualoma](https://github.com/sponsors/usualoma).
 - Make your application - Please try to use Hono.
 
 For more details, see [docs/CONTRIBUTING.md](docs/CONTRIBUTING.md).

package/node_modules/hono/dist/cjs/adapter/bun/serve-static.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_middleware_serve_static_index = require("../../middleware/serve-static/index.js");
-let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
+let node_fs_promises = require("node:fs/promises");
 //#region src/adapter/bun/serve-static.ts
 /**
 * @deprecated `hono/bun` will be removed in v5. Install `@hono/bun` and import from there instead.

package/node_modules/hono/dist/cjs/adapter/bun/websocket.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_adapter_bun_server = require("./server.js");
 const require_helper_websocket_index = require("../../helper/websocket/index.js");
+const require_adapter_bun_server = require("./server.js");
 //#region src/adapter/bun/websocket.ts
 /**
 * @internal

package/node_modules/hono/dist/cjs/context.js

@@ -198,7 +198,7 @@ var Context = class {
 	* ```
 	*/
 	header = (name, value, options) => {
-		if (this.finalized) this.#res = createResponseInstance(this.#res.body, this.#res);
+		if (this.finalized && !this.#res.bodyUsed) this.#res = createResponseInstance(this.#res.body, this.#res);
 		const headers = this.#res ? this.#res.headers : this.#preparedHeaders ??= new Headers();
 		if (value === void 0) headers.delete(name);
 		else if (options?.append) headers.append(name, value);

package/node_modules/hono/dist/cjs/helper/css/common.js

@@ -46,7 +46,11 @@ const isValidKeyframeName = (name) => isValidClassName(name) && !RESERVED_KEYFRA
 const defaultOnInvalidSlug = (slug) => {
 	console.warn(`Invalid slug: ${slug}`);
 };
-const cssStringReStr = ["\"(?:(?:\\\\[\\s\\S]|[^\"\\\\])*)\"", "'(?:(?:\\\\[\\s\\S]|[^'\\\\])*)'"].join("|");
+const cssStringReStr = [
+	"\"(?:(?:\\\\[\\s\\S]|[^\"\\\\])*)\"",
+	"'(?:(?:\\\\[\\s\\S]|[^'\\\\])*)'",
+	"url\\(\\s*[^)\"'\\s]*\\s*\\)"
+].join("|");
 const minifyCssRe = new RegExp([
 	"(" + cssStringReStr + ")",
 	"(?:" + [
@@ -56,11 +60,12 @@ const minifyCssRe = new RegExp([
 		"\\s+$"
 	].join("|") + ")",
 	"\\s*;\\s*(}|$)\\s*",
-	"\\s*([{};:,])\\s*",
+	"\\s*([{};,])\\s*",
+	"(:)\\s*",
 	"(\\s)\\s+"
 ].join("|"), "g");
 const minify = (css) => {
-	return css.replace(minifyCssRe, (_, $1, $2, $3, $4) => $1 || $2 || $3 || $4 || "");
+	return css.replace(minifyCssRe, (_, $1, $2, $3, $4, $5) => $1 || $2 || $3 || $4 || $5 || "");
 };
 const buildStyleString = (strings, values) => {
 	const selectors = [];
@@ -75,10 +80,8 @@ const buildStyleString = (strings, values) => {
 		for (let j = 0, len = vArray.length; j < len; j++) {
 			let value = vArray[j];
 			if (typeof value === "boolean" || value === null || value === void 0) continue;
-			if (typeof value === "string") {
-				if (/([\\"'\/])/.test(value)) styleString += value.replace(/([\\"']|(?<=<)\/)/g, "\\$1");
-				else styleString += value;
-			} else if (typeof value === "number") styleString += value;
+			if (typeof value === "string") styleString += value.replace(/[\\"']/g, "\\$&");
+			else if (typeof value === "number") styleString += value;
 			else if (value[CSS_ESCAPED]) styleString += value[CSS_ESCAPED];
 			else if (value[CLASS_NAME].startsWith("@keyframes ")) {
 				selectors.push(value);
@@ -103,7 +106,7 @@ const buildStyleString = (strings, values) => {
 	}
 	return [
 		label,
-		minify(styleString),
+		minify(styleString).replace(/<\//g, "<\\/"),
 		selectors,
 		externalClassNames
 	];

package/node_modules/hono/dist/cjs/helper/css/index.js

@@ -21,7 +21,7 @@ const createCssContext = ({ id, classNameSlug, onInvalidSlug }) => {
 	const [cssJsxDomObject, StyleRenderToDom] = require_jsx_dom_css.createCssJsxDomObjects({ id });
 	const contextMap = /* @__PURE__ */ new WeakMap();
 	const nonceMap = /* @__PURE__ */ new WeakMap();
-	const replaceStyleRe = new RegExp(`(<style id="${id}"(?: nonce="[^"]*")?>.*?)(</style>)`);
+	const replaceStyleRe = new RegExp(`(<style id="${id}"(?: nonce="[^"]*")?>.*?)(</style>)`, "s");
 	const newCssClassNameObject = (cssClassName) => {
