fix(server): reject unsupported static asset methods

[Boyeep]

Summary

• return 405 Method Not Allowed when an existing static asset receives a method other than GET or HEAD
• emit Allow: GET, HEAD and a deterministic plain-text response
• enforce the rule inside shared static serving so cached and filesystem fallback paths stay aligned
• preserve routing for missing assets instead of incorrectly converting them to 405

Next.js parity

Next.js checks filesystem-route methods before serveStatic and returns 405 with Allow: GET, HEAD. Vinext's early App and Pages asset paths previously bypassed its later method guard.

Test plan

• pnpm test tests/serve-static.test.ts (50 passed)
• staged vp check --fix passed

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@vinext/cloudflare@2714

npm i https://pkg.pr.new/create-vinext-app@2714

npm i https://pkg.pr.new/@vinext/types@2714

npm i https://pkg.pr.new/vinext@2714

commit: 9e9871e

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fc914369bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Route public-file methods through the new rejection check

For production requests such as POST /robots.txt, this new uncached-path check is never reached: the Pages Router's serveFilesystemRoute callback returns false for every non-GET/HEAD request at prod-server.ts:2001, while the App Router's resolvePublicFileRoute does the same before producing a static-file signal. Consequently, real public files still fall through to page routing and usually return 404 rather than the intended 405; the added uncached test only calls this private helper directly and does not exercise either request pipeline. Remove or revise those upstream method gates so existing public files reach this check while missing files still fall through.

AGENTS.md reference: AGENTS.md:L183-L192

Useful? React with 👍 / 👎.

[github-actions]

Performance benchmarks

Compared 9e9871e against base 05eee9f using alternating same-runner rounds. Next.js was unchanged and skipped.

0 improved · 0 regressed · 6 within ±1.5%

Scenario	Framework	Baseline	Current	Change
Client bundle size (gzip)	vinext	132.4 KB	132.4 KB	⚫ +0.0%
Client entry size (gzip)	vinext	119.7 KB	119.7 KB	⚫ +0.0%
Dev server cold start	vinext	2.20 s	2.17 s	⚫ -1.3%
Production build time	vinext	2.32 s	2.32 s	⚫ +0.2%
RSC entry closure size (gzip)	vinext	103.3 KB	103.3 KB	⚫ -0.0%
Server bundle size (gzip)	vinext	177.8 KB	177.8 KB	⚫ -0.0%

View detailed results and traces

_{🟢 improvement · 🔴 regression · ⚫ change below 1.5% · paired base/head}