What's Changed docs: fix typos in code comments and link third-party middleware section in #5343 perf(jsx/dom): reduce lookup work for large keyed updates in #5340 fix(aws-lambda): respect backpressure when streaming the response body in #5351 fix(accepts, language): skip accept entries with quality 0 when matching in #5311 fix(accept): treat the q parameter name as case-insensitive in #5349 fix(a…
Security fixes This release includes a fix for the following security issue: hono/jsx renders plain strings unescaped in boundary components, leading to XSS Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these componen…
What's Changed fix(client): keep a param value of "index" in $url() and $path() in #5297 fix(client): normalize root WebSocket URLs in #5291 fix(types): allow symbol keys in Context get and set fallbacks in #5300 chore: bump editorconfig-checker in #5336 refactor(on-handler): use forEach for consistent handler iteration in #5326 Full Changelog: v4.13.5...v4.13.6
Security fixes This release includes fixes for the following security issues: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start…
What's Changed fix(request): handle params on unmatched requests in #5268 fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in #5264 fix(reg-exp-router): associate wildcard middleware with matching routes in #5266 perf(router): share null object creation in #5267 fix(etag): match If-None-Match tags with optional whitespace before the comma in #5222 fix(client): skip und…
What's Changed fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #5227 fix(etag): copy pending stream bytes in #5239 fix(etag): avoid skipping headers when filtering 304 response headers in #5234 fix(cors): append Origin to Vary header on OPTIONS preflight in #5235 docs(context): add custom headers append option example to Context JSDoc in #5248 fix(trie-rou…
What's Changed fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #5197 fix(jsx): render async children of document metadata tags instead of [object Promise] in #5204 fix(etag): resolve incorrect incremental hashing for chunked responses in #5199 fix(client): serialize multiple cookies correctly in #5202 fix(etag): stabilize dige…
What's Changed fix(trie-router): count every slash a pattern consumes by @Jaybhade in #5189 fix(utils/stream): re-acquire writer lock when pipe() throws by @Sriharsha-dev369 in #4988 fix(etag): skip unsafe methods or error responses on non-* case by @na-trium-144 in #5196 New Contributors @Jaybhade made their first contribution in #5189 @Sriharsha-dev369 made their first contribution in #4988 Full…
Hono v4.13.0 is now available! The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more. Performance improvements This release incl…
Security fixes This release includes fixes for the following security issues: memo() retains SSR output across requests, leading to cross-user data disclosure Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or g…
What's Changed fix(cookie): relax name validation when parsing Cookie header in #5164 chore: bump @hono/node-server in #5167 fix(jsx): handle useSyncExternalStore subscription and snapshot changes in #5166 chore: remove undici in favor of global fetch in #5168 Full Changelog: v4.12.32...v4.12.33
What's Changed ci: enable reports for type & bundle size check in #5148 fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #5142 fix(sse): emit empty id field to reset Last-Event-ID in #5138 test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #5145 fix: use Object.create(null) when parsing query, headers, a…
What's Changed test(context): assert case-insensitive header names in response helpers by @yusukebe in #5116 chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in #5117 refactor(aws-lambada): remove FIXME in @ts-expect-error by @yusukebe in #5130 fix(utils/body): reuse cached formData in parseBody() by @yusukebe in #5131 fix(request): fix multipart boundary mismatch in cloneRawReque…
What's Changed chore(benchmark/routers): bump deps in #5107 chore(benchmark): remove not used benchmarks in #5108 chore: update to ts6 in prep for ts7 in #5104 fix(cache): deduplicate Cache-Control directives case-insensitively in #5025 fix(compress): do not compress 206 Partial Content responses in #5020 fix(client): replaceUrlParam should not match a param that prefixes another in #5096 fix(meth…
What's Changed fix(client): merge function headers with per-request headers by @yusukebe in #5092 chore: fix no-op tsc in test script by @yusukebe in #5093 fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in #5094 docs(language): add JSDoc @example to languageDetector by @codebybilal18 in #5081 test(workerd): add compatibilityDate by @yusukebe in #5100 fix(l…
What's Changed fix(serve-static): treat empty string content as found by @yusukebe in #5062 docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in #5047 chore: don't publish *.tsbuildinfo by @yusukebe in #5066 fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @yusukebe in #5067 fix: avoid circular dependency between body.ts…
Security fixes This release includes fixes for the following security issues: hono/jsx does not isolate context per request Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure o…
What's Changed fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @yusukebe in #5013 ci: publish to npm from CI with OIDC trusted publishing by @yusukebe in #5028 chore: remove unused devcontainer and gitpod configs by @yusukebe in #5029 chore: replace arg and glob with Bun native APIs in build script by @yusukebe in #5030 Full Changelog: v4.12.25...v4.12.26
Security fixes This release includes fixes for the following security issues: CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could m…
What's Changed docs(contribution): simplifyAI Usage Policy by @yusukebe in #4972 chore: remove @types/glob by @rtritto in #4978 fix(bearer-auth): mention verifyToken in missing-options error message by @tan7vir in #4987 refactor(language): Test/improve tests on languages middleware by @iNeoO in #4980 fix(utils/ipaddr): expand "::" to eight zero groups by @youcefzemmar in #4973 fix: clean up config…
What's Changed fix(serve-static): normalize all backslashes in file paths, not just the first in #4962 feat(context): export the Context class publicly by @BlankParticle in #4543 docs(contribution): add AI Usage Policy by @yusukebe in #4970 feat(compress): add contentTypeFilter option and COMPRESSIBLE_CONTENT_TYPE_REGEX re-export by @na-trium-144 in #4961 fix(utils/ipaddr): do not compress a singl…
What's Changed chore: update vitest to v4 and cleanups by @BlankParticle in #4952 fix(mime): specify charset parameter per MIME type instead of mechanical detection by @renatograsso10 in #4912 fix(compress): respect Accept-Encoding when encoding option is set by @LeSingh1 in #4951 fix(deno): echo negotiated WebSocket subprotocol in upgrade response by @ATOM00blue in #4955 feat: add msgpack as a co…
Security fixes This release includes fixes for the following security issues: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong posi…
What's Changed fix(route): preserve the base path of the mounted route() app by @usualoma in #4942 fix(jsx): widen jsx and jsxFn children to Child[] by @ashunar0 in #4947 New Contributors @ashunar0 made their first contribution in #4947 Full Changelog: v4.12.19...v4.12.20
What's Changed ci: pin GitHub Actions to SHAs by @yusukebe in #4932 fix(serveStatic): make options parameter optional in all adapters by @mixelburg in #4934 fix(cookie): return the first cookie when there are multiple cookies with the same name by @usualoma in #4922 feat(bearer-auth): make bearerAuth generic for typed context in verifyToken by @justinnais in #4913 feat(cache): key cache entries by…
Security fixes This release includes fixes for the following security issues: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm CSS Declaration Inje…