Update dependency hono to v4.11.4 #11

Open
renovate-bot wants to merge 1 commit from renovate/hono-4.x into main
Collaborator

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
hono (source) 4.8.44.11.4 age adoption passing confidence

Release Notes

honojs/hono (hono)

v4.11.4

Compare Source

Security

Fixed a JWT algorithm confusion issue in the JWT and JWK/JWKS middleware.

Both middlewares now require an explicit algorithm configuration to prevent the verification algorithm from being influenced by untrusted JWT header values.

If you are using the JWT or JWK/JWKS middleware, please update to the latest version as soon as possible.

JWT middleware
import { jwt } from 'hono/jwt'

app.use(
  '/auth/*',
  jwt({
    secret: 'it-is-very-secret',
    alg: 'HS256', // required
  })
)
JWK/JWKS middleware
import { jwk } from 'hono/jwk'

app.use(
  '/auth/*',
  jwk({
    jwks_uri: 'https://example.com/.well-known/jwks.json',
    alg: ['RS256'], // required (asymmetric algorithms only)
  })
)

For more details, see the Security Advisory.

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.11.3...v4.11.4

v4.11.3

Compare Source

What's Changed

  • fix(types): fix middleware union type merging in MergeMiddlewareResponse by @​yusukebe in #​4602

Full Changelog: https://github.com/honojs/hono/compare/v4.11.2...v4.11.3

v4.11.2

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.11.1...v4.11.2

v4.11.1

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.11.0...v4.11.1

v4.11.0

Compare Source

Release Notes

Hono v4.11.0 is now available!

This release includes new features for the Hono client, middleware improvements, and an important type system fix.

Type System Fix for Middleware

We've fixed a bug in the type system for middleware. Previously, app did not have the correct type with pathless handlers:

const app = new Hono()
  .use(async (c, next) => {
    await next()
  })
  .get('/a', async (c, next) => {
    await next()
  })
  .get((c) => {
    return c.text('Hello')
  })

// app's type was incorrect

This has now been fixed.

Thanks @​kosei28!

Typed URL for Hono Client

You can now pass the base URL as the second type parameter to hc to get more precise URL types:

const client = hc<typeof app, 'http://localhost:8787'>(
  'http://localhost:8787/'
)

const url = client.api.posts.$url()
// url is TypedURL with precise type information
// including protocol, host, and path

This is useful when you want to use the URL as a type-safe key for libraries like SWR.

Thanks @​miyaji255!

Custom NotFoundResponse Type

You can now customize the NotFoundResponse type using module augmentation. This allows c.notFound() to return a typed response:

import { Hono, TypedResponse } from 'hono'

declare module 'hono' {
  interface NotFoundResponse
    extends Response,
      TypedResponse<{ error: string }, 404, 'json'> {}
}

const app = new Hono()
  .get('/posts/:id', async (c) => {
    const post = await getPost(c.req.param('id'))
    if (!post) {
      return c.notFound()
    }
    return c.json({ post }, 200)
  })
  .notFound((c) => c.json({ error: 'not found' }, 404))

Now the client can correctly infer the 404 response type.

Thanks @​miyaji255!

tryGetContext Helper

The new tryGetContext() helper in the Context Storage middleware returns undefined instead of throwing an error when the context is not available:

import { tryGetContext } from 'hono/context-storage'

const context = tryGetContext<Env>()
if (context) {
  // Context is available
  console.log(context.var.message)
}

Thanks @​AyushCoder9!

Custom Query Serializer

You can now customize how query parameters are serialized using the buildSearchParams option:

const client = hc<AppType>('http://localhost', {
  buildSearchParams: (query) => {
    const searchParams = new URLSearchParams()
    for (const [k, v] of Object.entries(query)) {
      if (v === undefined) continue
      if (Array.isArray(v)) {
        v.forEach((item) => searchParams.append(`${k}[]`, item))
      } else {
        searchParams.set(k, v)
      }
    }
    return searchParams
  },
})

Thanks @​bolasblack!

New features

  • feat(types): make Hono client's $url return the exact URL type #​4502
  • feat(types): enhance NotFoundHandler to support custom NotFoundResponse type #​4518
  • feat(timing): add wrapTime to simplify usage #​4519
  • feat(pretty-json): support force option #​4531
  • feat(client): add buildSearchParams option to customize query serialization #​4535
  • feat(context-storage): add optional tryGetContext helper #​4539
  • feat(secure-headers): add CSP report-to and report-uri directive support #​4555
  • fix(types): replace schema-based path tracking with CurrentPath parameter #​4552

All changes

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.8...v4.11.0

v4.10.8

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.7...v4.10.8

v4.10.7

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.6...v4.10.7

v4.10.6

Compare Source

Deperecated

bearer-auth options

The following options are deprecated and will be removed in a future version:

  • noAuthenticationHeaderMessage => use noAuthenticationHeader.message
  • invalidAuthenticationHeaderMessage => use invalidAuthenticationHeader.message
  • invalidTokenMessage => use invalidToken.message

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.5...v4.10.6

v4.10.5

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.4...v4.10.5

v4.10.4

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.3...v4.10.4

v4.10.3

Compare Source

Securiy Fix

A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware.

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.2...v4.10.3

v4.10.2

Compare Source

Security hardening improvement

If you are using JWT middleware, please read the following and consider applying the configuration.

Improper Authorization in Hono (JWT Audience Validation)

Hono’s JWT authentication middleware did not validate the aud (Audience) claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential cross-service access (token mix-up).

The issue is addressed by adding a new verification.aud configuration option to allow RFC 7519–compliant audience validation. This change is classified as a security hardening improvement, but the lack of validation can still be considered a vulnerability in deployments that rely on default JWT verification.

You can enable RFC 7519–compliant audience validation using the new verification.aud option:

import { Hono } from 'hono'
import { jwt } from 'hono/jwt'

const app = new Hono()

app.use(
  '/api/*',
  jwt({
    secret: 'my-secret',
    verification: {
      // Require this API to only accept tokens with aud = 'service-a'
      aud: 'service-a',
    },
  })
)

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.1...v4.10.2

v4.10.1

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.10.0...v4.10.1

v4.10.0

Compare Source

Release Notes

Hono v4.10.0 is now available!

This release brings improved TypeScript support and new utilities.

The main highlight is the enhanced middleware type definitions that solve a long-standing issue with type safety for RPC clients.

Middleware Type Improvements

Imagine the following app:

import { Hono } from 'hono'

const app = new Hono()

const routes = app.get(
  '/',
  (c) => {
    return c.json({ errorMessage: 'Error!' }, 500)
  },
  (c) => {
    return c.json({ message: 'Success!' }, 200)
  }
)

The client with RPC:

import { hc } from 'hono/client'

const client = hc<typeof routes>('/')

const res = await client.index.$get()

if (res.status === 500) {
}

if (res.status === 200) {
}

Previously, it couldn't infer the responses from middleware, so a type error was thrown.

CleanShot 2025-10-17 at 06 51 48@​2x

Now the responses are correctly typed.

CleanShot 2025-10-17 at 06 54 13@​2x

This was a long-standing issue and we were thinking it was super difficult to resolve it. But now come true.

Thank you for the great work @​slawekkolodziej!

cloneRawRequest Utility

The new cloneRawRequest utility allows you to clone the raw Request object after it has been consumed by validators or middleware.

import { cloneRawRequest } from 'hono/request'

app.post('/api', async (c) => {
  const body = await c.req.json()

  // Clone the consumed request
  const clonedRequest = cloneRawRequest(c.req)
  await externalLibrary.process(clonedRequest)
})

Thanks @​kamaal111!

New features

  • feat(types): passing middleware types #​4393
  • feat(ssg): add default plugin that defines the recommended behavior #​4394
  • feat(request): add cloneRawRequest utility for request cloning #​4382

All changes

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.9.12...v4.10.0

v4.9.12

Compare Source

What's Changed

  • refactor: internal structure of PreparedRegExpRouter for optimization and added tests by @​usualoma in #​4456
  • refactor: use protected methods instead of computed properties to allow tree shaking by @​usualoma in #​4458

Full Changelog: https://github.com/honojs/hono/compare/v4.9.11...v4.9.12

v4.9.11

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.9.10...v4.9.11

v4.9.10

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.9.9...v4.9.10

v4.9.9

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.9.8...v4.9.9

v4.9.8

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.9.7...v4.9.8

v4.9.7

Compare Source

Security

  • Fixed an issue in the bodyLimit middleware where the body size limit could be bypassed when both Content-Length and Transfer-Encoding headers were present. If you are using this middleware, please update immediately. Security Advisory

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.9.6...v4.9.7

v4.9.6

Compare Source

Security

Fixed a bug in URL path parsing (getPath) that could cause path confusion under malformed requests.

If you rely on reverse proxies (e.g. Nginx) for ACLs or restrict access to endpoints like /admin, please update immediately.

See advisory for details: GHSA-9hp6-4448-45g2

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.9.5...v4.9.6

v4.9.5

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.9.4...v4.9.5

v4.9.4

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.9.3...v4.9.4

v4.9.3

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.9.2...v4.9.3

v4.9.2

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.9.1...v4.9.2

v4.9.1

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.9.0...v4.9.1

v4.9.0

Compare Source

Release Notes

Hono v4.9.0 is now available!

This release introduces several enhancements and utilities.

The main highlight is the new parseResponse utility that makes it easier to work with RPC client responses.

parseResponse Utility

The new parseResponse utility provides a convenient way to parse responses from Hono RPC clients (hc). It automatically handles different response formats and throws structured errors for failed requests.

import { parseResponse, DetailedError } from 'hono/client'

// result contains the parsed response body (automatically parsed based on Content-Type)
const result = await parseResponse(client.hello.$get()).catch(
  // parseResponse automatically throws an error if response is not ok
  (e: DetailedError) => {
    console.error(e)
  }
)

This makes working with RPC client responses much more straightforward and type-safe.

Thanks @​NamesMT!

New features

  • feat(bun): allow importing upgradeWebSocket and websocket directly #​4242
  • feat(aws-lambda): specify content-type as binary #​4250
  • feat(jwt): add validation for the issuer (iss) claim #​4253
  • feat(jwk): add headerName to JWK middleware #​4279
  • feat(cookie): add generateCookie and generateSignedCookie helpers #​4285
  • feat(serve-static): use join to correct path resolution #​4291
  • feat(jwt): expose utility function verifyWithJwks for external use #​4302
  • feat: add parseResponse util to smartly parse hc's Response #​4314
  • feat(ssg): mark old hook options as deprecated #​4331

All changes

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.8.12...v4.9.0

v4.8.12

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.8.11...v4.8.12

v4.8.11

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.8.10...v4.8.11

v4.8.10

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.8.9...v4.8.10

v4.8.9

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.8.8...v4.8.9

v4.8.8

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.8.7...v4.8.8

v4.8.7

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.8.6...v4.8.7

v4.8.6

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.8.5...v4.8.6

v4.8.5

Compare Source

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.8.4...v4.8.5


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [hono](https://hono.dev) ([source](https://github.com/honojs/hono)) | [`4.8.4` → `4.11.4`](https://renovatebot.com/diffs/npm/hono/4.8.4/4.11.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/hono/4.11.4?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/hono/4.11.4?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/hono/4.8.4/4.11.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/hono/4.8.4/4.11.4?slim=true) | --- ### Release Notes <details> <summary>honojs/hono (hono)</summary> ### [`v4.11.4`](https://github.com/honojs/hono/releases/tag/v4.11.4) [Compare Source](https://github.com/honojs/hono/compare/v4.11.3...v4.11.4) #### Security Fixed a JWT algorithm confusion issue in the JWT and JWK/JWKS middleware. Both middlewares now require an explicit algorithm configuration to prevent the verification algorithm from being influenced by untrusted JWT header values. If you are using the JWT or JWK/JWKS middleware, please update to the latest version as soon as possible. ##### JWT middleware ```ts import { jwt } from 'hono/jwt' app.use( '/auth/*', jwt({ secret: 'it-is-very-secret', alg: 'HS256', // required }) ) ``` ##### JWK/JWKS middleware ```ts import { jwk } from 'hono/jwk' app.use( '/auth/*', jwk({ jwks_uri: 'https://example.com/.well-known/jwks.json', alg: ['RS256'], // required (asymmetric algorithms only) }) ) ``` For more details, see the Security Advisory. - <https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4> - <https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4> #### What's Changed - test(utils/jwt): add missing algorithm types in jwa.test.ts by [@&#8203;flathill404](https://github.com/flathill404) in [#&#8203;4607](https://github.com/honojs/hono/pull/4607) - chore: bump `@hono/eslint-config` and enable curly rule by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4620](https://github.com/honojs/hono/pull/4620) - docs(bun/websocket): Fixed a typo in hono/bun deprecation message and updated test. by [@&#8203;Itsnotaka](https://github.com/Itsnotaka) in [#&#8203;4618](https://github.com/honojs/hono/pull/4618) - test: support `alg` option for JWT middleware by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4624](https://github.com/honojs/hono/pull/4624) #### New Contributors - [@&#8203;flathill404](https://github.com/flathill404) made their first contribution in [#&#8203;4607](https://github.com/honojs/hono/pull/4607) - [@&#8203;Itsnotaka](https://github.com/Itsnotaka) made their first contribution in [#&#8203;4618](https://github.com/honojs/hono/pull/4618) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.11.3...v4.11.4> ### [`v4.11.3`](https://github.com/honojs/hono/releases/tag/v4.11.3) [Compare Source](https://github.com/honojs/hono/compare/v4.11.2...v4.11.3) #### What's Changed - fix(types): fix middleware union type merging in MergeMiddlewareResponse by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4602](https://github.com/honojs/hono/pull/4602) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.11.2...v4.11.3> ### [`v4.11.2`](https://github.com/honojs/hono/releases/tag/v4.11.2) [Compare Source](https://github.com/honojs/hono/compare/v4.11.1...v4.11.2) #### What's Changed - docs: improve grammar in contributing documentation by [@&#8203;Ishiezz](https://github.com/Ishiezz) in [#&#8203;4581](https://github.com/honojs/hono/pull/4581) - fix(validator): preserve literal union types in input type inference by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4583](https://github.com/honojs/hono/pull/4583) - chore: bump typescript-go preview for accurate benchmarking by [@&#8203;sushichan044](https://github.com/sushichan044) in [#&#8203;4586](https://github.com/honojs/hono/pull/4586) - refactor(hono-base): add type annotations by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4591](https://github.com/honojs/hono/pull/4591) - refactor(client): refactor `HonoURL` types by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4592](https://github.com/honojs/hono/pull/4592) - perf(types): reduce `Simplify` in `ToSchema` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4597](https://github.com/honojs/hono/pull/4597) - perf(types): optimize `MergeMiddlewareResponse` type by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4598](https://github.com/honojs/hono/pull/4598) #### New Contributors - [@&#8203;Ishiezz](https://github.com/Ishiezz) made their first contribution in [#&#8203;4581](https://github.com/honojs/hono/pull/4581) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.11.1...v4.11.2> ### [`v4.11.1`](https://github.com/honojs/hono/releases/tag/v4.11.1) [Compare Source](https://github.com/honojs/hono/compare/v4.11.0...v4.11.1) #### What's Changed - fix(types): fix app.on method array type inference by [@&#8203;kosei28](https://github.com/kosei28) in [#&#8203;4578](https://github.com/honojs/hono/pull/4578) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.11.0...v4.11.1> ### [`v4.11.0`](https://github.com/honojs/hono/releases/tag/v4.11.0) [Compare Source](https://github.com/honojs/hono/compare/v4.10.8...v4.11.0) ### Release Notes Hono v4.11.0 is now available! This release includes new features for the Hono client, middleware improvements, and an important type system fix. #### Type System Fix for Middleware We've fixed a bug in the type system for middleware. Previously, `app` did not have the correct type with pathless handlers: ```ts const app = new Hono() .use(async (c, next) => { await next() }) .get('/a', async (c, next) => { await next() }) .get((c) => { return c.text('Hello') }) // app's type was incorrect ``` This has now been fixed. Thanks [@&#8203;kosei28](https://github.com/kosei28)! #### Typed URL for Hono Client You can now pass the base URL as the second type parameter to `hc` to get more precise URL types: ```ts const client = hc<typeof app, 'http://localhost:8787'>( 'http://localhost:8787/' ) const url = client.api.posts.$url() // url is TypedURL with precise type information // including protocol, host, and path ``` This is useful when you want to use the URL as a type-safe key for libraries like SWR. Thanks [@&#8203;miyaji255](https://github.com/miyaji255)! #### Custom NotFoundResponse Type You can now customize the `NotFoundResponse` type using module augmentation. This allows `c.notFound()` to return a typed response: ```ts import { Hono, TypedResponse } from 'hono' declare module 'hono' { interface NotFoundResponse extends Response, TypedResponse<{ error: string }, 404, 'json'> {} } const app = new Hono() .get('/posts/:id', async (c) => { const post = await getPost(c.req.param('id')) if (!post) { return c.notFound() } return c.json({ post }, 200) }) .notFound((c) => c.json({ error: 'not found' }, 404)) ``` Now the client can correctly infer the 404 response type. Thanks [@&#8203;miyaji255](https://github.com/miyaji255)! #### tryGetContext Helper The new `tryGetContext()` helper in the Context Storage middleware returns `undefined` instead of throwing an error when the context is not available: ```ts import { tryGetContext } from 'hono/context-storage' const context = tryGetContext<Env>() if (context) { // Context is available console.log(context.var.message) } ``` Thanks [@&#8203;AyushCoder9](https://github.com/AyushCoder9)! #### Custom Query Serializer You can now customize how query parameters are serialized using the `buildSearchParams` option: ```ts const client = hc<AppType>('http://localhost', { buildSearchParams: (query) => { const searchParams = new URLSearchParams() for (const [k, v] of Object.entries(query)) { if (v === undefined) continue if (Array.isArray(v)) { v.forEach((item) => searchParams.append(`${k}[]`, item)) } else { searchParams.set(k, v) } } return searchParams }, }) ``` Thanks [@&#8203;bolasblack](https://github.com/bolasblack)! #### New features - feat(types): make Hono client's $url return the exact URL type [#&#8203;4502](https://github.com/honojs/hono/pull/4502) - feat(types): enhance NotFoundHandler to support