[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.13.7 → 4.13.16

---

Release Notes

honojs/hono (hono)

v4.13.16

Compare Source

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

• fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in #​5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

Compare Source

What's Changed

• fix(auth): escape backslashes in the WWW-Authenticate realm by @​yusukebe in #​5590
• docs(contributing): drop the note about linking a fork branch by @​yusukebe in #​5593
• fix(context): allow c.header() after the response body is consumed by @​yusukebe in #​5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

Compare Source

What's Changed

• docs(contributing): ask for issues instead of RPs #​5526
• docs(readme): sync the contributing list with CONTRIBUTING.md #​5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range #​5537
• chore: unified oxfmt and oxlint config #​5518
• docs(readme): remove the deepwiki badge #​5548
• fix(serve-static): only serve GET and HEAD requests #​5514
• fix(build): keep barrel imports in the bundled d.ts #​5557
• fix(jsx): preserve self-closing void elements in cloneElement #​5314
• fix(css): keep "//" inside an unquoted url() when minifying #​5450
• fix(css): keep the descendant combinator before a pseudo-class when minifying #​5451
• fix(serve-static): respect q-values in Accept-Encoding for precompressed files #​5436
• fix(helper/route): match regex params in basePath() the same way as the router #​5498
• fix(trie-router): keep first value for duplicate path params #​5423
• fix(hono-base): disallow getPath when strict is false #​5563
• fix(css): Fix multiline CSS handling in style replacement #​5405
• feat(bearer-auth): allow MessageFunction to return a Response #​5269
• fix(utils/url): preserve encoded duplicate query order #​5495

Full Changelog: honojs/hono@v4.13.13...v4.13.14

v4.13.13

Compare Source

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in #​5439
• docs(request): fix jsdoc comments for some getters in #​5445
• fix(jsx): allow JSXNode function component results in #​5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in #​5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

Compare Source

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in #​5485
• test(build): type-check the bundled declarations from a consumer project in #​5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in #​5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in #​5487
• fix(combine): return a Response from a short-circuiting middleware in some() in #​5391
• chore(deps): upgrade vite-plus to 1.0.0 in #​5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Compare Source

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in #​5433
• chore(package.json): invoke package scripts through pnpm instead of bun in #​5434
• chore: replace prettier with oxfmt in #​5435
• chore(deps): upgrade vitest to 5.0.1 in #​5437
• chore: let oxfmt sort imports instead of eslint in #​5442
• chore: replace eslint with oxlint in #​5443
• chore: introduce Vite+ in #​5444
• fix(types): allow returning a Blob as a response body in #​5446
• chore: convert build scripts into plugins in #​5448
• chore: stop editorconfig-checker from checking Markdown indent size in #​5455
• ci: remove empty step left in cr.yml by the pnpm migration in #​5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #​5459
• feat(adapters): add @​hono/bun as a workspace package in #​5447
• chore(adapters/bun): ship ESM only in #​5462
• feat(adapters): add the seven adapters as workspace packages in #​5463
• feat(adapters/deno): publish to JSR in #​5465
• test: move adapter runtime tests into adapters/* in #​5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

Compare Source

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in #​5380
• fix(accepts): match media types and language tags case-insensitively in #​5376
• fix(linear-router): don't match an empty path segment as a param in #​5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in #​5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #​5379
• fix(aws-lambda): treat binary +xml archive media types as binary in #​5424
• fix(aws-lambda): preserve empty query parameters in #​5292
• fix(lambda-edge): sync content type detection with aws-lambda in #​5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in #​5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

Compare Source

What's Changed

• docs: fix typos in code comments and link third-party middleware section in #​5343
• perf(jsx/dom): reduce lookup work for large keyed updates in #​5340
• fix(aws-lambda): respect backpressure when streaming the response body in #​5351
• fix(accepts, language): skip accept entries with quality 0 when matching in #​5311
• fix(accept): treat the q parameter name as case-insensitive in #​5349
• fix(accept): clamp a negative q to 0, not 1 in #​5357
• fix(request): keep the request media type when reusing a cached body in #​5366
• docs(combine): fix except() JSDoc param and add missing @​returns in #​5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in #​5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Preview renovate/hono-4.x: https://curious-finch-229.convex.site
Deployment: https://curious-finch-229.convex.cloud
Dashboard: https://dashboard.convex.dev/d/curious-finch-229