[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.12.33 → 4.13.18

---

Release Notes

honojs/hono (hono)

v4.13.18

Compare Source

Security fixes

This release includes fixes for the following security issues:

validator() skips validation for requests whose Content-Type parameters are formatted differently

Affects: validator('json') and validator('form') in hono/validator. A Content-Type with whitespace before ;, a trailing ;, or an unusual parameter name was not recognized, so the validator saw an empty object while the handler could read all fields. This completes the fix for GHSA-4h7h-rv7c-7m2v. The validator now decides by the media type alone, as c.req.parseBody() does. GHSA-92p4-j3wq-jmqx

bodyLimit() keeps every transfer chunk of a request body in memory

Affects: bodyLimit() in hono/body-limit. A body sent in very small transfer chunks was retained as one object per chunk, so a request within the configured limit could exhaust memory. The body is now buffered in one array bounded by maxSize. GHSA-39q9-qp46-w8xg

mount() and app.mount() forward a wrong path when a custom getPath adds a prefix

Affects: mount() in hono/mount and app.mount() on 4.13.16 and 4.13.17. With a getPath that prepends a prefix such as the host name, one segment too many was removed from the forwarded path, so middleware scoped inside the mount prefix could be skipped. The prefix is removed from the routed path again. Paths that would change meaning when forwarded now get 400, and an optional regular expression parameter in a mount path throws. GHSA-h25j-2p75-qj33

serveStatic() serves a path that was decoded twice when allowPercentInPath is enabled

Affects: serveStatic() in hono/serve-static and the runtime adapters, only with allowPercentInPath: true. A malformed percent escape in the request path was decoded a second time, so a path that middleware registered on the encoded form did not see could still reach a static file. The file path must now be the same as the routed path, and otherwise the response is 404. GHSA-74fm-fwc7-3fwp

---

Users who rely on validator(), bodyLimit(), mount() with a custom getPath, or serveStatic() with allowPercentInPath are strongly encouraged to upgrade to this version.

Full Changelog: honojs/hono@v4.13.17...v4.13.18

v4.13.17

Compare Source

What's Changed

• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in #​5608
• fix(utils/url): do not match a query key across separators in #​5607
• fix(etag,pretty-json): cancel the discarded response body in #​5606
• fix(client): detect the JSON media type with whitespace before a parameter in #​5609
• fix(timing): honor a precision of 0 in setMetric in #​5363
• fix(utils/mime,ssg): match media types case-insensitively in #​5449
• fix(timing): escape double quotes and backslashes in Server-Timing descriptions in #​5478
• fix(etag): preserve commas within quoted entity tags in #​5353
• fix(accepts): preserve exact media type quality over subtype wildcards in #​5427
• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in #​5611
• fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in #​5430
• fix(ssg): do not reuse created directories across toSSG runs in #​5381
• fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in #​5483
• fix(jsx): escape element and object attribute values in #​5512
• fix(jsx): do not render ref objects as attributes in #​5615
• fix(factory): keep independent return types for nine handlers in #​5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

v4.13.16

Compare Source

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

• fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in #​5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

Compare Source

What's Changed

• fix(auth): escape backslashes in the WWW-Authenticate realm by @​yusukebe in #​5590
• docs(contributing): drop the note about linking a fork branch by @​yusukebe in #​5593
• fix(context): allow c.header() after the response body is consumed by @​yusukebe in #​5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

Compare Source

What's Changed

• docs(contributing): ask for issues instead of RPs #​5526
• docs(readme): sync the contributing list with CONTRIBUTING.md #​5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range #​5537
• chore: unified oxfmt and oxlint config #​5518
• docs(readme): remove the deepwiki badge #​5548
• fix(serve-static): only serve GET and HEAD requests #​5514
• fix(build): keep barrel imports in the bundled d.ts #​5557
• fix(jsx): preserve self-closing void elements in cloneElement #​5314
• fix(css): keep "//" inside an unquoted url() when minifying #​5450
• fix(css): keep the descendant combinator before a pseudo-class when minifying #​5451
• fix(serve-static): respect q-values in Accept-Encoding for precompressed files #​5436
• fix(helper/route): match regex params in basePath() the same way as the router #​5498
• fix(trie-router): keep first value for duplicate path params #​5423
• fix(hono-base): disallow getPath when strict is false #​5563
• fix(css): Fix multiline CSS handling in style replacement #​5405
• feat(bearer-auth): allow MessageFunction to return a Response #​5269
• fix(utils/url): preserve encoded duplicate query order #​5495

Full Changelog: honojs/hono@v4.13.13...v4.13.14

v4.13.13

Compare Source

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in #​5439
• docs(request): fix jsdoc comments for some getters in #​5445
• fix(jsx): allow JSXNode function component results in #​5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in #​5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

Compare Source

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in #​5485
• test(build): type-check the bundled declarations from a consumer project in #​5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in #​5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in #​5487
• fix(combine): return a Response from a short-circuiting middleware in some() in #​5391
• chore(deps): upgrade vite-plus to 1.0.0 in #​5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Compare Source

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in #​5433
• chore(package.json): invoke package scripts through pnpm instead of bun in #​5434
• chore: replace prettier with oxfmt in #​5435
• chore(deps): upgrade vitest to 5.0.1 in #​5437
• chore: let oxfmt sort imports instead of eslint in #​5442
• chore: replace eslint with oxlint in #​5443
• chore: introduce Vite+ in #​5444
• fix(types): allow returning a Blob as a response body in #​5446
• chore: convert build scripts into plugins in #​5448
• chore: stop editorconfig-checker from checking Markdown indent size in #​5455
• ci: remove empty step left in cr.yml by the pnpm migration in #​5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #​5459
• feat(adapters): add @​hono/bun as a workspace package in #​5447
• chore(adapters/bun): ship ESM only in #​5462
• feat(adapters): add the seven adapters as workspace packages in #​5463
• feat(adapters/deno): publish to JSR in #​5465
• test: move adapter runtime tests into adapters/* in #​5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

Compare Source

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in #​5380
• fix(accepts): match media types and language tags case-insensitively in #​5376
• fix(linear-router): don't match an empty path segment as a param in #​5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in #​5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #​5379
• fix(aws-lambda): treat binary +xml archive media types as binary in #​5424
• fix(aws-lambda): preserve empty query parameters in #​5292
• fix(lambda-edge): sync content type detection with aws-lambda in #​5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in #​5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

Compare Source

What's Changed

• docs: fix typos in code comments and link third-party middleware section in #​5343
• perf(jsx/dom): reduce lookup work for large keyed updates in #​5340
• fix(aws-lambda): respect backpressure when streaming the response body in #​5351
• fix(accepts, language): skip accept entries with quality 0 when matching in #​5311
• fix(accept): treat the q parameter name as case-insensitive in #​5349
• fix(accept): clamp a negative q to 0, not 1 in #​5357
• fix(request): keep the request media type when reusing a cached body in #​5366
• docs(combine): fix except() JSDoc param and add missing @​returns in #​5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in #​5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Compare Source

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

Compare Source

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in #​5297
• fix(client): normalize root WebSocket URLs in #​5291
• fix(types): allow symbol keys in Context get and set fallbacks in #​5300
• chore: bump editorconfig-checker in #​5336
• refactor(on-handler): use forEach for consistent handler iteration in #​5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Compare Source

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

Compare Source

What's Changed

• fix(request): handle params on unmatched requests in #​5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in #​5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in #​5266
• perf(router): share null object creation in #​5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in #​5222
• fix(client): skip undefined header and cookie values in #​5244
• fix(client): skip an undefined entry inside a query array in #​5272
• fix(client): skip an undefined entry inside a form array in #​5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin #​5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in #​5255
• fix(client): omit empty query delimiter in #​5283
• fix(request): drop stale content length for cloned FormData in #​5282
• fix(request): serialize cached JSON body in cloneRawRequest in #​5288
• fix(cookie): allow parsing signed cookies with empty string values in #​5246
• fix(utils/stream): do not let abort listeners crash abort() in #​5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

Compare Source

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #​5227
• fix(etag): copy pending stream bytes in #​5239
• fix(etag): avoid skipping headers when filtering 304 response headers in #​5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in #​5235
• docs(context): add custom headers append option example to Context JSDoc in #​5248
• fix(trie-router): match suffix wildcard routes in #​5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in #​5252
• fix(csrf): exempt OPTIONS request from CSRF validation in #​5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in #​5247
• feat(pretty-json): support structured JSON content-types (+json) in #​5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

