Skip to content

chore(deps): update dependency hono to v4 - #43

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/hono-4.x
Open

chore(deps): update dependency hono to v4#43
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/hono-4.x

Conversation

@renovate

@renovate renovate Bot commented Feb 9, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
hono (source) ^3.12.12 → ^4.0.0 age confidence

Release Notes

honojs/hono (hono)

v4.13.13

Compare Source

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in #​5439
  • docs(request): fix jsdoc comments for some getters in #​5445
  • fix(jsx): allow JSXNode function component results in #​5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in #​5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

Compare Source

What's Changed

  • fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in #​5485
  • test(build): type-check the bundled declarations from a consumer project in #​5486
  • fix(etag): correctly match mixed-case header name in retainedHeader option in #​5475
  • fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in #​5487
  • fix(combine): return a Response from a short-circuiting middleware in some() in #​5391
  • chore(deps): upgrade vite-plus to 1.0.0 in #​5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Compare Source

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

  • chore: migrate the package manager from bun to pnpm in #​5433
  • chore(package.json): invoke package scripts through pnpm instead of bun in #​5434
  • chore: replace prettier with oxfmt in #​5435
  • chore(deps): upgrade vitest to 5.0.1 in #​5437
  • chore: let oxfmt sort imports instead of eslint in #​5442
  • chore: replace eslint with oxlint in #​5443
  • chore: introduce Vite+ in #​5444
  • fix(types): allow returning a Blob as a response body in #​5446
  • chore: convert build scripts into plugins in #​5448
  • chore: stop editorconfig-checker from checking Markdown indent size in #​5455
  • ci: remove empty step left in cr.yml by the pnpm migration in #​5456
  • chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #​5459
  • feat(adapters): add @​hono/bun as a workspace package in #​5447
  • chore(adapters/bun): ship ESM only in #​5462
  • feat(adapters): add the seven adapters as workspace packages in #​5463
  • feat(adapters/deno): publish to JSR in #​5465
  • test: move adapter runtime tests into adapters/* in #​5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

Compare Source

What's Changed

  • fix(jsx): replace Suspense and ErrorBoundary content across newlines in #​5380
  • fix(accepts): match media types and language tags case-insensitively in #​5376
  • fix(linear-router): don't match an empty path segment as a param in #​5373
  • fix(pretty-json): don't break responses with unparseable JSON bodies in #​5377
  • fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #​5379
  • fix(aws-lambda): treat binary +xml archive media types as binary in #​5424
  • fix(aws-lambda): preserve empty query parameters in #​5292
  • fix(lambda-edge): sync content type detection with aws-lambda in #​5426
  • fix(lambda-edge): fail with a descriptive error on a malformed event in #​5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

Compare Source

What's Changed

  • docs: fix typos in code comments and link third-party middleware section in #​5343
  • perf(jsx/dom): reduce lookup work for large keyed updates in #​5340
  • fix(aws-lambda): respect backpressure when streaming the response body in #​5351
  • fix(accepts, language): skip accept entries with quality 0 when matching in #​5311
  • fix(accept): treat the q parameter name as case-insensitive in #​5349
  • fix(accept): clamp a negative q to 0, not 1 in #​5357
  • fix(request): keep the request media type when reusing a cached body in #​5366
  • docs(combine): fix except() JSDoc param and add missing @​returns in #​5346
  • perf(jsx/dom): optimize matching-head child lookup during reconciliation in #​5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Compare Source

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

Compare Source

What's Changed

  • fix(client): keep a param value of "index" in $url() and $path() in #​5297
  • fix(client): normalize root WebSocket URLs in #​5291
  • fix(types): allow symbol keys in Context get and set fallbacks in #​5300
  • chore: bump editorconfig-checker in #​5336
  • refactor(on-handler): use forEach for consistent handler iteration in #​5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Compare Source

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

Compare Source

What's Changed

  • fix(request): handle params on unmatched requests in #​5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in #​5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in #​5266
  • perf(router): share null object creation in #​5267
  • fix(etag): match If-None-Match tags with optional whitespace before the comma in #​5222
  • fix(client): skip undefined header and cookie values in #​5244
  • fix(client): skip an undefined entry inside a query array in #​5272
  • fix(client): skip an undefined entry inside a form array in #​5280
  • fix(client): support custom buildSearchParams and filter undefined query in $ws() bin #​5256
  • fix(accepts): support wildcard media types and specificity ordering in defaultMatch in #​5255
  • fix(client): omit empty query delimiter in #​5283
  • fix(request): drop stale content length for cloned FormData in #​5282
  • fix(request): serialize cached JSON body in cloneRawRequest in #​5288
  • fix(cookie): allow parsing signed cookies with empty string values in #​5246
  • fix(utils/stream): do not let abort listeners crash abort() in #​5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

Compare Source

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #​5227
  • fix(etag): copy pending stream bytes in #​5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in #​5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in #​5235
  • docs(context): add custom headers append option example to Context JSDoc in #​5248
  • fix(trie-router): match suffix wildcard routes in #​5236
  • fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in #​5252
  • fix(csrf): exempt OPTIONS request from CSRF validation in #​5250
  • fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in #​5247
  • feat(pretty-json): support structured JSON content-types (+json) in #​5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

Compare Source

What's Changed

  • fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #​5197
  • fix(jsx): render async children of document metadata tags instead of [object Promise] in #​5204
  • fix(etag): resolve incorrect incremental hashing for chunked responses in #​5199
  • fix(client): serialize multiple cookies correctly in #​5202
  • fix(etag): stabilize digest across stream chunks in #​5205
  • fix(url): strip trailing question mark correctly for optional params with regex quantifiers in #​5209
  • perf(cors): pre-join static array header options during initialization in #​5210
  • fix(client): send falsy JSON bodies in #​5215
  • feat(secure-headers): add missing W3C Permissions-Policy directives in #​5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Compare Source