 		const appendStyle = ({ buffer, context }) => {
 			const [toAdd, added] = contextMap.get(context);

package/node_modules/hono/dist/cjs/helper/route/index.js

@@ -111,7 +111,9 @@ const basePath = (c, index) => {
 			const pattern = require_utils_url.getPattern(paths[i], paths[i + 1]);
 			if (pattern) {
 				const re = pattern[2] === true || pattern === "*" ? /[^\/]+/ : pattern[2];
-				basePathLength += reqPath.substring(basePathLength + 1).match(re)?.[0].length || 0;
+				const restPath = reqPath.substring(basePathLength + 1);
+				const segment = restPath.split("/", 1)[0];
+				basePathLength += (restPath.match(re)?.[0] ?? (re.test(segment) ? segment : "")).length;
 			} else basePathLength += paths[i].length;
 			basePathLength += 1;
 		}

package/node_modules/hono/dist/cjs/hono-base.js

@@ -4,6 +4,7 @@ const require_utils_url = require("./utils/url.js");
 const require_context = require("./context.js");
 const require_router = require("./router.js");
 const require_utils_constants = require("./utils/constants.js");
+const require_utils_mount = require("./utils/mount.js");
 //#region src/hono-base.ts
 /**
 * @module
@@ -228,17 +229,10 @@ var Hono = class Hono {
 			} catch {}
 			return [c.env, executionContext];
 		};
-		replaceRequest ||= (() => {
-			const mergedPath = require_utils_url.mergePath(this._basePath, path);
-			const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
-			return (request) => {
-				const url = new URL(request.url);
-				url.pathname = this.getPath(request).slice(pathPrefixLength) || "/";
-				return new Request(url, request);
-			};
-		})();
+		const mergedPath = require_utils_url.mergePath(this._basePath, path);
+		const defaultReplaceRequest = (c) => require_utils_mount.createMountedRequest(c, mergedPath.replace(/\/$/, ""), require_utils_url.mergePath(mergedPath, "*"));
 		const handler = async (c, next) => {
-			const res = await applicationHandler(replaceRequest(c.req.raw), ...getOptions(c));
+			const res = await applicationHandler(replaceRequest ? replaceRequest(c.req.raw) : defaultReplaceRequest(c), ...getOptions(c));
 			if (res) return res;
 			await next();
 		};

package/node_modules/hono/dist/cjs/hono.js

@@ -1,7 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_hono_base = require("./hono-base.js");
 const require_router_reg_exp_router_router = require("./router/reg-exp-router/router.js");
-require("./router/reg-exp-router/index.js");
 const require_router_smart_router_router = require("./router/smart-router/router.js");
 const require_router_trie_router_router = require("./router/trie-router/router.js");
 require("./router/trie-router/index.js");

package/node_modules/hono/dist/cjs/jsx/base.js

@@ -240,7 +240,7 @@ const cloneElement = (element, props, ...children) => {
 	if (children.length > 0) childrenToClone = children;
 	else {
 		const c = element.props.children;
-		childrenToClone = Array.isArray(c) ? c : [c];
+		childrenToClone = c !== void 0 ? Array.isArray(c) ? c : [c] : [];
 	}
 	return jsx(element.tag, {
 		...element.props,

package/node_modules/hono/dist/cjs/middleware/basic-auth/index.js

@@ -81,7 +81,7 @@ const basicAuth = (options, ...users) => {
 			}
 		}
 		const status = 401;
-		const headers = { "WWW-Authenticate": "Basic realm=\"" + options.realm?.replace(/"/g, "\\\"") + "\"" };
+		const headers = { "WWW-Authenticate": "Basic realm=\"" + options.realm?.replace(/[\\"]/g, "\\$&") + "\"" };
 		const responseMessage = typeof options.invalidUserMessage === "function" ? await options.invalidUserMessage(ctx) : options.invalidUserMessage;
 		const res = typeof responseMessage === "string" ? new Response(responseMessage, {
 			status,

package/node_modules/hono/dist/cjs/middleware/bearer-auth/index.js

@@ -45,7 +45,7 @@ const bearerAuth = (options) => {
 	if (!("token" in options || "verifyToken" in options)) throw new Error("bearer auth middleware requires options for \"token\" or \"verifyToken\"");
 	if (!options.realm) options.realm = "";
 	if (options.prefix === void 0) options.prefix = PREFIX;
-	const realm = options.realm?.replace(/"/g, "\\\"");
+	const realm = options.realm?.replace(/[\\"]/g, "\\$&");
 	const prefix = options.prefix;
