Hono changelog

Security fixes This release includes a fix for the following security issue: hono/jsx renders plain strings unescaped in boundary components, leading to XSS Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToStr

fix(client): keep a param value of "index" in $url() and $path() in https://github.com/honojs/hono/pull/5297 fix(client): normalize root WebSocket URLs in https://github.com/honojs/hono/pull/5291 fix(types): allow symbol keys in Context get

Security fixes This release includes fixes for the following security issues: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials Affects: Cache Middleware and applications behind a

fix(request): handle params on unmatched requests in https://github.com/honojs/hono/pull/5268 fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in https://github.com/honojs/hono/pull/5264 fix(reg-exp-router): ass

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in https://github.com/honojs/hono/pull/5227 fix(etag): copy pending stream bytes in https://github.com/honojs/hono/pull/5239 fix(etag): avoid skipping he

fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in https://github.com/honojs/hono/pull/5197 fix(jsx): render async children of document metadata tags instead of [object Pr

fix(trie-router): count every slash a pattern consumes by @Jaybhade in https://github.com/honojs/hono/pull/5189 fix(utils/stream): re-acquire writer lock when pipe() throws by @Sriharsha-dev369 in https://github.com/honojs/hono/pull/4988 fi

Hono v4.13.0 is now available! The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also add

Security fixes This release includes fixes for the following security issues: memo() retains SSR output across requests, leading to cross-user data disclosure Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render

fix(cookie): relax name validation when parsing Cookie header in https://github.com/honojs/hono/pull/5164 chore: bump @hono/node-server in https://github.com/honojs/hono/pull/5167 fix(jsx): handle useSyncExternalStore subscription and snaps

ci: enable reports for type & bundle size check in https://github.com/honojs/hono/pull/5148 fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in https://github.com/honojs/hono/pull/5142 fix(sse): emit empty id field to

test(context): assert case-insensitive header names in response helpers by @yusukebe in https://github.com/honojs/hono/pull/5116 chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in https://github.com/honojs/hono/pull/5117 r

chore(benchmark/routers): bump deps in https://github.com/honojs/hono/pull/5107 chore(benchmark): remove not used benchmarks in https://github.com/honojs/hono/pull/5108 chore: update to ts6 in prep for ts7 in https://github.com/honojs/hono/

fix(client): merge function headers with per-request headers by @yusukebe in https://github.com/honojs/hono/pull/5092 chore: fix no-op tsc in test script by @yusukebe in https://github.com/honojs/hono/pull/5093 fix(lambda-edge): resolve the

fix(serve-static): treat empty string content as found by @yusukebe in https://github.com/honojs/hono/pull/5062 docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in https://github.com/honojs/hono/pull/5047 c

Security fixes This release includes fixes for the following security issues: hono/jsx does not isolate context per request Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useCont

fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @yusukebe in https://github.com/honojs/hono/pull/5013 ci: publish to npm from CI with OIDC trusted publishing by @yusukebe in https://github.com/honojs/hono/pull/5

Security fixes This release includes fixes for the following security issues: CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard Affects: hono/cors. Fixes the wildcard origin reflecting the request Ori

docs(contribution): simplifyAI Usage Policy by @yusukebe in https://github.com/honojs/hono/pull/4972 chore: remove @types/glob by @rtritto in https://github.com/honojs/hono/pull/4978 fix(bearer-auth): mention verifyToken in missing-options

fix(serve-static): normalize all backslashes in file paths, not just the first in https://github.com/honojs/hono/pull/4962 feat(context): export the Context class publicly by @BlankParticle in https://github.com/honojs/hono/pull/4543 docs(c

chore: update vitest to v4 and cleanups by @BlankParticle in https://github.com/honojs/hono/pull/4952 fix(mime): specify charset parameter per MIME type instead of mechanical detection by @renatograsso10 in https://github.com/honojs/hono/pu

Security fixes This release includes fixes for the following security issues: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths Affects: app.mount(). Fixes prefix stripping using the r

fix(route): preserve the base path of the mounted route() app by @usualoma in https://github.com/honojs/hono/pull/4942 fix(jsx): widen jsx and jsxFn children to Child[] by @ashunar0 in https://github.com/honojs/hono/pull/4947

ci: pin GitHub Actions to SHAs by @yusukebe in https://github.com/honojs/hono/pull/4932 fix(serveStatic): make options parameter optional in all adapters by @mixelburg in https://github.com/honojs/hono/pull/4934 fix(cookie): return the firs

Security fixes This release includes fixes for the following security issues: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage Affects: Cache Middleware. Fixes missing cache-skip handling for V

fix(jsx): normalize SVG attributes on the root element by @kfly8 in https://github.com/honojs/hono/pull/4893 fix(ssg): add atom+xml and rss+xml to defaultExtensionMap by @yuintei in https://github.com/honojs/hono/pull/4899 fix(cors): make o

Security fixes This release includes fixes for the following security issues: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), w

fix(jwt): support single-line PEM keys by @hiendv in https://github.com/honojs/hono/pull/4889

Security fixes This release includes fixes for the following security issues: Improper handling of JSX attribute names in hono/jsx SSR Affects: hono/jsx. Fixes missing validation of JSX attribute names during server-side rendering, which co

fix(types): infer response type from last handler in app.on 9-/10-handler overloads by @T4ko0522 in https://github.com/honojs/hono/pull/4865 feat(trailing-slash): add skip option by @yusukebe in https://github.com/honojs/hono/pull/4862 feat

Security fixes This release includes fixes for the following security issues: Middleware bypass via repeated slashes in serveStatic Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could

feat(css): add classNameSlug option to createCssContext by @flow-pie in https://github.com/honojs/hono/pull/4834

test(router): fix Simple capturing group test by @yusukebe in https://github.com/honojs/hono/pull/4838 docs: fix impaired -> inspired typo in benchmark READMEs by @Abhi3975 in https://github.com/honojs/hono/pull/4843 fix(jsx/dom): apply sel

fix(request): remove parseBody from bodyCache to prevent TypeError by @yusukebe in https://github.com/honojs/hono/pull/4807 feat(client): add PickResponseByStatusCode type by @yusukebe in https://github.com/honojs/hono/pull/4791 fix(ssg): p

fix(utils/mime): Normalize input extension to lowercase before MIME check by @TheEssem in https://github.com/honojs/hono/pull/4800 fix(bearer-auth): escape regex metacharacters in bearer auth prefix option by @otoneko1102 in https://github.

Security hardening Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

fix(accept): replace regex split to mitigate ReDoS by @EdamAme-x in https://github.com/honojs/hono/pull/4758 fix(jsx): align link hoisting and dedupe with React 19 by @usualoma in https://github.com/honojs/hono/pull/4792 chore(builld): tsco

fix(request): return string | undefined from param() when path type is any by @andrewdamelio in https://github.com/honojs/hono/pull/4723 fix(jwt): validate token format in decode and decodeHeader functions by @otoneko1102 in https://github.

Security fixes This release includes fixes for the following security issues: SSE Control Field Injection Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and ret

fix(validator): prevent type diff bug in form data parsing by @EdamAme-x in https://github.com/honojs/hono/pull/4753 fix(jwt): use Math.floor instead of bitwise OR for safe timestamp by @EdamAme-x in https://github.com/honojs/hono/pull/4754

Security fix Fixed incorrect handling of X-Forwarded-For in the AWS Lambda adapter behind ALB that could allow IP-based access control bypass. The detail: https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3 Thanks @EdamAm

fix(client): export ApplyGlobalResponse from hono/client by @sushichan044 in https://github.com/honojs/hono/pull/4743

Hono v4.12.0 is now available! This release includes new features for the Hono client, middleware improvements, adapter enhancements, and significant performance improvements to the router and context. $path for Hono Client The Hono client

fix: fixed to be more properly timing safe (Merge commit from fork 91def7ca)

fix(url): ignore fragment identifiers in getPath() by @sano-suguru in https://github.com/honojs/hono/pull/4627 fix: determine if rendered or not by node.vC[0] instead of referring to node.pP by @usualoma in https://github.com/honojs/hono/pu

fix(jsx): preserve context when using await before html helper by @kaigritun in https://github.com/honojs/hono/pull/4662 fix(bearer-auth): make auth-scheme case-insensitive by @bytaesu in https://github.com/honojs/hono/pull/4659

Security Release This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components. Components IP Restriction Middleware Fixed an IPv4 ad

refactor: use unique symbol for more accurate typing. by @usualoma in https://github.com/honojs/hono/pull/4651 docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant by @sano-suguru in https://github.com/honojs/hono/pull/4630 fix(

fix(client): exclude $all from ClientRequest type by @paveg in https://github.com/honojs/hono/pull/4611 refactor(jwks): mark allowedAlgorithms, so the user can pass a `const… by @nikeee in https://github.com/honojs/hono/pull/4641 feat(jwt):

Security Fixed a JWT algorithm confusion issue in the JWT and JWK/JWKS middleware. Both middlewares now require an explicit algorithm configuration to prevent the verification algorithm from being influenced by untrusted JWT header values.

fix(types): fix middleware union type merging in MergeMiddlewareResponse by @yusukebe in https://github.com/honojs/hono/pull/4602

docs: improve grammar in contributing documentation by @Ishiezz in https://github.com/honojs/hono/pull/4581 fix(validator): preserve literal union types in input type inference by @yusukebe in https://github.com/honojs/hono/pull/4583 chore:

fix(types): fix app.on method array type inference by @kosei28 in https://github.com/honojs/hono/pull/4578

Hono v4.11.0 is now available! This release includes new features for the Hono client, middleware improvements, and an important type system fix. Type System Fix for Middleware We've fixed a bug in the type system for middleware. Previously

chore: bump linter and formatter by @ryuapp in https://github.com/honojs/hono/pull/4568 chore: bump github actions by @ryuapp in https://github.com/honojs/hono/pull/4569 fix(linear-router): incorrect path matching by @cromery in https://git

fix(validator): fix incomplete types and wrong tests by @EdamAme-x in https://github.com/honojs/hono/pull/4521 refactor(types): delete type NotSpecified and StrictVerifyOptions by @ysknsid25 in https://github.com/honojs/hono/pull/4525 fix:

Deperecated bearer-auth options The following options are deprecated and will be removed in a future version: noAuthenticationHeaderMessage => use noAuthenticationHeader.message invalidAuthenticationHeaderMessage => use invalidAuthenticatio

docs(CONTRIBUTING): use bun instead of yarn in local development setup by @taichi-1 in https://github.com/honojs/hono/pull/4503 docs: grammar issue by @WuMingDao in https://github.com/honojs/hono/pull/4508 fix(utils/url): make _getQueryPara

chore: add a monochrome logo image by @yusukebe in https://github.com/honojs/hono/pull/4487 chore: fix the monochrome logo by @yusukebe in https://github.com/honojs/hono/pull/4488 fix(secure-headers): proposed features typo spelling mistake

Securiy Fix A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware. What's Changed fix(aws-lamb