Skip to content

chore(deps): update dependency hono to v4#43

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/hono-4.x
Open

chore(deps): update dependency hono to v4#43
renovate[bot] wants to merge 1 commit intomainfrom
renovate/hono-4.x

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 9, 2024 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
hono (source) ^3.12.12 → ^4.0.0 age confidence

Release Notes

honojs/hono (hono)

v4.12.0

Compare Source

Release Notes

Hono v4.12.0 is now available!

This release includes new features for the Hono client, middleware improvements, adapter enhancements, and significant performance improvements to the router and context.

$path for Hono Client

The Hono client now has a $path() method that returns the path string instead of a full URL. This is useful when you need just the path portion for routing or key-based operations:

const client = hc<typeof app>('http://localhost:8787')

// Get the path string
const path = client.api.posts.$path()
// => '/api/posts'

// With path parameters
const postPath = client.api.posts[':id'].$path({
  param: { id: '123' },
})
// => '/api/posts/123'

// With query parameters
const searchPath = client.api.posts.$path({
  query: { filter: 'test' },
})
// => '/api/posts?filter=test'

Unlike $url() which returns a URL object, $path() returns a plain path string, making it convenient for use with routers or as cache keys.

Thanks @​ShaMan123!

ApplyGlobalResponse Type Helper for RPC Client

The new ApplyGlobalResponse type helper allows you to add global error response types to all routes in the RPC client. This is useful for typing common error responses from app.onError() or global middlewares:

const app = new Hono()
  .get('/api/users', (c) => c.json({ users: ['alice', 'bob'] }, 200))
  .onError((err, c) => c.json({ error: err.message }, 500))

type AppWithErrors = ApplyGlobalResponse<
  typeof app,
  {
    401: { json: { error: string; message: string } }
    500: { json: { error: string; message: string } }
  }
>

const client = hc<AppWithErrors>('http://api.example.com')
// Now client knows about both success and error responses
const res = await client.api.users.$get()
// InferResponseType includes { users: string[] } | { error: string; message: string }

Thanks @​mohankumarelec!

SSG Redirect Plugin

A new redirectPlugin for SSG generates static HTML redirect pages for HTTP redirect responses (301, 302, 303, 307, 308):

import { toSSG } from 'hono/ssg'
import { defaultPlugin, redirectPlugin } from 'hono/ssg'

const app = new Hono()
app.get('/old', (c) => c.redirect('/new'))
app.get('/new', (c) => c.html('New Page'))

// redirectPlugin must be placed before defaultPlugin
await toSSG(app, fs, {
  plugins: [redirectPlugin(), defaultPlugin()],
})

The generated redirect pages include a <meta http-equiv="refresh"> tag, a canonical link, and a robots noindex meta tag.

Thanks @​3w36zj6!

onAuthSuccess Callback for Basic Auth

The Basic Auth middleware now supports an onAuthSuccess callback that is invoked after successful authentication. This allows you to set context variables or perform logging without re-parsing the Authorization header:

app.use(
  '/auth/*',
  basicAuth({
    username: 'hono',
    password: 'ahotproject',
    onAuthSuccess: (c, username) => {
      c.set('user', { name: username, role: 'admin' })
      console.log(`User ${username} authenticated`)
    },
  })
)

The callback also works with async functions and the verifyUser mode.

Thanks @​AprilNEA!

getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify

getConnInfo() is now available for three additional adapters:

// AWS Lambda (supports API Gateway v1, v2, and ALB)
import { handle, getConnInfo } from 'hono/aws-lambda'

// Cloudflare Pages
import { handle, getConnInfo } from 'hono/cloudflare-pages'

// Netlify
import { handle, getConnInfo } from 'hono/netlify'

app.get('/', (c) => {
  const info = getConnInfo(c)
  return c.text(`Your IP: ${info.remote.address}`)
})

Thanks @​rokasta12!

alwaysRedirect Option for Trailing Slash Middleware

The trailing slash middleware now supports an alwaysRedirect option. When enabled, the middleware redirects before executing handlers, which fixes the issue where trailing slash handling doesn't work with wildcard routes:

app.use(trimTrailingSlash({ alwaysRedirect: true }))

app.get('/my-path/*', async (c) => {
  return c.text('wildcard')
})