 	const tokenRegexp = new RegExp(`^${TOKEN_STRINGS}$`);
 	const wwwAuthenticatePrefix = prefix === "" ? "" : `${prefix} `;
@@ -53,6 +53,14 @@ const bearerAuth = (options) => {
 		const wwwAuthenticateHeaderValue = typeof wwwAuthenticateHeader === "function" ? await wwwAuthenticateHeader(c) : wwwAuthenticateHeader;
 		const headers = { "WWW-Authenticate": typeof wwwAuthenticateHeaderValue === "string" ? wwwAuthenticateHeaderValue : `${wwwAuthenticatePrefix}${Object.entries(wwwAuthenticateHeaderValue).map(([key, value]) => `${key}="${value}"`).join(",")}` };
 		const responseMessage = typeof messageOption === "function" ? await messageOption(c) : messageOption;
+		if (responseMessage instanceof Response) {
+			const resHeaders = new Headers(responseMessage.headers);
+			if (!resHeaders.has("WWW-Authenticate")) resHeaders.set("WWW-Authenticate", headers["WWW-Authenticate"]);
+			throw new require_http_exception.HTTPException(responseMessage.status, { res: new Response(responseMessage.body, {
+				status: responseMessage.status,
+				headers: resHeaders
+			}) });
+		}
 		const res = typeof responseMessage === "string" ? new Response(responseMessage, {
 			status,
 			headers

package/node_modules/hono/dist/cjs/middleware/csrf/index.js

@@ -9,7 +9,7 @@ const secFetchSiteValues = [
 ];
 const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
 const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
-const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
+const isCsrfContentTypeRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/(?:plain|ping))\b/i;
 /**
 * CSRF Protection Middleware for Hono.
 *
@@ -95,7 +95,7 @@ const csrf = (options) => {
 		return await secFetchSiteHandler(secFetchSite, c);
 	};
 	return async function csrf(c, next) {
-		if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
+		if (!isSafeMethodRe.test(c.req.method) && isCsrfContentTypeRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
 			const res = new Response("Forbidden", { status: 403 });
 			throw new require_http_exception.HTTPException(403, { res });
 		}

package/node_modules/hono/dist/cjs/middleware/jwk/jwk.js

@@ -110,8 +110,8 @@ const jwk = (options, init) => {
 	};
 };
 function unauthorizedResponse(opts) {
-	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
-	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/[\\"]/g, "\\$&");
+	const errDescription = opts.errDescription.replace(/[\\"]/g, "\\$&");
 	return new Response("Unauthorized", {
 		status: 401,
 		statusText: opts.statusText,

package/node_modules/hono/dist/cjs/middleware/jwt/jwt.js

@@ -104,8 +104,8 @@ const jwt = (options) => {
 	};
 };
 function unauthorizedResponse(opts) {
-	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
-	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/[\\"]/g, "\\$&");
+	const errDescription = opts.errDescription.replace(/[\\"]/g, "\\$&");
 	return new Response("Unauthorized", {
 		status: 401,
 		statusText: opts.statusText,

package/node_modules/hono/dist/cjs/middleware/mount/index.js

@@ -1,11 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_utils_mount = require("../../utils/mount.js");
 const require_helper_route_index = require("../../helper/route/index.js");
 //#region src/middleware/mount/index.ts
 const defaultReplaceRequest = (c) => {
-	const pathPrefix = require_helper_route_index.routePath(c).replace(/\/\*$/, "");
-	const url = new URL(c.req.raw.url);
-	url.pathname = c.req.path.slice(pathPrefix.length) || "/";
-	return new Request(url, c.req.raw);
+	const path = require_helper_route_index.routePath(c);
+	return require_utils_mount.createMountedRequest(c, path.replace(/\/?\*$/, ""), path);
 };
 const defaultGetOptions = (c) => {
 	let executionContext = void 0;
@@ -22,6 +21,7 @@ const defaultGetOptions = (c) => {
 * @param {Function} applicationHandler - other Request Handler
 * @param {MountOptions} [options] - options of `mount()`
 * @returns {MiddlewareHandler} handler to register with `app.all()`
+* @throws {Error} If the route ends with a wildcard inside a segment (e.g. `/assets*`), or automatic request rewriting encounters duplicate path parameter names.
 *
 * @example
 * ```ts

