Hono Release Notes

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

• app.mount('/itty-router', ittyRouter.handle)

• app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

test(client): simulate network error for undefined route in parseResponse test in #5439

docs(request): fix jsdoc comments for some getters in #5445

fix(jsx): allow JSXNode function component results in #5476

feat(mount): introduce Mount Middleware and deprecate app.mount in #5221

Full Changelog: v4.13.12...v4.13.13

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in #5485
• test(build): type-check the bundled declarations from a consumer project in #5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in #5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in #5487
• fix(combine): return a Response from a short-circuiting middleware in some() in #5391
• chore(deps): upgrade vite-plus to 1.0.0 in #5464

Full Changelog: v4.13.11...v4.13.12

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

chore: migrate the package manager from bun to pnpm in #5433

chore(package.json): invoke package scripts through pnpm instead of bun in #5434

chore: replace prettier with oxfmt in #5435

chore(deps): upgrade vitest to 5.0.1 in #5437

chore: let oxfmt sort imports instead of eslint in #5442

chore: replace eslint with oxlint in #5443

chore: introduce Vite+ in #5444

fix(types): allow returning a Blob as a response body in #5446

chore: convert build scripts into plugins in #5448

chore: stop editorconfig-checker from checking Markdown indent size in #5455

ci: remove empty step left in cr.yml by the pnpm migration in #5456

chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #5459

feat(adapters): add @hono/bun as a workspace package in #5447

chore(adapters/bun): ship ESM only in #5462

feat(adapters): add the seven adapters as workspace packages in #5463

feat(adapters/deno): publish to JSR in #5465

test: move adapter runtime tests into adapters/* in #5466

Full Changelog: v4.13.9...v4.13.10

What's Changed

fix(jsx): replace Suspense and ErrorBoundary content across newlines in #5380

fix(accepts): match media types and language tags case-insensitively in #5376

fix(linear-router): don't match an empty path segment as a param in #5373

fix(pretty-json): don't break responses with unparseable JSON bodies in #5377

fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #5379

fix(aws-lambda): treat binary +xml archive media types as binary in #5424

fix(aws-lambda): preserve empty query parameters in #5292

fix(lambda-edge): sync content type detection with aws-lambda in #5426

fix(lambda-edge): fail with a descriptive error on a malformed event in #5358

Full Changelog: v4.13.8...v4.13.9

What's Changed

docs: fix typos in code comments and link third-party middleware section in #5343

perf(jsx/dom): reduce lookup work for large keyed updates in #5340

fix(aws-lambda): respect backpressure when streaming the response body in #5351

fix(accepts, language): skip accept entries with quality 0 when matching in #5311

fix(accept): treat the q parameter name as case-insensitive in #5349

fix(accept): clamp a negative q to 0, not 1 in #5357

fix(request): keep the request media type when reusing a cached body in #5366

docs(combine): fix except() JSDoc param and add missing @returns in #5346

perf(jsx/dom): optimize matching-head child lookup during reconciliation in #5329

Full Changelog: v4.13.7...v4.13.8