Packages/hono

Releases of hono

410 stable releases, newest first. Release notes are kept for the last 90 days; older ones link to where they were published.

  1. 4.13.13

    4 October 2026

    Mount Middleware

    app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

    import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

    app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

  2. 4.13.12

    30 September 2026

    What's Changed

    • build: keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements

    • etag: correctly match mixed-case header name in retainedHeader option

    • jsx: add px to numeric gridGap, gridRowGap and gridColumnGap

  3. 4.13.11

    29 September 2026

    Security fixes

    serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

    Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

    serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

  4. 4.13.10

    28 September 2026

    Adapters are now separate packages

    The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

    hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

    - import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

  5. 4.13.9

    24 September 2026

    What's Changed

    • jsx: replace Suspense and ErrorBoundary content across newlines

    • accepts: match media types and language tags case-insensitively

    • linear-router: don't match an empty path segment as a param

  6. 4.13.8

    15 September 2026

    What's Changed

    • jsx/dom: reduce lookup work for large keyed updates

    • aws-lambda: respect backpressure when streaming the response body

    • accepts, language: skip accept entries with quality 0 when matching

  7. 4.13.7

    4 September 2026

    Security fixes

    This release includes a fix for the following security issue:

    hono/jsx renders plain strings unescaped in boundary components, leading to XSS

    Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

  8. 4.13.6

    4 September 2026

    What's Changed

    • client: keep a param value of "index" in $url() and $path()

    • client: normalize root WebSocket URLs

    • types: allow symbol keys in Context<any> get and set fallbacks

  9. 4.13.5

    26 August 2026

    Security fixes

    This release includes fixes for the following security issues:

    Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

    Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

  10. 4.13.4

    24 August 2026

    What's Changed

    • request: handle params on unmatched requests

    • jsx/dom: execute previous ref cleanup when ref prop changes on re-render

    • reg-exp-router: associate wildcard middleware with matching routes

  11. 4.13.3

    18 August 2026

    What's Changed

    • client: prevent URL corruption when replaceUrlParam contains $ replacement tokens

    • etag: copy pending stream bytes

    • etag: avoid skipping headers when filtering 304 response headers

  12. 4.13.2

    13 August 2026

    What's Changed

    • secure-headers: output standard empty parentheses () instead of none for disabled Permissions-Policy directives

    • jsx: render async children of document metadata tags instead of [object Promise]

    • etag: resolve incorrect incremental hashing for chunked responses

  13. 4.13.1

    7 August 2026

    What's Changed

    • trie-router: count every slash a pattern consumes

    • utils/stream: re-acquire writer lock when pipe() throws

    • etag: skip unsafe methods or error responses on non-* case

  14. 4.13.0

    3 August 2026

    Hono v4.13.0 is now available!

    The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

    Performance improvements

    This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

  15. 4.12.34

    3 August 2026

    Security fixes

    This release includes fixes for the following security issues:

    memo() retains SSR output across requests, leading to cross-user data disclosure

    Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

  16. 4.12.33

    31 July 2026

    What's Changed

    • cookie: relax name validation when parsing Cookie header

    • jsx: handle useSyncExternalStore subscription and snapshot changes

  17. 4.12.32

    24 July 2026

    What's Changed

    • aws-lambda: add jwt and lambda authorizer types for API Gateway v2

    • sse: emit empty id field to reset Last-Event-ID

    • use Object.create(null) when parsing query, headers, and params

  18. 4.12.31

    18 July 2026

  19. 4.12.30

    13 July 2026

  20. 4.12.29

    10 July 2026

  21. 4.12.28

    6 July 2026

  22. 4.12.27

    23 June 2026

  23. 4.12.26

    18 June 2026

  24. 4.12.25

    9 June 2026

  25. 4.12.24

    8 June 2026

  26. 4.12.23

    25 May 2026

  27. 4.12.22

    22 May 2026

  28. 4.12.21

    19 May 2026

  29. 4.12.20

    19 May 2026

  30. 4.12.19

    16 May 2026

  31. 4.12.18

    6 May 2026

  32. 4.12.17

    5 May 2026

  33. 4.12.16

    30 April 2026

  34. 4.12.15

    24 April 2026

  35. 4.12.14

    15 April 2026

  36. 4.12.13

    15 April 2026

  37. 4.12.12

    7 April 2026

  38. 4.12.11

    6 April 2026

  39. 4.12.10

    2 April 2026

  40. 4.12.9

    23 March 2026

  41. 4.12.8

    14 March 2026

  42. 4.12.7

    10 March 2026

  43. 4.12.6

    10 March 2026

  44. 4.12.5

    4 March 2026

  45. 4.12.4

    3 March 2026

  46. 4.12.3

    26 February 2026

  47. 4.12.2

    23 February 2026

  48. 4.12.1

    21 February 2026

  49. 4.12.0

    19 February 2026

  50. 4.11.10

    18 February 2026