Hono v4.13.0 is now available!
The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.
Performance improvements
This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.
Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):
| Benchmark | v4.12 | v4.13 | Speedup |
|---|
ping — GET / | 165.83 ns | 163.99 ns | 1.01x |
query — GET /id/1?name=bun | 674.40 ns | 616.99 ns | 1.09x |
json — GET /user | 528.99 ns | 422.44 ns | 1.25x |
body — POST /json | 1.16 µs | 1.00 µs | 1.15x |
The individual changes:
In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.
Thanks @kibertoad for the contributions!
First-class QUERY method support
The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():
const app = new Hono()
app.query('/search', async (c) => {
const conditions = await c.req.json()
return c.json(await search(conditions))
})
Thanks @shellhaki!
QUERY support across built-in middleware
The built-in middleware has been updated to handle QUERY requests properly:
Cache Middleware
The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:
app.query(
'/search',
cache({
cacheName: 'search-cache',
cacheControl: 'max-age=3600',
})
)
Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.
ETag Middleware
The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.
CORS Middleware
The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.
Thanks @usualoma and @Cherry!
Method Not Allowed Middleware
The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:
import { methodNotAllowed } from 'hono/method-not-allowed'
const app = new Hono()
app.use(methodNotAllowed({ app }))
app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))
// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST
You can customize the response with the onMethodNotAllowed option:
app.use(
methodNotAllowed({
app,
onMethodNotAllowed: (c, methods) =>
c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
})
)
Thanks @usualoma!
RegExpRouter throws UnsupportedPathError at registration time
The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.
Thanks @usualoma!
Other improvements
hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @akahoshi1421!- The JWT and JWK middleware now accept a
realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @arhxam!
- JSX:
useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @ashunar0!
- JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @natsuki-engr!
- The Compress Middleware now sets
Vary: Accept-Encoding on negotiated responses. Thanks @arhxam!
All changes
Full Changelog: https://github.com/honojs/hono/compare/v4.12.34...v4.13.0
Thank you to all contributors!