Update dependency hono to v4.11.4 #11
No reviewers
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
MobiusReactor/TicTacToeV2!11
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/hono-4.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
4.8.4→4.11.4Release Notes
honojs/hono (hono)
v4.11.4Compare Source
Security
Fixed a JWT algorithm confusion issue in the JWT and JWK/JWKS middleware.
Both middlewares now require an explicit algorithm configuration to prevent the verification algorithm from being influenced by untrusted JWT header values.
If you are using the JWT or JWK/JWKS middleware, please update to the latest version as soon as possible.
JWT middleware
JWK/JWKS middleware
For more details, see the Security Advisory.
What's Changed
@hono/eslint-configand enable curly rule by @yusukebe in #4620algoption for JWT middleware by @yusukebe in #4624New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.11.3...v4.11.4
v4.11.3Compare Source
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.11.2...v4.11.3
v4.11.2Compare Source
What's Changed
HonoURLtypes by @yusukebe in #4592SimplifyinToSchemaby @yusukebe in #4597MergeMiddlewareResponsetype by @yusukebe in #4598New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.11.1...v4.11.2
v4.11.1Compare Source
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.11.0...v4.11.1
v4.11.0Compare Source
Release Notes
Hono v4.11.0 is now available!
This release includes new features for the Hono client, middleware improvements, and an important type system fix.
Type System Fix for Middleware
We've fixed a bug in the type system for middleware. Previously,
appdid not have the correct type with pathless handlers:This has now been fixed.
Thanks @kosei28!
Typed URL for Hono Client
You can now pass the base URL as the second type parameter to
hcto get more precise URL types:This is useful when you want to use the URL as a type-safe key for libraries like SWR.
Thanks @miyaji255!
Custom NotFoundResponse Type
You can now customize the
NotFoundResponsetype using module augmentation. This allowsc.notFound()to return a typed response:Now the client can correctly infer the 404 response type.
Thanks @miyaji255!
tryGetContext Helper
The new
tryGetContext()helper in the Context Storage middleware returnsundefinedinstead of throwing an error when the context is not available:Thanks @AyushCoder9!
Custom Query Serializer
You can now customize how query parameters are serialized using the
buildSearchParamsoption:Thanks @bolasblack!
New features
All changes
New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.10.8...v4.11.0
v4.10.8Compare Source
What's Changed
IsAllowedOriginHandlerby @baseballyama in #4558IsAllowedSecFetchSiteHandlerby @baseballyama in #4559New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.10.7...v4.10.8
v4.10.7Compare Source
What's Changed
NotSpecifiedandStrictVerifyOptionsby @ysknsid25 in #4525bun.lockby @yusukebe in #4548New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.10.6...v4.10.7
v4.10.6Compare Source
Deperecated
bearer-auth options
The following options are deprecated and will be removed in a future version:
noAuthenticationHeaderMessage=> usenoAuthenticationHeader.messageinvalidAuthenticationHeaderMessage=> useinvalidAuthenticationHeader.messageinvalidTokenMessage=> useinvalidToken.messageWhat's Changed
New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.10.5...v4.10.6
v4.10.5Compare Source
What's Changed
Vary: *is present by @pHo9UBenaA in #4504New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.10.4...v4.10.5
v4.10.4Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.10.3...v4.10.4
v4.10.3Compare Source
Securiy Fix
A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware.
What's Changed
=by @ryuapp in #4478New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.10.2...v4.10.3
v4.10.2Compare Source
Security hardening improvement
If you are using JWT middleware, please read the following and consider applying the configuration.
Improper Authorization in Hono (JWT Audience Validation)
Hono’s JWT authentication middleware did not validate the aud (Audience) claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential cross-service access (token mix-up).
The issue is addressed by adding a new
verification.audconfiguration option to allow RFC 7519–compliant audience validation. This change is classified as a security hardening improvement, but the lack of validation can still be considered a vulnerability in deployments that rely on default JWT verification.Recommended secure configuration
You can enable RFC 7519–compliant audience validation using the new
verification.audoption:What's Changed
New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.10.1...v4.10.2
v4.10.1Compare Source
What's Changed
.usenon-return mw fromcreateMiddlewareby @NamesMT in #4465Full Changelog: https://github.com/honojs/hono/compare/v4.10.0...v4.10.1
v4.10.0Compare Source
Release Notes
Hono v4.10.0 is now available!