custom NotFoundResponse type [#&#8203;4518](https://github.com/honojs/hono/pull/4518) - feat(timing): add wrapTime to simplify usage [#&#8203;4519](https://github.com/honojs/hono/pull/4519) - feat(pretty-json): support force option [#&#8203;4531](https://github.com/honojs/hono/pull/4531) - feat(client): add buildSearchParams option to customize query serialization [#&#8203;4535](https://github.com/honojs/hono/pull/4535) - feat(context-storage): add optional tryGetContext helper [#&#8203;4539](https://github.com/honojs/hono/pull/4539) - feat(secure-headers): add CSP report-to and report-uri directive support [#&#8203;4555](https://github.com/honojs/hono/pull/4555) - fix(types): replace schema-based path tracking with CurrentPath parameter [#&#8203;4552](https://github.com/honojs/hono/pull/4552) #### All changes - chore: update esbuild to version 0.27.1 by [@&#8203;kosei28](https://github.com/kosei28) in [#&#8203;4571](https://github.com/honojs/hono/pull/4571) - fix(hono/jsx): display blank when children is nullish by [@&#8203;techfish-11](https://github.com/techfish-11) in [#&#8203;4573](https://github.com/honojs/hono/pull/4573) - feat(types): make Hono client's $url return the exact URL type by [@&#8203;miyaji255](https://github.com/miyaji255) in [#&#8203;4502](https://github.com/honojs/hono/pull/4502) - feat(types): enhance NotFoundHandler to support custom NotFoundResponse type by [@&#8203;miyaji255](https://github.com/miyaji255) in [#&#8203;4518](https://github.com/honojs/hono/pull/4518) - feat(timing): add wrapTime to simplify usage by [@&#8203;PassiDel](https://github.com/PassiDel) in [#&#8203;4519](https://github.com/honojs/hono/pull/4519) - feat(pretty-json): support force option by [@&#8203;missinglink](https://github.com/missinglink) in [#&#8203;4531](https://github.com/honojs/hono/pull/4531) - feat(context-storage): Add optional tryGetContext helper to context-storage middleware by [@&#8203;AyushCoder9](https://github.com/AyushCoder9) in [#&#8203;4539](https://github.com/honojs/hono/pull/4539) - feat(client): add buildSearchParams option to customize query serialization by [@&#8203;bolasblack](https://github.com/bolasblack) in [#&#8203;4535](https://github.com/honojs/hono/pull/4535) - feat(secure-headers): Add CSP report-to and report-uri directive support by [@&#8203;cruzz77](https://github.com/cruzz77) in [#&#8203;4555](https://github.com/honojs/hono/pull/4555) - fix(types): replace schema-based path tracking with CurrentPath parameter by [@&#8203;kosei28](https://github.com/kosei28) in [#&#8203;4552](https://github.com/honojs/hono/pull/4552) - Next by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4574](https://github.com/honojs/hono/pull/4574) #### New Contributors - [@&#8203;missinglink](https://github.com/missinglink) made their first contribution in [#&#8203;4531](https://github.com/honojs/hono/pull/4531) - [@&#8203;bolasblack](https://github.com/bolasblack) made their first contribution in [#&#8203;4535](https://github.com/honojs/hono/pull/4535) - [@&#8203;cruzz77](https://github.com/cruzz77) made their first contribution in [#&#8203;4555](https://github.com/honojs/hono/pull/4555) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.10.8...v4.11.0> ### [`v4.10.8`](https://github.com/honojs/hono/releases/tag/v4.10.8) [Compare Source](https://github.com/honojs/hono/compare/v4.10.7...v4.10.8) #### What's Changed - chore: bump linter and formatter by [@&#8203;ryuapp](https://github.com/ryuapp) in [#&#8203;4568](https://github.com/honojs/hono/pull/4568) - chore: bump github actions by [@&#8203;ryuapp](https://github.com/ryuapp) in [#&#8203;4569](https://github.com/honojs/hono/pull/4569) - fix(linear-router): incorrect path matching by [@&#8203;cromery](https://github.com/cromery) in [#&#8203;4567](https://github.com/honojs/hono/pull/4567) - docs(cookie): update outdated RFC links by [@&#8203;AyushCoder9](https://github.com/AyushCoder9) in [#&#8203;4557](https://github.com/honojs/hono/pull/4557) - feat(csrf): Support async `IsAllowedOriginHandler` by [@&#8203;baseballyama](https://github.com/baseballyama) in [#&#8203;4558](https://github.com/honojs/hono/pull/4558) - feat(csrf): Support async `IsAllowedSecFetchSiteHandler` by [@&#8203;baseballyama](https://github.com/baseballyama) in [#&#8203;4559](https://github.com/honojs/hono/pull/4559) #### New Contributors - [@&#8203;cromery](https://github.com/cromery) made their first contribution in [#&#8203;4567](https://github.com/honojs/hono/pull/4567) - [@&#8203;AyushCoder9](https://github.com/AyushCoder9) made their first contribution in [#&#8203;4557](https://github.com/honojs/hono/pull/4557) - [@&#8203;baseballyama](https://github.com/baseballyama) made their first contribution in [#&#8203;4558](https://github.com/honojs/hono/pull/4558) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.10.7...v4.10.8> ### [`v4.10.7`](https://github.com/honojs/hono/releases/tag/v4.10.7) [Compare Source](https://github.com/honojs/hono/compare/v4.10.6...v4.10.7) #### What's Changed - fix(validator): fix incomplete types and wrong tests by [@&#8203;EdamAme-x](https://github.com/EdamAme-x) in [#&#8203;4521](https://github.com/honojs/hono/pull/4521) - refactor(types): delete type `NotSpecified` and `StrictVerifyOptions` by [@&#8203;ysknsid25](https://github.com/ysknsid25) in [#&#8203;4525](https://github.com/honojs/hono/pull/4525) - fix: add JSX type for hono/jsx/dom by [@&#8203;ssssota](https://github.com/ssssota) in [#&#8203;4534](https://github.com/honojs/hono/pull/4534) - fix(adapter/bun): fix TypeError: null is not an object ([#&#8203;4429](https://github.com/honojs/hono/issues/4429)) by [@&#8203;brenc](https://github.com/brenc) in [#&#8203;4538](https://github.com/honojs/hono/pull/4538) - chore: add config version to `bun.lock` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4548](https://github.com/honojs/hono/pull/4548) #### New Contributors - [@&#8203;ysknsid25](https://github.com/ysknsid25) made their first contribution in [#&#8203;4525](https://github.com/honojs/hono/pull/4525) - [@&#8203;brenc](https://github.com/brenc) made their first contribution in [#&#8203;4538](https://github.com/honojs/hono/pull/4538) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.10.6...v4.10.7> ### [`v4.10.6`](https://github.com/honojs/hono/releases/tag/v4.10.6) [Compare Source](https://github.com/honojs/hono/compare/v4.10.5...v4.10.6) #### Deperecated ##### bearer-auth options The following options are deprecated and will be removed in a future version: - `noAuthenticationHeaderMessage` => use `noAuthenticationHeader.message` - `invalidAuthenticationHeaderMessage` => use `invalidAuthenticationHeader.message` - `invalidTokenMessage` => use `invalidToken.message` #### What's Changed - feat(aws-lambda): handle AWS Lattice events by [@&#8203;anho](https://github.com/anho) in [#&#8203;4451](https://github.com/honojs/hono/pull/4451) - feat(secure-headers): support CSP TrustedTypePolicy by [@&#8203;RosApr](https://github.com/RosApr) in [#&#8203;4500](https://github.com/honojs/hono/pull/4500) - feat: Improve auth middlewares by [@&#8203;MathurAditya724](https://github.com/MathurAditya724) in [#&#8203;4485](https://github.com/honojs/hono/pull/4485) #### New Contributors - [@&#8203;anho](https://github.com/anho) made their first contribution in [#&#8203;4451](https://github.com/honojs/hono/pull/4451) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.10.5...v4.10.6> ### [`v4.10.5`](https://github.com/honojs/hono/releases/tag/v4.10.5) [Compare Source](https://github.com/honojs/hono/compare/v4.10.4...v4.10.5) #### What's Changed - docs(CONTRIBUTING): use bun instead of yarn in local development setup by [@&#8203;taichi-1](https://github.com/taichi-1) in [#&#8203;4503](https://github.com/honojs/hono/pull/4503) - docs: grammar issue by [@&#8203;WuMingDao](https://github.com/WuMingDao) in [#&#8203;4508](https://github.com/honojs/hono/pull/4508) - fix(utils/url): make \_getQueryParam search behind question mark by [@&#8203;tuzi3040](https://github.com/tuzi3040) in [#&#8203;4507](https://github.com/honojs/hono/pull/4507) - fix(jsx): self-close wrapped empty tags by [@&#8203;jakelee8](https://github.com/jakelee8) in [#&#8203;4511](https://github.com/honojs/hono/pull/4511) - chore: improve private field removal by [@&#8203;BlankParticle](https://github.com/BlankParticle) in [#&#8203;4513](https://github.com/honojs/hono/pull/4513) - fix(middleware/cache): skip caching when `Vary: *` is present by [@&#8203;pHo9UBenaA](https://github.com/pHo9UBenaA) in [#&#8203;4504](https://github.com/honojs/hono/pull/4504) #### New Contributors - [@&#8203;taichi-1](https://github.com/taichi-1) made their first contribution in [#&#8203;4503](https://github.com/honojs/hono/pull/4503) - [@&#8203;WuMingDao](https://github.com/WuMingDao) made their first contribution in [#&#8203;4508](https://github.com/honojs/hono/pull/4508) - [@&#8203;tuzi3040](https://github.com/tuzi3040) made their first contribution in [#&#8203;4507](https://github.com/honojs/hono/pull/4507) - [@&#8203;jakelee8](https://github.com/jakelee8) made their first contribution in [#&#8203;4511](https://github.com/honojs/hono/pull/4511) - [@&#8203;pHo9UBenaA](https://github.com/pHo9UBenaA) made their first contribution in [#&#8203;4504](https://github.com/honojs/hono/pull/4504) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.10.4...v4.10.5> ### [`v4.10.4`](https://github.com/honojs/hono/releases/tag/v4.10.4) [Compare Source](https://github.com/honojs/hono/compare/v4.10.3...v4.10.4) #### What's Changed - chore: add a monochrome logo image by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4487](https://github.com/honojs/hono/pull/4487) - chore: fix the monochrome logo by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4488](https://github.com/honojs/hono/pull/4488) - fix(secure-headers): proposed features typo spelling mistake by [@&#8203;RosApr](https://github.com/RosApr) in [#&#8203;4494](https://github.com/honojs/hono/pull/4494) - fix(types): preserve handler response typing in createHandlers by [@&#8203;s-junio](https://github.com/s-junio) in [#&#8203;4492](https://github.com/honojs/hono/pull/4492) #### New Contributors - [@&#8203;RosApr](https://github.com/RosApr) made their first contribution in [#&#8203;4494](https://github.com/honojs/hono/pull/4494) - [@&#8203;s-junio](https://github.com/s-junio) made their first contribution in [#&#8203;4492](https://github.com/honojs/hono/pull/4492) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.10.3...v4.10.4> ### [`v4.10.3`](https://github.com/honojs/hono/releases/tag/v4.10.3) [Compare Source](https://github.com/honojs/hono/compare/v4.10.2...v4.10.3) #### Securiy Fix A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware. #### What's Changed - fix(aws-lambda): serve microsoft office files as binary in lambda handler by [@&#8203;matthiasfeist](https://github.com/matthiasfeist) in [#&#8203;4469](https://github.com/honojs/hono/pull/4469) - fix(request-id): validation accepts `=` by [@&#8203;ryuapp](https://github.com/ryuapp) in [#&#8203;4478](https://github.com/honojs/hono/pull/4478) - refactor(jwt): reduce the size of the code generated by minification by [@&#8203;usualoma](https://github.com/usualoma) in [#&#8203;4480](https://github.com/honojs/hono/pull/4480) #### New Contributors - [@&#8203;matthiasfeist](https://github.com/matthiasfeist) made their first contribution in [#&#8203;4469](https://github.com/honojs/hono/pull/4469) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.10.2...v4.10.3> ### [`v4.10.2`](https://github.com/honojs/hono/releases/tag/v4.10.2) [Compare Source](https://github.com/honojs/hono/compare/v4.10.1...v4.10.2) #### Security hardening improvement If you are using JWT middleware, please read the following and consider applying the configuration. ##### Improper Authorization in Hono (JWT Audience Validation) Hono’s JWT authentication middleware did not validate the aud (Audience) claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential cross-service access (token mix-up). The issue is addressed by adding a new `verification.aud` configuration option to allow RFC 7519–compliant audience validation. This change is classified as a security hardening improvement, but the lack of validation can still be considered a vulnerability in deployments that rely on default JWT verification. ##### Recommended secure configuration You can enable RFC 7519–compliant audience validation using the new `verification.aud` option: ```ts import { Hono } from 'hono' import { jwt } from 'hono/jwt' const app = new Hono() app.use( '/api/*', jwt({ secret: 'my-secret', verification: { // Require this API to only accept tokens with aud = 'service-a' aud: 'service-a', }, }) ) ``` #### What's Changed - tests: Fix test case of handlers without a path by [@&#8203;IAmSSH](https://github.com/IAmSSH) in [#&#8203;4472](https://github.com/honojs/hono/pull/4472) #### New Contributors - [@&#8203;IAmSSH](https://github.com/IAmSSH) made their first contribution in [#&#8203;4472](https://github.com/honojs/hono/pull/4472) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.10.1...v4.10.2> ### [`v4.10.1`](https://github.com/honojs/hono/releases/tag/v4.10.1) [Compare Source](https://github.com/honojs/hono/compare/v4.10.0...v4.10.1) #### What's Changed - fix(types): cannot `.use` non-return mw from `createMiddleware` by [@&#8203;NamesMT](https://github.com/NamesMT) in [#&#8203;4465](https://github.com/honojs/hono/pull/4465) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.10.0...v4.10.1> ### [`v4.10.0`](https://github.com/honojs/hono/releases/tag/v4.10.0) [Compare Source](https://github.com/honojs/hono/compare/v4.9.12...v4.10.0) ### Release Notes Hono v4.10.0 is now available! This release brings improved TypeScript support and new utilities. The main highlight is the enhanced middleware type definitions that solve a long-standing issue with type safety for RPC clients. #### Middleware Type Improvements Imagine the following app: ```ts import { Hono } from 'hono' const app = new Hono() const routes = app.get( '/', (c) => { return c.json({ errorMessage: 'Error!' }, 500) }, (c) => { return c.json({ message: 'Success!' }, 200) } ) ``` The client with RPC: ```ts import { hc } from 'hono/client' const client = hc<typeof routes>('/') const res = await client.index.$get() if (res.status === 500) { } if (res.status === 200) { } ``` Previously, it couldn't infer the responses from middleware, so a type error was thrown. <img width="1538" height="724" alt="CleanShot 2025-10-17 at 06 51 48@&#8203;2x" src="https://github.com/user-attachments/assets/7e660db0-6c52-4249-9a3d-2932614bbace" /> Now the responses are correctly typed. <img width="1586" height="876" alt="CleanShot 2025-10-17 at 06 54 13@&#8203;2x" src="https://github.com/user-attachments/assets/ef6136f1-bc26-4625-9238-0aec25110efc" /> *** This was a long-standing issue and we were thinking it was super difficult to resolve it. But now come true. Thank you for the great work [@&#8203;slawekkolodziej](https://github.com/slawekkolodziej)! #### cloneRawRequest Utility The new `cloneRawRequest` utility allows you to clone the raw Request object after it has been consumed by validators or middleware. ```ts import { cloneRawRequest } from 'hono/request' app.post('/api', async (c) => { const body = await c.req.json() // Clone the consumed request const clonedRequest = cloneRawRequest(c.req) await externalLibrary.process(clonedRequest) }) ``` Thanks [@&#8203;kamaal111](https://github.com/kamaal111)! #### New features - feat(types): passing middleware types [#&#8203;4393](https://github.com/honojs/hono/pull/4393) - feat(ssg): add default plugin that defines the recommended behavior [#&#8203;4394](https://github.com/honojs/hono/pull/4394) - feat(request): add cloneRawRequest utility for request cloning [#&#8203;4382](https://github.com/honojs/hono/pull/4382) #### All changes - feat(types): passing middleware types by [@&#8203;slawekkolodziej](https://github.com/slawekkolodziej) in [#&#8203;4393](https://github.com/honojs/hono/pull/4393) - feat(ssg): add default plugin that defines the recommended behavior by [@&#8203;3w36zj6](https://github.com/3w36zj6) in [#&#8203;4394](https://github.com/honojs/hono/pull/4394) - feat(request): add cloneRawRequest utility for request cloning by [@&#8203;kamaal111](https://github.com/kamaal111) in [#&#8203;4382](https://github.com/honojs/hono/pull/4382) - fix(proxy): Correct hop-by-hop header handling per RFC 9110 by [@&#8203;sugar-cat7](https://github.com/sugar-cat7) in [#&#8203;4459](https://github.com/honojs/hono/pull/4459) #### New Contributors - [@&#8203;slawekkolodziej](https://github.com/slawekkolodziej) made their first contribution in [#&#8203;4393](https://github.com/honojs/hono/pull/4393) - [@&#8203;kamaal111](https://github.com/kamaal111) made their first contribution in [#&#8203;4382](https://github.com/honojs/hono/pull/4382) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.12...v4.10.0> ### [`v4.9.12`](https://github.com/honojs/hono/releases/tag/v4.9.12) [Compare Source](https://github.com/honojs/hono/compare/v4.9.11...v4.9.12) #### What's Changed - refactor: internal structure of `PreparedRegExpRouter` for optimization and added tests by [@&#8203;usualoma](https://github.com/usualoma) in [#&#8203;4456](https://github.com/honojs/hono/pull/4456) - refactor: use protected methods instead of computed properties to allow `tree shaking` by [@&#8203;usualoma](https://github.com/usualoma) in [#&#8203;4458](https://github.com/honojs/hono/pull/4458) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.11...v4.9.12> ### [`v4.9.11`](https://github.com/honojs/hono/releases/tag/v4.9.11) [Compare Source](https://github.com/honojs/hono/compare/v4.9.10...v4.9.11) #### What's Changed - fix(types): fix 4.9.8 regression by [@&#8203;aadito123](https://github.com/aadito123) in [#&#8203;4448](https://github.com/honojs/hono/pull/4448) - feat(reg-exp-router): Introduced PreparedRegExpRouter by [@&#8203;usualoma](https://github.com/usualoma) in [#&#8203;1796](https://github.com/honojs/hono/pull/1796) #### New Contributors - [@&#8203;aadito123](https://github.com/aadito123) made their first contribution in [#&#8203;4448](https://github.com/honojs/hono/pull/4448) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.10...v4.9.11> ### [`v4.9.10`](https://github.com/honojs/hono/releases/tag/v4.9.10) [Compare Source](https://github.com/honojs/hono/compare/v4.9.9...v4.9.10) #### What's Changed - fix(context): Fix [#&#8203;4427](https://github.com/honojs/hono/issues/4427) type regression by removing non-public export by [@&#8203;aantthony](https://github.com/aantthony) in [#&#8203;4433](https://github.com/honojs/hono/pull/4433) - fix(aws-lambda): sanitize non-ASCII header values to prevent ByteString errors by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4437](https://github.com/honojs/hono/pull/4437) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.9...v4.9.10> ### [`v4.9.9`](https://github.com/honojs/hono/releases/tag/v4.9.9) [Compare Source](https://github.com/honojs/hono/compare/v4.9.8...v4.9.9) #### What's Changed - fix(service-worker): Update service-worker fire() to accept generic variants of Hono app instance by [@&#8203;harmony7](https://github.com/harmony7) in [#&#8203;4420](https://github.com/honojs/hono/pull/4420) - fix(service-worker): correct generics for `handle` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4421](https://github.com/honojs/hono/pull/4421) - feat(helper/route): enable to get route path at specific index by [@&#8203;usualoma](https://github.com/usualoma) in [#&#8203;4423](https://github.com/honojs/hono/pull/4423) #### New Contributors - [@&#8203;harmony7](https://github.com/harmony7) made their first contribution in [#&#8203;4420](https://github.com/honojs/hono/pull/4420) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.8...v4.9.9> ### [`v4.9.8`](https://github.com/honojs/hono/releases/tag/v4.9.8) [Compare Source](https://github.com/honojs/hono/compare/v4.9.7...v4.9.8) #### What's Changed - fix(types): JSONParsed infer unknown values by [@&#8203;BarryThePenguin](https://github.com/BarryThePenguin) in [#&#8203;4405](https://github.com/honojs/hono/pull/4405) - refactor(types): remove SimplifyDeepArray from json types by [@&#8203;BarryThePenguin](https://github.com/BarryThePenguin) in [#&#8203;4406](https://github.com/honojs/hono/pull/4406) - refactor(types): fix the type definitions in hono-base by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4407](https://github.com/honojs/hono/pull/4407) - fix(request): return empty string for empty catch-all param by [@&#8203;amitksingh0880](https://github.com/amitksingh0880) in [#&#8203;4395](https://github.com/honojs/hono/pull/4395) #### New Contributors - [@&#8203;amitksingh0880](https://github.com/amitksingh0880) made their first contribution in [#&#8203;4395](https://github.com/honojs/hono/pull/4395) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.7...v4.9.8> ### [`v4.9.7`](https://github.com/honojs/hono/releases/tag/v4.9.7) [Compare Source](https://github.com/honojs/hono/compare/v4.9.6...v4.9.7) #### Security - Fixed an issue in the `bodyLimit` middleware where the body size limit could be bypassed when both `Content-Length` and `Transfer-Encoding` headers were present. If you are using this middleware, please update immediately. [Security Advisory](https://github.com/honojs/hono/security/advisories/GHSA-92vj-g62v-jqhh) #### What's Changed - fix(client): Fix `parseResponse` not parsing json in react native by [@&#8203;lr0pb](https://github.com/lr0pb) in [#&#8203;4399](https://github.com/honojs/hono/pull/4399) - chore: add `.tool-versions` file by [@&#8203;3w36zj6](https://github.com/3w36zj6) in [#&#8203;4397](https://github.com/honojs/hono/pull/4397) - chore: update `bun install` commands to use `--frozen-lockfile` by [@&#8203;3w36zj6](https://github.com/3w36zj6) in [#&#8203;4398](https://github.com/honojs/hono/pull/4398) - test(jwk): Add tests of JWK token verification by [@&#8203;buckett](https://github.com/buckett) in [#&#8203;4402](https://github.com/honojs/hono/pull/4402) #### New Contributors - [@&#8203;lr0pb](https://github.com/lr0pb) made their first contribution in [#&#8203;4399](https://github.com/honojs/hono/pull/4399) - [@&#8203;buckett](https://github.com/buckett) made their first contribution in [#&#8203;4402](https://github.com/honojs/hono/pull/4402) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.6...v4.9.7> ### [`v4.9.6`](https://github.com/honojs/hono/releases/tag/v4.9.6) [Compare Source](https://github.com/honojs/hono/compare/v4.9.5...v4.9.6) #### Security Fixed a bug in URL path parsing (`getPath`) that could cause path confusion under malformed requests. If you rely on reverse proxies (e.g. Nginx) for ACLs or restrict access to endpoints like `/admin`, please update immediately. See advisory for details: GHSA-9hp6-4448-45g2 #### What's Changed - chore: update packages in the router bench by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4386](https://github.com/honojs/hono/pull/4386) - chore(benchmarks): remove comment-out from router bench by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4387](https://github.com/honojs/hono/pull/4387) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.5...v4.9.6> ### [`v4.9.5`](https://github.com/honojs/hono/releases/tag/v4.9.5) [Compare Source](https://github.com/honojs/hono/compare/v4.9.4...v4.9.5) #### What's Changed - chore: replace supertest with undici by [@&#8203;BarryThePenguin](https://github.com/BarryThePenguin) in [#&#8203;4365](https://github.com/honojs/hono/pull/4365) - fix(aws-lambda): preserve percent-encoded values in query strings by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4372](https://github.com/honojs/hono/pull/4372) - feat(cors): Allow async functions for `origin` and `allowMethods` by [@&#8203;jobrk](https://github.com/jobrk) in [#&#8203;4373](https://github.com/honojs/hono/pull/4373) - feat(cors): Correct origin function return type asynchronously returning null or undefined for origin by [@&#8203;jobrk](https://github.com/jobrk) in [#&#8203;4375](https://github.com/honojs/hono/pull/4375) - fix(service-worker): correct args for `app.fetch` in `handle` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4374](https://github.com/honojs/hono/pull/4374) - fix(language-detector): Detect language from path after getPath changed by [@&#8203;iflamed](https://github.com/iflamed) in [#&#8203;4369](https://github.com/honojs/hono/pull/4369) #### New Contributors - [@&#8203;jobrk](https://github.com/jobrk) made their first contribution in [#&#8203;4373](https://github.com/honojs/hono/pull/4373) - [@&#8203;iflamed](https://github.com/iflamed) made their first contribution in [#&#8203;4369](https://github.com/honojs/hono/pull/4369) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.4...v4.9.5> ### [`v4.9.4`](https://github.com/honojs/hono/releases/tag/v4.9.4) [Compare Source](https://github.com/honojs/hono/compare/v4.9.3...v4.9.4) #### What's Changed - chore: add a type cast to run `deno publish` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4364](https://github.com/honojs/hono/pull/4364) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.3...v4.9.4> ### [`v4.9.3`](https://github.com/honojs/hono/releases/tag/v4.9.3) [Compare Source](https://github.com/honojs/hono/compare/v4.9.2...v4.9.3) #### What's Changed - feat(csrf): Add modern CSRF protection with Fetch Metadata support by [@&#8203;meck93](https://github.com/meck93) in [#&#8203;4353](https://github.com/honojs/hono/pull/4353) - tests: use vitest projects by [@&#8203;BarryThePenguin](https://github.com/BarryThePenguin) in [#&#8203;4359](https://github.com/honojs/hono/pull/4359) - feat(proxy): add `customFetch` option to allow custom fetch function by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4360](https://github.com/honojs/hono/pull/4360) - chore: update `typescript` to `5.9.2` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4362](https://github.com/honojs/hono/pull/4362) - chore: add `packageManager` field to `package.json` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4363](https://github.com/honojs/hono/pull/4363) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.2...v4.9.3> ### [`v4.9.2`](https://github.com/honojs/hono/releases/tag/v4.9.2) [Compare Source](https://github.com/honojs/hono/compare/v4.9.1...v4.9.2) #### What's Changed - fix(jsx): 'plaintext-only' value for contenteditable attribute by [@&#8203;object1037](https://github.com/object1037) in [#&#8203;4349](https://github.com/honojs/hono/pull/4349) - fix(client): handle query parameters in `removeIndexString` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4352](https://github.com/honojs/hono/pull/4352) #### New Contributors - [@&#8203;object1037](https://github.com/object1037) made their first contribution in [#&#8203;4349](https://github.com/honojs/hono/pull/4349) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.1...v4.9.2> ### [`v4.9.1`](https://github.com/honojs/hono/releases/tag/v4.9.1) [Compare Source](https://github.com/honojs/hono/compare/v4.9.0...v4.9.1) #### What's Changed - feat(parseResponse): set `DetailedError.name` (+ error tests) by [@&#8203;NamesMT](https://github.com/NamesMT) in [#&#8203;4344](https://github.com/honojs/hono/pull/4344) - fix(parseResponse): should not include error responses in result by [@&#8203;NamesMT](https://github.com/NamesMT) in [#&#8203;4348](https://github.com/honojs/hono/pull/4348) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.9.0...v4.9.1> ### [`v4.9.0`](https://github.com/honojs/hono/releases/tag/v4.9.0) [Compare Source](https://github.com/honojs/hono/compare/v4.8.12...v4.9.0) ### Release Notes Hono v4.9.0 is now available! This release introduces several enhancements and utilities. The main highlight is the new `parseResponse` utility that makes it easier to work with RPC client responses. #### parseResponse Utility The new `parseResponse` utility provides a convenient way to parse responses from Hono RPC clients (`hc`). It automatically handles different response formats and throws structured errors for failed requests. ```ts import { parseResponse, DetailedError } from 'hono/client' // result contains the parsed response body (automatically parsed based on Content-Type) const result = await parseResponse(client.hello.$get()).catch( // parseResponse automatically throws an error if response is not ok (e: DetailedError) => { console.error(e) } ) ``` This makes working with RPC client responses much more straightforward and type-safe. Thanks [@&#8203;NamesMT](https://github.com/NamesMT)! #### New features - feat(bun): allow importing upgradeWebSocket and websocket directly [#&#8203;4242](https://github.com/honojs/hono/pull/4242) - feat(aws-lambda): specify content-type as binary [#&#8203;4250](https://github.com/honojs/hono/pull/4250) - feat(jwt): add validation for the issuer (iss) claim [#&#8203;4253](https://github.com/honojs/hono/pull/4253) - feat(jwk): add headerName to JWK middleware [#&#8203;4279](https://github.com/honojs/hono/pull/4279) - feat(cookie): add generateCookie and generateSignedCookie helpers [#&#8203;4285](https://github.com/honojs/hono/pull/4285) - feat(serve-static): use join to correct path resolution [#&#8203;4291](https://github.com/honojs/hono/pull/4291) - feat(jwt): expose utility function verifyWithJwks for external use [#&#8203;4302](https://github.com/honojs/hono/pull/4302) - feat: add parseResponse util to smartly parse hc's Response [#&#8203;4314](https://github.com/honojs/hono/pull/4314) - feat(ssg): mark old hook options as deprecated [#&#8203;4331](https://github.com/honojs/hono/pull/4331) #### All changes - feat(aws-lambda): specify content-type as binary by [@&#8203;Kanahiro](https://github.com/Kanahiro) in [#&#8203;4250](https://github.com/honojs/hono/pull/4250) - feat(jwt): added validation for the issuer (`iss`) claim by [@&#8203;yolocat-dev](https://github.com/yolocat-dev) in [#&#8203;4253](https://github.com/honojs/hono/pull/4253) - feat(jwk): Add custom `headerName` to JWK middleware by [@&#8203;JoaquinGimenez1](https://github.com/JoaquinGimenez1) in [#&#8203;4279](https://github.com/honojs/hono/pull/4279) - feat(cookie): generateCookie and generateSignedCookie helpers by [@&#8203;Soviut](https://github.com/Soviut) in [#&#8203;4285](https://github.com/honojs/hono/pull/4285) - feat(serve-static): use `join` to correct path resolution by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4291](https://github.com/honojs/hono/pull/4291) - feat(jwt): Exposing utility function `verifyWithJwks` for external use by [@&#8203;Beyondo](https://github.com/Beyondo) in [#&#8203;4302](https://github.com/honojs/hono/pull/4302) - feat: add `parseResponse` util to smartly parse `hc`'s Response by [@&#8203;NamesMT](https://github.com/NamesMT) in [#&#8203;4314](https://github.com/honojs/hono/pull/4314) - feat(ssg): mark old hook options as deprecated by [@&#8203;3w36zj6](https://github.com/3w36zj6) in [#&#8203;4331](https://github.com/honojs/hono/pull/4331) - fix(bun): exports functions related to websocket by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4341](https://github.com/honojs/hono/pull/4341) - Next by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4340](https://github.com/honojs/hono/pull/4340) - chore: enable `skipLibCheck` to resolve TypeScript compilation issues by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4342](https://github.com/honojs/hono/pull/4342) #### New Contributors - [@&#8203;yolocat-dev](https://github.com/yolocat-dev) made their first contribution in [#&#8203;4253](https://github.com/honojs/hono/pull/4253) - [@&#8203;JoaquinGimenez1](https://github.com/JoaquinGimenez1) made their first contribution in [#&#8203;4279](https://github.com/honojs/hono/pull/4279) - [@&#8203;Soviut](https://github.com/Soviut) made their first contribution in [#&#8203;4285](https://github.com/honojs/hono/pull/4285) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.8.12...v4.9.0> ### [`v4.8.12`](https://github.com/honojs/hono/releases/tag/v4.8.12) [Compare Source](https://github.com/honojs/hono/compare/v4.8.11...v4.8.12) #### What's Changed - fix(router): support `/files/:name{.*}` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4329](https://github.com/honojs/hono/pull/4329) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.8.11...v4.8.12> ### [`v4.8.11`](https://github.com/honojs/hono/releases/tag/v4.8.11) [Compare Source](https://github.com/honojs/hono/compare/v4.8.10...v4.8.11) #### What's Changed - fix(types): should populate `output` type for `c.body()` by [@&#8203;NamesMT](https://github.com/NamesMT) in [#&#8203;4318](https://github.com/honojs/hono/pull/4318) - ci: add editorconfig-checker by [@&#8203;3w36zj6](https://github.com/3w36zj6) in [#&#8203;4321](https://github.com/honojs/hono/pull/4321) - fix(service-worker): pass `FetchEvent` as second argument to `app.fetch` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4328](https://github.com/honojs/hono/pull/4328) - chore(ci): upgrade bun version to 1.2.19 by [@&#8203;BarryThePenguin](https://github.com/BarryThePenguin) in [#&#8203;4323](https://github.com/honojs/hono/pull/4323) - chore: bump `@hono/eslint-config` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4330](https://github.com/honojs/hono/pull/4330) - chore: autofix ci by [@&#8203;BarryThePenguin](https://github.com/BarryThePenguin) in [#&#8203;4322](https://github.com/honojs/hono/pull/4322) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.8.10...v4.8.11> ### [`v4.8.10`](https://github.com/honojs/hono/releases/tag/v4.8.10) [Compare Source](https://github.com/honojs/hono/compare/v4.8.9...v4.8.10) #### What's Changed - chore: add EditorConfig by [@&#8203;3w36zj6](https://github.com/3w36zj6) in [#&#8203;4309](https://github.com/honojs/hono/pull/4309) - chore: format JSON, YAML, and Markdown by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4310](https://github.com/honojs/hono/pull/4310) - chore: format and lint `benchmarks/*` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4317](https://github.com/honojs/hono/pull/4317) - refactor(types): bring adapter/service-worker types up to date by [@&#8203;idealsh](https://github.com/idealsh) in [#&#8203;4315](https://github.com/honojs/hono/pull/4315) - chore: add editorconfig-checker by [@&#8203;3w36zj6](https://github.com/3w36zj6) in [#&#8203;4312](https://github.com/honojs/hono/pull/4312) - fix(cookie): support lowercase priority for compatibility with other libraries by [@&#8203;bytaesu](https://github.com/bytaesu) in [#&#8203;4293](https://github.com/honojs/hono/pull/4293) #### New Contributors - [@&#8203;idealsh](https://github.com/idealsh) made their first contribution in [#&#8203;4315](https://github.com/honojs/hono/pull/4315) - [@&#8203;bytaesu](https://github.com/bytaesu) made their