// /my-path/something/ will be redirected to /my-path/something
// before the wildcard handler is executed

Progressive Locale Code Truncation

The normalizeLanguage function in the language middleware now supports RFC 4647 Lookup-based progressive truncation. Locale codes like ja-JP will match ja when only the base language is in supportedLanguages:

app.use(
  '/*',
  languageDetector({
    supportedLanguages: ['en', 'ja'],
    fallbackLanguage: 'en',
    order: ['cookie', 'header'],
  })
)

// Accept-Language: ja-JP → matches 'ja'
// Accept-Language: ko-KR → falls back to 'en'

Thanks @​sorafujitani!

exports Field for ExecutionContext

The ExecutionContext type now includes an exports property for Cloudflare Workers. You can use module augmentation to type it with Wrangler's generated types:

import 'hono'

declare module 'hono' {
  interface ExecutionContext {
    readonly exports: Cloudflare.Exports
  }
}

Thanks @​toreis-up!

Performance Improvements

TrieRouter 1.5x ~ 2.0x Faster

The TrieRouter has been significantly optimized with reduced spread syntax usage, O(1) hasChildren checks, lazy regular expression generation, and removal of redundant processes:

Route Node.js Deno Bun
short static GET /user 1.70x 1.40x 1.34x
dynamic GET /user/lookup/username/hey 1.38x 1.69x 1.51x
wildcard GET /static/index.html 1.51x 1.72x 1.43x
all together 1.58x 1.60x 1.82x

Thanks @​EdamAme-x!

Fast Path for c.json()

c.json() now has the same fast path optimization as c.text(). When no custom status, headers, or finalized state exists, the Response is created directly without allocating a Headers object:

// This common pattern is now faster
return c.json({ message: 'Hello' })

Benchmark results:

Metric Before After Change
Reqs/sec 92,268 95,244 +3.2%
Latency 5.42ms 5.25ms -3.1%
Throughput 17.24MB/s 19.07MB/s +10.6%

Thanks @​mgcrea!

New features

  • feat(client): Add ApplyGlobalResponse type helper for RPC Client #​4556
  • feat(ssg): add redirect plugin #​4599
  • feat(client): $path #​4636
  • feat(basic-auth): add context key and callback options #​4645
  • feat(adapter): add getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify #​4649
  • feat(trailing-slash): add alwaysRedirect option to support wildcard routes #​4658
  • feat(language): add progressive locale code truncation to normalizeLanguage #​4717
  • feat(types): Add exports field to ExecutionContext #​4719

Performance

  • perf(context): add fast path to c.json() matching c.text() optimization #​4707
  • perf(trie-router): improve performance (1.5x ~ 2.0x) #​4724
  • perf(context): use createResponseInstance for new Response #​4733

All changes

New Contributors

Full Changelog: honojs/hono@v4.11.10...v4.12.0

v4.11.10

Compare Source

What's Changed

  • fix: fixed to be more properly timing safe (Merge commit from fork 91def7c)

Full Changelog: honojs/hono@v4.11.9...v4.11.10

v4.11.9

Compare Source

v4.11.8

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.11.7...v4.11.8

v4.11.7

Compare Source

Security Release

This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components.

Components
IP Restriction Middleware

Fixed an IPv4 address validation bypass that could allow IP-based access control to be bypassed under certain configurations.

Cache Middleware

Fixed an issue where responses marked with Cache-Control: private or no-store could be cached, potentially leading to information disclosure on some runtimes.

Serve Static Middleware (Cloudflare Workers adapter)

Fixed an issue that could allow unintended access to internal asset keys when serving static files with user-controlled paths.

hono/jsx ErrorBoundary

Fixed a reflected Cross-Site Scripting (XSS) issue in the ErrorBoundary component that could occur when untrusted strings were rendered without proper escaping.

Recommendation

Users are encouraged to upgrade to this release, especially if they:

  • Use IP Restriction Middleware
  • Use Cache Middleware on Deno, Bun, or Node.js
  • Use Serve Static Middleware with user-controlled paths on Cloudflare Workers
  • Render untrusted data inside ErrorBoundary components
Security Advisories & CVEs

Full Changelog: honojs/hono@v4.11.6...v4.11.7

v4.11.6

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.11.5...v4.11.6

v4.11.5

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.11.4...v4.11.5

v4.11.4

Compare Source

Security

Fixed a JWT algorithm confusion issue in the JWT and JWK/JWKS middleware.

Both middlewares now require an explicit algorithm configuration to prevent the verification algorithm from being influenced by untrusted JWT header values.

If you are using the JWT or JWK/JWKS middleware, please update to the latest version as soon as possible.

JWT middleware
import { jwt } from 'hono/jwt'

app.use(
  '/auth/*',
  jwt({
    secret: 'it-is-very-secret',
    alg: 'HS256', // required
  })
)
JWK/JWKS middleware
import { jwk } from 'hono/jwk'

app.use(
  '/auth/*',
  jwk({
    jwks_uri: 'https://example.com/.well-known/jwks.json',
    alg: ['RS256'], // required (asymmetric algorithms only)
  })
)

For more details, see the Security Advisory.

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.11.3...v4.11.4

v4.11.3

Compare Source

What's Changed

  • fix(types): fix middleware union type merging in MergeMiddlewareResponse by @​yusukebe in #​4602

Full Changelog: honojs/hono@v4.11.2...v4.11.3

v4.11.2

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.11.1...v4.11.2

v4.11.1

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.11.0...v4.11.1

v4.11.0

Compare Source

Release Notes

Hono v4.11.0 is now available!

This release includes new features for the Hono client, middleware improvements, and an important type system fix.

Type System Fix for Middleware

We've fixed a bug in the type system for middleware. Previously, app did not have the correct type with pathless handlers:

const app = new Hono()
  .use(async (c, next) => {
    await next()
  })
  .get('/a', async (c, next) => {
    await next()
  })
  .get((c) => {
    return c.text('Hello')
  })

// app's type was incorrect

This has now been fixed.

Thanks @​kosei28!

Typed URL for Hono Client

You can now pass the base URL as the second type parameter to hc to get more precise URL types:

const client = hc<typeof app, 'http://localhost:8787'>(
  'http://localhost:8787/'
)

const url = client.api.posts.$url()
// url is TypedURL with precise type information
// including protocol, host, and path

This is useful when you want to use the URL as a type-safe key for libraries like SWR.

Thanks @​miyaji255!

Custom NotFoundResponse Type

You can now customize the NotFoundResponse type using module augmentation. This allows c.notFound() to return a typed response:

import { Hono, TypedResponse } from 'hono'

declare module 'hono' {
  interface NotFoundResponse
    extends Response,
      TypedResponse<{ error: string }, 404, 'json'> {}
}

const app = new Hono()
  .get('/posts/:id', async (c) => {
    const post = await getPost(c.req.param('id'))
    if (!post) {
      return c.notFound()
    }
    return c.json({ post }, 200)
  })
  .notFound((c) => c.json({ error: 'not found' }, 404))

Now the client can correctly infer the 404 response type.

Thanks @​miyaji255!

tryGetContext Helper

The new tryGetContext() helper in the Context Storage middleware returns undefined instead of throwing an error when the context is not available:

import { tryGetContext } from 'hono/context-storage'

const context = tryGetContext<Env>()
if (context) {
  // Context is available
  console.log(context.var.message)
}

Thanks @​AyushCoder9!

Custom Query Serializer

You can now customize how query parameters are serialized using the buildSearchParams option:

const client = hc<AppType>('http://localhost', {
  buildSearchParams: (query) => {
    const searchParams = new URLSearchParams()
    for (const [k, v] of Object.entries(query)) {
      if (v === undefined) continue
      if (Array.isArray(v)) {
        v.forEach((item) => searchParams.append(`${k}[]`, item))
      } else {
        searchParams.set(k, v)
      }
    }
    return searchParams
  },
})

Thanks @​bolasblack!

New features

  • feat(types): make Hono client's $url return the exact URL type #​4502
  • feat(types): enhance NotFoundHandler to support custom NotFoundResponse type #​4518
  • feat(timing): add wrapTime to simplify usage #​4519
  • feat(pretty-json): support force option #​4531
  • feat(client): add buildSearchParams option to customize query serialization #​4535
  • feat(context-storage): add optional tryGetContext helper #​4539
  • feat(secure-headers): add CSP report-to and report-uri directive support #​4555
  • fix(types): replace schema-based path tracking with CurrentPath parameter #​4552

All changes

New Contributors

Full Changelog: honojs/hono@v4.10.8...v4.11.0

v4.10.8

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.10.7...v4.10.8

v4.10.7

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.10.6...v4.10.7

v4.10.6

Compare Source

Deperecated
bearer-auth options

The following options are deprecated and will be removed in a future version:

  • noAuthenticationHeaderMessage => use noAuthenticationHeader.message
  • invalidAuthenticationHeaderMessage => use invalidAuthenticationHeader.message
  • invalidTokenMessage => use invalidToken.message
What's Changed
New Contributors

Full Changelog: honojs/hono@v4.10.5...v4.10.6

v4.10.5

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.10.4...v4.10.5

v4.10.4

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.10.3...v4.10.4

v4.10.3

Compare Source

Securiy Fix

A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware.

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.10.2...v4.10.3

v4.10.2

Compare Source

v4.10.1

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.10.0...v4.10.1

v4.10.0

Compare Source

Release Notes

Hono v4.10.0 is now available!

This release brings improved TypeScript support and new utilities.

The main highlight is the enhanced middleware type definitions that solve a long-standing issue with type safety for RPC clients.

Middleware Type Improvements

Imagine the following app:

import { Hono } from 'hono'

const app = new Hono()

const routes = app.get(
  '/',
  (c) => {
    return c.json({ errorMessage: 'Error!' }, 500)
  },
  (c) => {
    return c.json({ message: 'Success!' }, 200)
  }
)

The client with RPC:

import { hc } from 'hono/client'

const client = hc<typeof routes>('/')

const res = await client.index.$get()

if (res.status === 500) {
}

if (res.status === 200) {
}

Previously, it couldn't infer the responses from middleware, so a type error was thrown.

CleanShot 2025-10-17 at 06 51 48@​2x

Now the responses are correctly typed.

CleanShot 2025-10-17 at 06 54 13@​2x

This was a long-standing issue and we were thinking it was super difficult to resolve it. But now come true.

Thank you for the great work @​slawekkolodziej!

cloneRawRequest Utility

The new cloneRawRequest utility allows you to clone the raw Request object after it has been consumed by validators or middleware.

import { cloneRawRequest } from 'hono/request'

app.post('/api', async (c) => {
  const body = await c.req.json()

  // Clone the consumed request
  const clonedRequest = cloneRawRequest(c.req)
  await externalLibrary.process(clonedRequest)
})

Thanks @​kamaal111!

New features

  • feat(types): passing middleware types #​4393
  • feat(ssg): add default plugin that defines the recommended behavior #​4394
  • feat(request): add cloneRawRequest utility for request cloning #​4382

All changes

New Contributors

Full Changelog: honojs/hono@v4.9.12...v4.10.0

v4.9.12

Compare Source

What's Changed

  • refactor: internal structure of PreparedRegExpRouter for optimization and added tests by @​usualoma in #​4456
  • refactor: use protected methods instead of computed properties to allow tree shaking by @​usualoma in #​4458

Full Changelog: honojs/hono@v4.9.11...v4.9.12

v4.9.11

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.10...v4.9.11

v4.9.10

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.9.9...v4.9.10

v4.9.9

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.8...v4.9.9

v4.9.8

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.7...v4.9.8

v4.9.7

Compare Source

Security

  • Fixed an issue in the bodyLimit middleware where the body size limit could be bypassed when both Content-Length and Transfer-Encoding headers were present. If you are using this middleware, please update immediately. Security Advisory

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.6...v4.9.7

v4.9.6

Compare Source

Security

Fixed a bug in URL path parsing (getPath) that could cause path confusion under malformed requests.

If you rely on reverse proxies (e.g. Nginx) for ACLs or restrict access to endpoints like /admin, please update immediately.

See advisory for details: GHSA-9hp6-4448-45g2

What's Changed

Full Changelog: honojs/hono@v4.9.5...v4.9.6

v4.9.5

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.4...v4.9.5

v4.9.4

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.9.3...v4.9.4

v4.9.3

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.9.2...v4.9.3

v4.9.2

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.1...v4.9.2

v4.9.1

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.9.0...v4.9.1

v4.9.0

Compare Source

Release Notes

Hono v4.9.0 is now available!