This release brings improved TypeScript support and new utilities.
The main highlight is the enhanced middleware type definitions that solve a long-standing issue with type safety for RPC clients.
Middleware Type Improvements
Imagine the following app:
The client with RPC:
Previously, it couldn't infer the responses from middleware, so a type error was thrown.
Now the responses are correctly typed.
This was a long-standing issue and we were thinking it was super difficult to resolve it. But now come true.
Thank you for the great work @slawekkolodziej!
cloneRawRequest Utility
The new
cloneRawRequestutility allows you to clone the raw Request object after it has been consumed by validators or middleware.Thanks @kamaal111!
New features
All changes
New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.9.12...v4.10.0
v4.9.12Compare Source
What's Changed
PreparedRegExpRouterfor optimization and added tests by @usualoma in #4456tree shakingby @usualoma in #4458Full Changelog: https://github.com/honojs/hono/compare/v4.9.11...v4.9.12
v4.9.11Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.9.10...v4.9.11
v4.9.10Compare Source
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.9.9...v4.9.10
v4.9.9Compare Source
What's Changed
handleby @yusukebe in #4421New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.9.8...v4.9.9
v4.9.8Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.9.7...v4.9.8
v4.9.7Compare Source
Security
bodyLimitmiddleware where the body size limit could be bypassed when bothContent-LengthandTransfer-Encodingheaders were present. If you are using this middleware, please update immediately. Security AdvisoryWhat's Changed
parseResponsenot parsing json in react native by @lr0pb in #4399.tool-versionsfile by @3w36zj6 in #4397bun installcommands to use--frozen-lockfileby @3w36zj6 in #4398New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.9.6...v4.9.7
v4.9.6Compare Source
Security
Fixed a bug in URL path parsing (
getPath) that could cause path confusion under malformed requests.If you rely on reverse proxies (e.g. Nginx) for ACLs or restrict access to endpoints like
/admin, please update immediately.See advisory for details: GHSA-9hp6-4448-45g2
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.9.5...v4.9.6
v4.9.5Compare Source
What's Changed
originandallowMethodsby @jobrk in #4373app.fetchinhandleby @yusukebe in #4374New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.9.4...v4.9.5
v4.9.4Compare Source
What's Changed
deno publishby @yusukebe in #4364Full Changelog: https://github.com/honojs/hono/compare/v4.9.3...v4.9.4
v4.9.3Compare Source
What's Changed
customFetchoption to allow custom fetch function by @yusukebe in #4360typescriptto5.9.2by @yusukebe in #4362packageManagerfield topackage.jsonby @yusukebe in #4363Full Changelog: https://github.com/honojs/hono/compare/v4.9.2...v4.9.3
v4.9.2Compare Source
What's Changed
removeIndexStringby @yusukebe in #4352New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.9.1...v4.9.2
v4.9.1Compare Source
What's Changed
DetailedError.name(+ error tests) by @NamesMT in #4344Full Changelog: https://github.com/honojs/hono/compare/v4.9.0...v4.9.1
v4.9.0Compare Source
Release Notes
Hono v4.9.0 is now available!
This release introduces several enhancements and utilities.
The main highlight is the new
parseResponseutility that makes it easier to work with RPC client responses.parseResponse Utility
The new
parseResponseutility provides a convenient way to parse responses from Hono RPC clients (hc). It automatically handles different response formats and throws structured errors for failed requests.This makes working with RPC client responses much more straightforward and type-safe.
Thanks @NamesMT!
New features
All changes
iss) claim by @yolocat-dev in #4253headerNameto JWK middleware by @JoaquinGimenez1 in #4279jointo correct path resolution by @yusukebe in #4291verifyWithJwksfor external use by @Beyondo in #4302parseResponseutil to smartly parsehc's Response by @NamesMT in #4314skipLibCheckto resolve TypeScript compilation issues by @yusukebe in #4342New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.8.12...v4.9.0
v4.8.12Compare Source
What's Changed
/files/:name{.*}by @yusukebe in #4329Full Changelog: https://github.com/honojs/hono/compare/v4.8.11...v4.8.12
v4.8.11Compare Source
What's Changed
outputtype forc.body()by @NamesMT in #4318FetchEventas second argument toapp.fetchby @yusukebe in #4328@hono/eslint-configby @yusukebe in #4330Full Changelog: https://github.com/honojs/hono/compare/v4.8.10...v4.8.11
v4.8.10Compare Source
What's Changed
benchmarks/*by @yusukebe in #4317New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.8.9...v4.8.10
v4.8.9Compare Source
What's Changed
isByteStringinc.redirectby @yusukebe in #4307Full Changelog: https://github.com/honojs/hono/compare/v4.8.8...v4.8.9
v4.8.8Compare Source
What's Changed
safeEncodeURIby @yusukebe in #4306Full Changelog: https://github.com/honojs/hono/compare/v4.8.7...v4.8.8
v4.8.7Compare Source
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.8.6...v4.8.7
v4.8.6Compare Source
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.8.5...v4.8.6
v4.8.5Compare Source
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.8.4...v4.8.5
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
Update dependency hono to ^4.9.2to Update dependency hono to v4.9.231403b72e8toc62f1a2060c62f1a2060to8d348aba918d348aba91toce0d4662daUpdate dependency hono to v4.9.2to Update dependency hono to v4.9.4ce0d4662datofa1844cbaaUpdate dependency hono to v4.9.4to Update dependency hono to v4.9.5fa1844cbaatof1dc877057Update dependency hono to v4.9.5to Update dependency hono to v4.9.6Update dependency hono to v4.9.6to Update dependency hono to v4.9.7f1dc877057to24dd71385524dd713855tob89c5420f2Update dependency hono to v4.9.7to Update dependency hono to v4.9.8b89c5420f2tof507f4e148Update dependency hono to v4.9.8to Update dependency hono to v4.9.9f507f4e148toc6316bade5Update dependency hono to v4.9.9to Update dependency hono to v4.9.10c6316bade5tod34782158eUpdate dependency hono to v4.9.10to Update dependency hono to v4.9.11d34782158etoa8be25ee65Update dependency hono to v4.9.11to Update dependency hono to v4.9.12a8be25ee65toae6be13b72Update dependency hono to v4.9.12to Update dependency hono to v4.10.0ae6be13b72tob109762d7aUpdate dependency hono to v4.10.0to Update dependency hono to v4.10.1b109762d7ato9e53a984fcUpdate dependency hono to v4.10.1to Update dependency hono to v4.10.29e53a984fctoc0012a6f22Update dependency hono to v4.10.2to Update dependency hono to v4.10.3c0012a6f22to49ae46c57fUpdate dependency hono to v4.10.3to Update dependency hono to v4.10.449ae46c57fto3b3f1d2c4eUpdate dependency hono to v4.10.4to Update dependency hono to v4.10.5Update dependency hono to v4.10.5to Update dependency hono to v4.10.63b3f1d2c4eto90d938a7a4Update dependency hono to v4.10.6to Update dependency hono to v4.10.790d938a7a4to21cfc9473f21cfc9473fto77648c8393Update dependency hono to v4.10.7to Update dependency hono to v4.10.877648c8393tof47e07ad1dUpdate dependency hono to v4.10.8to Update dependency hono to v4.11.0f47e07ad1dto341b4767fcUpdate dependency hono to v4.11.0to Update dependency hono to v4.11.1341b4767fcto55254cd467Update dependency hono to v4.11.1to Update dependency hono to v4.11.2Update dependency hono to v4.11.2to Update dependency hono to v4.11.355254cd467to7f07a05e697f07a05e69to4d4ad83935Update dependency hono to v4.11.3to Update dependency hono to v4.11.4View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.