first contribution in [#&#8203;4293](https://github.com/honojs/hono/pull/4293) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.8.9...v4.8.10> ### [`v4.8.9`](https://github.com/honojs/hono/releases/tag/v4.8.9) [Compare Source](https://github.com/honojs/hono/compare/v4.8.8...v4.8.9) #### What's Changed - fix(context): use `isByteString` in `c.redirect` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4307](https://github.com/honojs/hono/pull/4307) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.8.8...v4.8.9> ### [`v4.8.8`](https://github.com/honojs/hono/releases/tag/v4.8.8) [Compare Source](https://github.com/honojs/hono/compare/v4.8.7...v4.8.8) #### What's Changed - docs: simplify the readme by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4305](https://github.com/honojs/hono/pull/4305) - fix(utils/url): prevent double encoding in `safeEncodeURI` by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4306](https://github.com/honojs/hono/pull/4306) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.8.7...v4.8.8> ### [`v4.8.7`](https://github.com/honojs/hono/releases/tag/v4.8.7) [Compare Source](https://github.com/honojs/hono/compare/v4.8.6...v4.8.7) #### What's Changed - chore: fix the deno version for publishing to jsr by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4304](https://github.com/honojs/hono/pull/4304) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.8.6...v4.8.7> ### [`v4.8.6`](https://github.com/honojs/hono/releases/tag/v4.8.6) [Compare Source](https://github.com/honojs/hono/compare/v4.8.5...v4.8.6) #### What's Changed - perf(types): remove unnecessary default types by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;4282](https://github.com/honojs/hono/pull/4282) - fix(context): encode the redirect location by [@&#8203;yayugu](https://github.com/yayugu) in [#&#8203;4297](https://github.com/honojs/hono/pull/4297) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.8.5...v4.8.6> ### [`v4.8.5`](https://github.com/honojs/hono/releases/tag/v4.8.5) [Compare Source](https://github.com/honojs/hono/compare/v4.8.4...v4.8.5) #### What's Changed - fix(serve-static): support Windows by [@&#8203;yusukebe](https://github.com/yusukebe) in [#&#8203;3477](https://github.com/honojs/hono/pull/3477) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.8.4...v4.8.5> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS44Mi4xIiwidXBkYXRlZEluVmVyIjoiNDIuNjQuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYmFja2VuZCIsInJlbm92YXRlIl19-->
renovate-bot changed title from Update dependency hono to ^4.9.2 to Update dependency hono to v4.9.2 2025-08-21 00:10:46 +01:00
renovate-bot force-pushed renovate/hono-4.x from 31403b72e8 to c62f1a2060 2025-08-21 00:10:46 +01:00 Compare
renovate-bot force-pushed renovate/hono-4.x from c62f1a2060 to 8d348aba91 2025-08-21 00:14:01 +01:00 Compare
renovate-bot force-pushed renovate/hono-4.x from 8d348aba91 to ce0d4662da 2025-08-22 06:02:18 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.9.2 to Update dependency hono to v4.9.4 2025-08-22 06:02:19 +01:00
renovate-bot force-pushed renovate/hono-4.x from ce0d4662da to fa1844cbaa 2025-08-30 06:02:02 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.9.4 to Update dependency hono to v4.9.5 2025-08-30 06:02:03 +01:00
renovate-bot force-pushed renovate/hono-4.x from fa1844cbaa to f1dc877057 2025-09-03 06:02:10 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.9.5 to Update dependency hono to v4.9.6 2025-09-03 06:02:10 +01:00
renovate-bot changed title from Update dependency hono to v4.9.6 to Update dependency hono to v4.9.7 2025-09-13 06:02:55 +01:00
renovate-bot force-pushed renovate/hono-4.x from f1dc877057 to 24dd713855 2025-09-13 06:02:55 +01:00 Compare
renovate-bot force-pushed renovate/hono-4.x from 24dd713855 to b89c5420f2 2025-09-19 06:03:31 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.9.7 to Update dependency hono to v4.9.8 2025-09-19 06:03:34 +01:00
renovate-bot force-pushed renovate/hono-4.x from b89c5420f2 to f507f4e148 2025-09-27 06:03:35 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.9.8 to Update dependency hono to v4.9.9 2025-09-27 06:03:36 +01:00
renovate-bot force-pushed renovate/hono-4.x from f507f4e148 to c6316bade5 2025-10-06 06:02:48 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.9.9 to Update dependency hono to v4.9.10 2025-10-06 06:02:48 +01:00
renovate-bot force-pushed renovate/hono-4.x from c6316bade5 to d34782158e 2025-10-12 06:03:09 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.9.10 to Update dependency hono to v4.9.11 2025-10-12 06:03:10 +01:00
renovate-bot force-pushed renovate/hono-4.x from d34782158e to a8be25ee65 2025-10-14 06:03:03 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.9.11 to Update dependency hono to v4.9.12 2025-10-14 06:03:03 +01:00
renovate-bot force-pushed renovate/hono-4.x from a8be25ee65 to ae6be13b72 2025-10-17 06:03:24 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.9.12 to Update dependency hono to v4.10.0 2025-10-17 06:03:26 +01:00
renovate-bot force-pushed renovate/hono-4.x from ae6be13b72 to b109762d7a 2025-10-20 23:08:59 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.10.0 to Update dependency hono to v4.10.1 2025-10-20 23:09:02 +01:00
renovate-bot force-pushed renovate/hono-4.x from b109762d7a to 9e53a984fc 2025-10-22 06:02:03 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.10.1 to Update dependency hono to v4.10.2 2025-10-22 06:02:04 +01:00
renovate-bot force-pushed renovate/hono-4.x from 9e53a984fc to c0012a6f22 2025-10-25 06:02:02 +01:00 Compare
renovate-bot changed title from Update dependency hono to v4.10.2 to Update dependency hono to v4.10.3 2025-10-25 06:02:03 +01:00
renovate-bot force-pushed renovate/hono-4.x from c0012a6f22 to 49ae46c57f 2025-10-30 05:02:09 +00:00 Compare
renovate-bot changed title from Update dependency hono to v4.10.3 to Update dependency hono to v4.10.4 2025-10-30 05:02:09 +00:00
renovate-bot force-pushed renovate/hono-4.x from 49ae46c57f to 3b3f1d2c4e 2025-11-12 05:03:03 +00:00 Compare
renovate-bot changed title from Update dependency hono to v4.10.4 to Update dependency hono to v4.10.5 2025-11-12 05:03:04 +00:00
renovate-bot changed title from Update dependency hono to v4.10.5 to Update dependency hono to v4.10.6 2025-11-15 05:02:16 +00:00
renovate-bot force-pushed renovate/hono-4.x from 3b3f1d2c4e to 90d938a7a4 2025-11-15 05:02:16 +00:00 Compare
renovate-bot changed title from Update dependency hono to v4.10.6 to Update dependency hono to v4.10.7 2025-11-27 05:02:04 +00:00
renovate-bot force-pushed renovate/hono-4.x from 90d938a7a4 to 21cfc9473f 2025-11-27 05:02:04 +00:00 Compare
renovate-bot force-pushed renovate/hono-4.x from 21cfc9473f to 77648c8393 2025-12-10 05:02:43 +00:00 Compare
renovate-bot changed title from Update dependency hono to v4.10.7 to Update dependency hono to v4.10.8 2025-12-10 05:02:44 +00:00
renovate-bot force-pushed renovate/hono-4.x from 77648c8393 to f47e07ad1d 2025-12-14 05:03:43 +00:00 Compare
renovate-bot changed title from Update dependency hono to v4.10.8 to Update dependency hono to v4.11.0 2025-12-14 05:03:44 +00:00
renovate-bot force-pushed renovate/hono-4.x from f47e07ad1d to 341b4767fc 2025-12-15 05:03:19 +00:00 Compare
renovate-bot changed title from Update dependency hono to v4.11.0 to Update dependency hono to v4.11.1 2025-12-15 05:03:20 +00:00
renovate-bot force-pushed renovate/hono-4.x from 341b4767fc to 55254cd467 2025-12-26 05:01:13 +00:00 Compare
renovate-bot changed title from Update dependency hono to v4.11.1 to Update dependency hono to v4.11.2 2025-12-26 05:01:13 +00:00
renovate-bot changed title from Update dependency hono to v4.11.2 to Update dependency hono to v4.11.3 2025-12-27 05:01:16 +00:00
renovate-bot force-pushed renovate/hono-4.x from 55254cd467 to 7f07a05e69 2025-12-27 05:01:16 +00:00 Compare
renovate-bot force-pushed renovate/hono-4.x from 7f07a05e69 to 4d4ad83935 2026-01-13 05:02:47 +00:00 Compare
renovate-bot changed title from Update dependency hono to v4.11.3 to Update dependency hono to v4.11.4 2026-01-13 05:02:48 +00:00
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/hono-4.x:renovate/hono-4.x
git switch renovate/hono-4.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/hono-4.x
git switch renovate/hono-4.x
git rebase main
git switch main
git merge --ff-only renovate/hono-4.x
git switch renovate/hono-4.x
git rebase main
git switch main
git merge --no-ff renovate/hono-4.x
git switch main
git merge --squash renovate/hono-4.x
git switch main
git merge --ff-only renovate/hono-4.x
git switch main
git merge renovate/hono-4.x
git push origin main
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
MobiusReactor/TicTacToeV2!11
No description provided.