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup
ping — GET / 165.83 ns 163.99 ns 1.01x
query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x
json — GET /user 528.99 ns 422.44 ns 1.25x
body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

  • perf(context): iterate the header record with for..in #​5118
  • perf(url): replace regex tests with indexOf #​5121
  • perf(context): skip Headers creation when there are no headers to merge #​5122
  • perf(urls): refactor tryDecodeURIComponent #​5158
  • perf(request): allocate #validatedData lazily #​5175
  • perf(request): probe the body cache without allocating #​5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @​usualoma and @​Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'

const app = new Hono()

app.use(methodNotAllowed({ app }))

app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))

// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
  methodNotAllowed({
    app,
    onMethodNotAllowed: (c, methods) =>
      c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
  })
)

Thanks @​usualoma!

RegExpRouter throws UnsupportedPathError at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @​usualoma!

Other improvements

  • hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @​akahoshi1421!
  • The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @​arhxam!
  • JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @​ashunar0!
  • JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @​natsuki-engr!
  • The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @​arhxam!

All changes

Full Changelog: honojs/hono@v4.12.34...v4.13.0

Thank you to all contributors!

v4.12.34

Compare Source

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

Compare Source

What's Changed

  • fix(cookie): relax name validation when parsing Cookie header in #​5164
  • chore: bump @hono/node-server in #​5167
  • fix(jsx): handle useSyncExternalStore subscription and snapshot changes in #​5166
  • chore: remove undici in favor of global fetch in #​5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

Compare Source

What's Changed

  • ci: enable reports for type & bundle size check in #​5148
  • fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #​5142
  • fix(sse): emit empty id field to reset Last-Event-ID in #​5138
  • test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #​5145
  • fix: use Object.create(null) when parsing query, headers, and params in #​5161
  • fix(secure-headers): keep CSP callbacks scoped to their header in #​5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

Compare Source

What's Changed

  • chore(benchmark/routers): bump deps in #​5107
  • chore(benchmark): remove not used benchmarks in #​5108
  • chore: update to ts6 in prep for ts7 in #​5104
  • fix(cache): deduplicate Cache-Control directives case-insensitively in #​5025
  • fix(compress): do not compress 206 Partial Content responses in #​5020
  • fix(client): replaceUrlParam should not match a param that prefixes another in #​5096
  • fix(method-override): set duplex when forwarding a stream body in query mode in #​5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.27...v4.12.28

v4.12.27

Compare Source

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

v4.12.26

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.12.25...v4.12.26

v4.12.25

Compare Source

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@​Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.12.23...v4.12.24

v4.12.23

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.12.22...v4.12.23

v4.12.22

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.21...v4.12.22

v4.12.21

Compare Source

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

Compare Source

What's Changed

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the deps label Feb 9, 2024
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 4 times, most recently from f997c2e to c730140 Compare March 2, 2024 17:06
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from c730140 to 35258d1 Compare July 25, 2025 10:45
@coderabbitai

coderabbitai Bot commented Jul 25, 2025 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: a353e51f-70ac-4ce9-87d7-909d0ca7c7ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 3 times, most recently from 398703a to 6010bf0 Compare July 29, 2025 08:53
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from b7485f6 to eee0a9e Compare August 8, 2025 01:25
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from b85be43 to e76f4fb Compare August 15, 2025 10:01
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from e76f4fb to 2e35c93 Compare August 22, 2025 04:47
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 271d6c0 to 8e92841 Compare September 3, 2025 05:32
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 7f12ef4 to ace1bda Compare September 18, 2025 09:40
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from ace1bda to a234216 Compare September 27, 2025 02:06
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 8bd32ac to e98d1f4 Compare October 11, 2025 13:26
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 3 times, most recently from d4d9b8b to 8a66df7 Compare October 17, 2025 14:00
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from ea59e08 to 261bfa1 Compare October 24, 2025 22:52
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from 261bfa1 to 28fe864 Compare October 30, 2025 04:38
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from 28fe864 to 3074550 Compare November 6, 2025 15:55
@github-actions github-actions Bot removed the deps label Nov 9, 2025
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from ba86efa to dbff9d2 Compare January 23, 2026 17:29
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 1b18d76 to d678bd2 Compare February 2, 2026 18:16
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from d678bd2 to dd3e4c1 Compare February 12, 2026 10:02
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 49ac514 to 3522ff1 Compare February 28, 2026 13:10
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 4 times, most recently from 0e950e4 to 175dca0 Compare March 11, 2026 10:47
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from a3b7dc0 to 11334c6 Compare March 17, 2026 04:44
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from 11334c6 to bb20e99 Compare March 21, 2026 09:41
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from bb20e99 to eaf5e73 Compare March 30, 2026 14:59
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 4a6f0a1 to 880b6ec Compare April 13, 2026 09:22
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from 880b6ec to 3e60e36 Compare April 22, 2026 06:03
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from b78f047 to 35c02b6 Compare May 1, 2026 14:01
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 3 times, most recently from 0e4bf57 to 87b5fb6 Compare May 13, 2026 14:06
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 4593023 to 6732681 Compare May 23, 2026 13:32
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from 6732681 to 6b3cce7 Compare May 26, 2026 11:10
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch from 6b3cce7 to b87c439 Compare June 11, 2026 12:01
@renovate
renovate Bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 8a5d4eb to 8e8c432 Compare June 30, 2026 04:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants