chore(deps): update dependency hono to v4.13.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.12.14 → 4.13.1

---

Release Notes

honojs/hono (hono)

v4.13.1

Compare Source

v4.13.0

Compare Source

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
ping — GET /	165.83 ns	163.99 ns	1.01x
query — GET /id/1?name=bun	674.40 ns	616.99 ns	1.09x
json — GET /user	528.99 ns	422.44 ns	1.25x
body — POST /json	1.16 µs	1.00 µs	1.15x

The individual changes:

• perf(context): iterate the header record with for..in #​5118
• perf(url): replace regex tests with indexOf #​5121
• perf(context): skip Headers creation when there are no headers to merge #​5122
• perf(urls): refactor tryDecodeURIComponent #​5158
• perf(request): allocate #validatedData lazily #​5175
• perf(request): probe the body cache without allocating #​5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @​usualoma and @​Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'

const app = new Hono()

app.use(methodNotAllowed({ app }))

app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))

// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
  methodNotAllowed({
    app,
    onMethodNotAllowed: (c, methods) =>
      c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
  })
)

Thanks @​usualoma!

RegExpRouter throws UnsupportedPathError at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @​usualoma!

Other improvements

• hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @​akahoshi1421!
• The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @​arhxam!
• JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @​ashunar0!
• JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @​natsuki-engr!
• The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @​arhxam!

All changes

• perf(hono-base): avoid rest parameter in fetch by @​yusukebe in #​5113
• perf(context): iterate the header record with for..in by @​yusukebe in #​5118
• perf(url/request): replace regex tests with indexOf by @​yusukebe in #​5121
• perf(context): skip Headers creation when there are no headers to merge by @​yusukebe in #​5122
• perf(urls): refactor tryDecodeURIComponent by @​yusukebe in #​5158
• chore(benchmarks): correct src path on Windows, add json and middleware cases by @​kibertoad in #​5173
• perf(context): drop the throwaway env field initializer by @​kibertoad in #​5174
• perf(request): allocate #validatedData lazily by @​kibertoad in #​5175
• perf(request): probe the body cache without allocating by @​kibertoad in #​5176
• chore(benchmarks): stabilize measurements by forcing mitata batching by @​yusukebe in #​5183
• perf(hono-base): restore the rest parameter in fetch by @​yusukebe in #​5184
• perf(context): restore the env field initializer by @​yusukebe in #​5186
• feat: add first-class QUERY method support by @​shellhaki in #​5070
• feat(etag): support conditional requests for the QUERY method by @​Cherry in #​5111
• feat(cors): allow QUERY by default as a first-class method by @​usualoma in #​5115
• feat(cache): add first-class support for QUERY requests by @​usualoma in #​5119
• feat(jsx): add React-compatible overloads to useRef by @​ashunar0 in #​5063
• feat(middleware): add method-not-allowed middleware by @​usualoma in #​5132
• feat(jwt,jwk): add a configurable WWW-Authenticate realm by @​arhxam in #​5141
• feat(utils/headers): sync HTTP field types with the IANA registry by @​akahoshi1421 in #​5153
• fix(jsx): allow a function component to return an array by @​natsuki-engr in #​5179
• feat(reg-exp-router): throw UnsupportedPathError during route registration by @​usualoma in #​5171
• fix(compress): set Vary: Accept-Encoding on negotiated responses by @​arhxam in #​5137

Full Changelog: honojs/hono@v4.12.34...v4.13.0

Thank you to all contributors!

v4.12.34

Compare Source

v4.12.33

Compare Source

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in #​5164
• chore: bump @hono/node-server in #​5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in #​5166
• chore: remove undici in favor of global fetch in #​5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

Compare Source

What's Changed

• ci: enable reports for type & bundle size check in #​5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #​5142
• fix(sse): emit empty id field to reset Last-Event-ID in #​5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #​5145
• fix: use Object.create(null) when parsing query, headers, and params in #​5161
• fix(secure-headers): keep CSP callbacks scoped to their header in #​5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

Compare Source

v4.12.30

Compare Source

What's Changed

• chore(benchmark/routers): bump deps in #​5107
• chore(benchmark): remove not used benchmarks in #​5108
• chore: update to ts6 in prep for ts7 in #​5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in #​5025
• fix(compress): do not compress 206 Partial Content responses in #​5020
• fix(client): replaceUrlParam should not match a param that prefixes another in #​5096
• fix(method-override): set duplex when forwarding a stream body in query mode in #​5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

Compare Source

What's Changed

• fix(client): merge function headers with per-request headers by @​yusukebe in #​5092
• chore: fix no-op tsc in test script by @​yusukebe in #​5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @​yusukebe in #​5094
• docs(language): add JSDoc @​example to languageDetector by @​codebybilal18 in #​5081
• test(workerd): add compatibilityDate by @​yusukebe in #​5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @​yusukebe in #​5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @​yusukebe in #​5101
• fix(types): strip extra properties from array types in JSONParsed by @​Arman-Luthra in #​5103
• fix(trie-router): match empty wildcard remainder after regexp param by @​usualoma in #​5102
• fix(etag): treat If-None-Match: * as a match by @​yusukebe in #​5084

New Contributors

• @​codebybilal18 made their first contribution in #​5081
• @​Arman-Luthra made their first contribution in #​5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

Compare Source

What's Changed

• fix(serve-static): treat empty string content as found by @​yusukebe in #​5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @​EduardF1 in #​5047
• chore: don't publish *.tsbuildinfo by @​yusukebe in #​5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @​yusukebe in #​5067
• fix: avoid circular dependency between body.ts and request.ts by @​usualoma in #​5071
• fix(bun): report the requested subprotocol on WSContext.protocol by @​greymoth-jp in #​5059
• chore: bump devDependencies by @​yusukebe in #​5085
• fix(aws-lambda): detect V2 events by request context, not rawPath alone by @​VihaanAgarwal in #​5033
• docs(context-storage): fix JSDoc by @​yusukebe in #​5086

New Contributors

• @​EduardF1 made their first contribution in #​5047
• @​greymoth-jp made their first contribution in #​5059
• @​VihaanAgarwal made their first contribution in #​5033

Full Changelog: honojs/hono@v4.12.27...v4.12.28

v4.12.27

Compare Source

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

---

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

v4.12.26

Compare Source

What's Changed

• fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @​yusukebe in #​5013
• ci: publish to npm from CI with OIDC trusted publishing by @​yusukebe in #​5028
• chore: remove unused devcontainer and gitpod configs by @​yusukebe in #​5029
• chore: replace arg and glob with Bun native APIs in build script by @​yusukebe in #​5030

Full Changelog: honojs/hono@v4.12.25...v4.12.26

v4.12.25

Compare Source

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@​Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

Compare Source

What's Changed

• docs(contribution): simplifyAI Usage Policy by @​yusukebe in #​4972
• chore: remove @​types/glob by @​rtritto in #​4978
• fix(bearer-auth): mention verifyToken in missing-options error message by @​tan7vir in #​4987
• refactor(language): Test/improve tests on languages middleware by @​iNeoO in #​4980
• fix(utils/ipaddr): expand "::" to eight zero groups by @​youcefzemmar in #​4973
• fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by @​Mohammad-Faiz-Cloud-Engineer in #​4982
• refactor(timing): Test/add test for middleware timing by @​iNeoO in #​4991
• fix(utils/ipaddr): render the unspecified address binary as "::" by @​sarathfrancis90 in #​4998

Full Changelog: honojs/hono@v4.12.23...v4.12.24

v4.12.23

Compare Source

What's Changed

• fix(serve-static): normalize all backslashes in file paths, not just the first in #​4962
• feat(context): export the Context class publicly by @​BlankParticle in #​4543
• docs(contribution): add AI Usage Policy by @​yusukebe in #​4970
• feat(compress): add contentTypeFilter option and COMPRESSIBLE_CONTENT_TYPE_REGEX re-export by @​na-trium-144 in #​4961
• fix(utils/ipaddr): do not compress a single 0 group to :: by @​yusukebe in #​4971

Full Changelog: honojs/hono@v4.12.22...v4.12.23

v4.12.22

Compare Source

What's Changed

• chore: update vitest to v4 and cleanups by @​BlankParticle in #​4952
• fix(mime): specify charset parameter per MIME type instead of mechanical detection by @​renatograsso10 in #​4912
• fix(compress): respect Accept-Encoding when encoding option is set by @​LeSingh1 in #​4951
• fix(deno): echo negotiated WebSocket subprotocol in upgrade response by @​ATOM00blue in #​4955
• feat: add msgpack as a compressible content type by @​na-trium-144 in #​4957

New Contributors

• @​renatograsso10 made their first contribution in #​4912
• @​LeSingh1 made their first contribution in #​4951
• @​ATOM00blue made their first contribution in #​4955
• @​na-trium-144 made their first contribution in #​4957

Full Changelog: honojs/hono@v4.12.21...v4.12.22

v4.12.21

Compare Source

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

---

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

Compare Source

What's Changed

• fix(route): preserve the base path of the mounted route() app by @​usualoma in #​4942
• fix(jsx): widen jsx and jsxFn children to Child[] by @​ashunar0 in #​4947

New Contributors

• @​ashunar0 made their first contribution in #​4947

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

Compare Source

What's Changed

• ci: pin GitHub Actions to SHAs by @​yusukebe in #​4932
• fix(serveStatic): make options parameter optional in all adapters by @​mixelburg in #​4934
• fix(cookie): return the first cookie when there are multiple cookies with the same name by @​usualoma in #​4922
• feat(bearer-auth): make bearerAuth generic for typed context in verifyToken by @​justinnais in #​4913
• feat(cache): key cache entries by configured vary headers by @​usualoma in #​4915
• feat(request): add bytes() by @​yusukebe in #​4921
• fix(stream): upgrade @hono/node-server to v2 and fix abort handling by @​yusukebe in #​4940

New Contributors

• @​justinnais made their first contribution in #​4913

Full Changelog: honojs/hono@v4.12.18...v4.12.19

v4.12.18

Compare Source

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

---

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

Compare Source

What's Changed

• fix(jsx): normalize SVG attributes on the root element by @​kfly8 in #​4893
• fix(ssg): add atom+xml and rss+xml to defaultExtensionMap by @​yuintei in #​4899
• fix(cors): make origin optional in CORSOptions by @​truffle-dev in #​4905
• fix(types): propagate middleware response types to app.on overloads by @​T4ko0522 in #​4906

New Contributors

• @​kfly8 made their first contribution in #​4893
• @​truffle-dev made their first contribution in #​4905

Full Changelog: honojs/hono@v4.12.16...v4.12.17

v4.12.16

Compare Source

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

v4.12.15

Compare Source

What's Changed

• fix(jwt): support single-line PEM keys by @​hiendv in #​4889

New Contributors

• @​hiendv made their first contribution in #​4889

Full Changelog: honojs/hono@v4.12.14...v4.12.15

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.