This release introduces several enhancements and utilities.

The main highlight is the new parseResponse utility that makes it easier to work with RPC client responses.

parseResponse Utility

The new parseResponse utility provides a convenient way to parse responses from Hono RPC clients (hc). It automatically handles different response formats and throws structured errors for failed requests.

import { parseResponse, DetailedError } from 'hono/client'

// result contains the parsed response body (automatically parsed based on Content-Type)
const result = await parseResponse(client.hello.$get()).catch(
  // parseResponse automatically throws an error if response is not ok
  (e: DetailedError) => {
    console.error(e)
  }
)

This mak

@renovate renovate bot added the deps label Feb 9, 2024
@renovate renovate bot force-pushed the renovate/hono-4.x branch 4 times, most recently from f997c2e to c730140 Compare March 2, 2024 17:06
@renovate renovate bot force-pushed the renovate/hono-4.x branch from c730140 to 35258d1 Compare July 25, 2025 10:45
@coderabbitai
Copy link

coderabbitai bot commented Jul 25, 2025 •
edited
Loading

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

  • 🔍 Trigger a full review

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate bot force-pushed the renovate/hono-4.x branch 3 times, most recently from 398703a to 6010bf0 Compare July 29, 2025 08:53
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from b7485f6 to eee0a9e Compare August 8, 2025 01:25
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from b85be43 to e76f4fb Compare August 15, 2025 10:01
@renovate renovate bot force-pushed the renovate/hono-4.x branch from e76f4fb to 2e35c93 Compare August 22, 2025 04:47
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 271d6c0 to 8e92841 Compare September 3, 2025 05:32
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 7f12ef4 to ace1bda Compare September 18, 2025 09:40
@renovate renovate bot force-pushed the renovate/hono-4.x branch from ace1bda to a234216 Compare September 27, 2025 02:06
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 8bd32ac to e98d1f4 Compare October 11, 2025 13:26
@renovate renovate bot force-pushed the renovate/hono-4.x branch 3 times, most recently from d4d9b8b to 8a66df7 Compare October 17, 2025 14:00
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from ea59e08 to 261bfa1 Compare October 24, 2025 22:52
@renovate renovate bot force-pushed the renovate/hono-4.x branch from 261bfa1 to 28fe864 Compare October 30, 2025 04:38
@renovate renovate bot force-pushed the renovate/hono-4.x branch from 28fe864 to 3074550 Compare November 6, 2025 15:55
@github-actions github-actions bot removed the deps label Nov 9, 2025
@renovate renovate bot force-pushed the renovate/hono-4.x branch 3 times, most recently from e5123fc to a38d6d2 Compare November 9, 2025 07:38
@pkg-pr-new
Copy link

pkg-pr-new bot commented Nov 9, 2025 •
edited
Loading

Open in StackBlitz

npm i https://pkg.pr.new/intlify/utils/@intlify/utils@43

commit: 49ac514

@renovate renovate bot force-pushed the renovate/hono-4.x branch 4 times, most recently from 2ed149c to 96ed4f7 Compare November 10, 2025 19:42
@renovate renovate bot force-pushed the renovate/hono-4.x branch from 96ed4f7 to fe2a81a Compare November 18, 2025 12:01
@renovate renovate bot force-pushed the renovate/hono-4.x branch from fe2a81a to 7ccf17f Compare December 3, 2025 12:29
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from ee2208e to 2bdc2f2 Compare December 20, 2025 09:50
@renovate renovate bot force-pushed the renovate/hono-4.x branch from 2bdc2f2 to 9b610b7 Compare December 31, 2025 17:05
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from ba86efa to dbff9d2 Compare January 23, 2026 17:29
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 1b18d76 to d678bd2 Compare February 2, 2026 18:16
@renovate renovate bot force-pushed the renovate/hono-4.x branch from d678bd2 to dd3e4c1 Compare February 12, 2026 10:02
@renovate renovate bot force-pushed the renovate/hono-4.x branch from dd3e4c1 to 49ac514 Compare February 25, 2026 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants