Security fixes This release includes fixes for the following security issues: mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / an…
What's Changed fix(auth): escape backslashes in the WWW-Authenticate realm by @yusukebe in #5590 docs(contributing): drop the note about linking a fork branch by @yusukebe in #5593 fix(context): allow c.header() after the response body is consumed by @yusukebe in #5587 Full Changelog: v4.13.14...v4.13.15
What's Changed docs(contributing): ask for issues instead of RPs #5526 docs(readme): sync the contributing list with CONTRIBUTING.md #5527 fix(adapters): accept Hono v5 prereleases in the hono peer range #5537 chore: unified oxfmt and oxlint config #5518 docs(readme): remove the deepwiki badge #5548 fix(serve-static): only serve GET and HEAD requests #5514 fix(build): keep barrel imports in the bu…
No content.
No content.
What's Changed Accept Hono v5 prereleases in the hono peer range, so npm install with hono@next no longer fails with ERESOLVE by @yusukebe in #5537 Keep internal types private in the bundled d.ts by @yusukebe in #5485
What's Changed Accept Hono v5 prereleases in the hono peer range, so npm install with hono@next no longer fails with ERESOLVE by @yusukebe in #5537 Keep internal types private in the bundled d.ts by @yusukebe in #5485
What's Changed Accept Hono v5 prereleases in the hono peer range, so npm install with hono@next no longer fails with ERESOLVE by @yusukebe in #5537 Keep internal types private in the bundled d.ts by @yusukebe in #5485
What's Changed Accept Hono v5 prereleases in the hono peer range, so npm install with hono@next no longer fails with ERESOLVE by @yusukebe in #5537 Keep internal types private in the bundled d.ts by @yusukebe in #5485
What's Changed Accept Hono v5 prereleases in the hono peer range, so npm install with hono@next no longer fails with ERESOLVE by @yusukebe in #5537 Keep internal types private in the bundled d.ts by @yusukebe in #5485
What's Changed Accept Hono v5 prereleases in the hono peer range, so npm install with hono@next no longer fails with ERESOLVE by @yusukebe in #5537 Keep internal types private in the bundled d.ts by @yusukebe in #5485
What's Changed Accept Hono v5 prereleases in the hono peer range, so npm install with hono@next no longer fails with ERESOLVE by @yusukebe in #5537 Keep internal types private in the bundled d.ts by @yusukebe in #5485
What's Changed Accept Hono v5 prereleases in the hono peer range, so npm install with hono@next no longer fails with ERESOLVE by @yusukebe in #5537 Keep internal types private in the bundled d.ts by @yusukebe in #5485
Mount Middleware app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all(): import { Router as IttyRouter } from 'itty-router' import { Hono } from 'hono' import { mount } from 'hono/mount' const ittyRouter = IttyRouter() ittyRouter.get('/hello', () => new Response('Hello from itty-router')) const app = new Hono() app.all('/itty-route…
What's Changed fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in #5485 test(build): type-check the bundled declarations from a consumer project in #5486 fix(etag): correctly match mixed-case header name in retainedHeader option in #5475 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in #5487 fix(combine): return a Respo…
Security fixes serveStatic decodes the request path a second time, leading to bypass of middleware on static paths Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipp…
No content.
No content.
@hono/deno@1.0.1
Adapters are now separate packages The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR. hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change: - import { serveStatic } f…
What's Changed fix(jsx): replace Suspense and ErrorBoundary content across newlines in #5380 fix(accepts): match media types and language tags case-insensitively in #5376 fix(linear-router): don't match an empty path segment as a param in #5373 fix(pretty-json): don't break responses with unparseable JSON bodies in #5377 fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in…
What's Changed docs: fix typos in code comments and link third-party middleware section in #5343 perf(jsx/dom): reduce lookup work for large keyed updates in #5340 fix(aws-lambda): respect backpressure when streaming the response body in #5351 fix(accepts, language): skip accept entries with quality 0 when matching in #5311 fix(accept): treat the q parameter name as case-insensitive in #5349 fix(a…
Security fixes This release includes a fix for the following security issue: hono/jsx renders plain strings unescaped in boundary components, leading to XSS Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these componen…
What's Changed fix(client): keep a param value of "index" in $url() and $path() in #5297 fix(client): normalize root WebSocket URLs in #5291 fix(types): allow symbol keys in Context get and set fallbacks in #5300 chore: bump editorconfig-checker in #5336 refactor(on-handler): use forEach for consistent handler iteration in #5326 Full Changelog: v4.13.5...v4.13.6
Security fixes This release includes fixes for the following security issues: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start…
What's Changed fix(request): handle params on unmatched requests in #5268 fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in #5264 fix(reg-exp-router): associate wildcard middleware with matching routes in #5266 perf(router): share null object creation in #5267 fix(etag): match If-None-Match tags with optional whitespace before the comma in #5222 fix(client): skip und…
What's Changed fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #5227 fix(etag): copy pending stream bytes in #5239 fix(etag): avoid skipping headers when filtering 304 response headers in #5234 fix(cors): append Origin to Vary header on OPTIONS preflight in #5235 docs(context): add custom headers append option example to Context JSDoc in #5248 fix(trie-rou…
What's Changed fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #5197 fix(jsx): render async children of document metadata tags instead of [object Promise] in #5204 fix(etag): resolve incorrect incremental hashing for chunked responses in #5199 fix(client): serialize multiple cookies correctly in #5202 fix(etag): stabilize dige…
What's Changed fix(trie-router): count every slash a pattern consumes by @Jaybhade in #5189 fix(utils/stream): re-acquire writer lock when pipe() throws by @Sriharsha-dev369 in #4988 fix(etag): skip unsafe methods or error responses on non-* case by @na-trium-144 in #5196 New Contributors @Jaybhade made their first contribution in #5189 @Sriharsha-dev369 made their first contribution in #4988 Full…
Hono v4.13.0 is now available! The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more. Performance improvements This release incl…