package/node_modules/hono/dist/cjs/middleware/serve-static/index.js

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_utils_url = require("../../utils/url.js");
+const require_utils_accept = require("../../utils/accept.js");
 const require_utils_compress = require("../../utils/compress.js");
 const require_utils_mime = require("../../utils/mime.js");
 const require_middleware_serve_static_path = require("./path.js");
@@ -20,6 +21,7 @@ const serveStatic = (options) => {
 	const join = options.join ?? require_middleware_serve_static_path.defaultJoin;
 	return async (c, next) => {
 		if (c.finalized) return next();
+		if (c.req.method !== "GET" && c.req.method !== "HEAD") return next();
 		let filename;
 		if (options.path) filename = options.path;
 		else try {
@@ -39,7 +41,7 @@ const serveStatic = (options) => {
 			const mimeType = options.mimes && require_utils_mime.getMimeType(path, options.mimes) || require_utils_mime.getMimeType(path);
 			c.header("Content-Type", mimeType || "application/octet-stream");
 			if (options.precompressed && (!mimeType || require_utils_compress.COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
-				const acceptEncodingSet = new Set(c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim()));
+				const acceptEncodingSet = new Set(require_utils_accept.parseAccept(c.req.header("Accept-Encoding") ?? "").filter((encoding) => encoding.q > 0).map((encoding) => encoding.type));
 				for (const encoding of ENCODINGS_ORDERED_KEYS) {
 					if (!acceptEncodingSet.has(encoding)) continue;
 					const compressedContent = await getContent(path + ENCODINGS[encoding], c);