Compare Source

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #​5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in #​5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in #​5199
• fix(client): serialize multiple cookies correctly in #​5202
• fix(etag): stabilize digest across stream chunks in #​5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in #​5209
• perf(cors): pre-join static array header options during initialization in #​5210
• fix(client): send falsy JSON bodies in #​5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in #​5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

Compare Source

What's Changed

• fix(trie-router): count every slash a pattern consumes by @​Jaybhade in #​5189
• fix(utils/stream): re-acquire writer lock when pipe() throws by @​Sriharsha-dev369 in #​4988
• fix(etag): skip unsafe methods or error responses on non-* case by @​na-trium-144 in #​5196

New Contributors

• @​Jaybhade made their first contribution in #​5189
• @​Sriharsha-dev369 made their first contribution in #​4988

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Compare Source

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
ping — GET /	165.83 ns	163.99 ns	1.01x
query — GET /id/1?name=bun	674.40 ns	616.99 ns	1.09x
json — GET /user	528.99 ns	422.44 ns	1.25x
body — POST /json	1.16 µs	1.00 µs	1.15x

The individual changes:

• perf(context): iterate the header record with for..in #​5118
• perf(url): replace regex tests with indexOf #​5121
• perf(context): skip Headers creation when there are no headers to merge #​5122
• perf(urls): refactor tryDecodeURIComponent #​5158
• perf(request): allocate #validatedData lazily #​5175
• perf(request): probe the body cache without allocating #​5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @​usualoma and @​Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'

const app = new Hono()

app.use(methodNotAllowed({ app }))

app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))

// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
  methodNotAllowed({
    app,
    onMethodNotAllowed: (c, methods) =>
      c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
  })
)

Thanks @​usualoma!

RegExpRouter throws UnsupportedPathError at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @​usualoma!

Other improvements

• hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @​akahoshi1421!
• The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @​arhxam!
• JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @​ashunar0!
• JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @​natsuki-engr!
• The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @​arhxam!

All changes

• perf(hono-base): avoid rest parameter in fetch by @​yusukebe in #​5113
• perf(context): iterate the header record with for..in by @​yusukebe in #​5118
• perf(url/request): replace regex tests with indexOf by @​yusukebe in #​5121
• perf(context): skip Headers creation when there are no headers to merge by @​yusukebe in #​5122
• perf(urls): refactor tryDecodeURIComponent by @​yusukebe in #​5158
• chore(benchmarks): correct src path on Windows, add json and middleware cases by @​kibertoad in #​5173
• perf(context): drop the throwaway env field initializer by @​kibertoad in #​5174
• perf(request): allocate #validatedData lazily by @​kibertoad in #​5175
• perf(request): probe the body cache without allocating by @​kibertoad in #​5176
• chore(benchmarks): stabilize measurements by forcing mitata batching by @​yusukebe in #​5183
• perf(hono-base): restore the rest parameter in fetch by @​yusukebe in #​5184
• perf(context): restore the env field initializer by @​yusukebe in #​5186
• feat: add first-class QUERY method support by @​shellhaki in #​5070
• feat(etag): support conditional requests for the QUERY method by @​Cherry in #​5111
• feat(cors): allow QUERY by default as a first-class method by @​usualoma in #​5115
• feat(cache): add first-class support for QUERY requests by @​usualoma in #​5119
• feat(jsx): add React-compatible overloads to useRef by @​ashunar0 in #​5063
• feat(middleware): add method-not-allowed middleware by @​usualoma in #​5132
• feat(jwt,jwk): add a configurable WWW-Authenticate realm by @​arhxam in #​5141
• feat(utils/headers): sync HTTP field types with the IANA registry by @​akahoshi1421 in #​5153
• fix(jsx): allow a function component to return an array by @​natsuki-engr in #​5179
• feat(reg-exp-router): throw UnsupportedPathError during route registration by @​usualoma in #​5171
• fix(compress): set Vary: Accept-Encoding on negotiated responses by @​arhxam in #​5137

Full Changelog: honojs/hono@v4.12.34...v4.13.0

Thank you to all contributors!

v4.12.34

Compare Source

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

---

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	hono@​4.12.33 ⏵ 4.13.18		+26

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud