# Hono changelog

> A small, fast web framework built on Web Standards that runs on any JavaScript runtime.

- Vendor: Hono
- Category: Frameworks & Libraries
- Official site: https://hono.dev
- Tracked by: What's New (https://whatsnew.fyi/product/hono)
- Harvested from: GitHub (honojs/hono)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v4.13.1

- Date: 2026-08-07
- Version: v4.13.1
- Original notes: https://github.com/honojs/hono/releases/tag/v4.13.1
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.13.1

- **fixed** — Trie router now counts every slash a pattern consumes
- **fixed** — Stream utilities re-acquire writer lock when pipe() throws
- **fixed** — ETag skips unsafe methods or error responses on non-* case

##### What's Changed
* fix(trie-router): count every slash a pattern consumes by @Jaybhade in https://github.com/honojs/hono/pull/5189
* fix(utils/stream): re-acquire writer lock when pipe() throws by @Sriharsha-dev369 in https://github.com/honojs/hono/pull/4988
* fix(etag): skip unsafe methods or error responses on non-* case by @na-trium-144 in https://github.com/honojs/hono/pull/5196

##### New Contributors
* @Jaybhade made their first contribution in https://github.com/honojs/hono/pull/5189
* @Sriharsha-dev369 made their first contribution in https://github.com/honojs/hono/pull/4988

**Full Changelog**: https://github.com/honojs/hono/compare/v4.13.0...v4.13.1

### v4.13.0

- Date: 2026-08-03
- Version: v4.13.0
- Original notes: https://github.com/honojs/hono/releases/tag/v4.13.0
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.13.0

- **added** — First-class support for the HTTP QUERY method with app.query() handler
- **added** — Method Not Allowed middleware that returns 405 responses with Allow header for unsupported methods on registered routes
- **changed** — Core request/response path optimizations including skipping unnecessary Headers allocations, replacing regex tests with indexOf, and lazy allocation of internal state, achieving up to 1.25x performance improvement on common routes
- **changed** — Cache Middleware now caches QUERY responses using SHA-256 digest of request content as part of the cache key, changing internal cache key format for all methods
- **changed** — ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches
- **changed** — CORS Middleware default Access-Control-Allow-Methods now includes QUERY: GET, HEAD, PUT, POST, DELETE, PATCH, QUERY
- **changed** — RegExpRouter now detects unsupported path combinations at registration time instead of at first matching request, making registration plus first match roughly 20% faster
- **changed** — JWT and JWK middleware now accept realm option for WWW-Authenticate challenge on 401 responses with properly escaped challenge values
- **changed** — JSX RefObject type is now aligned with React 19 as { current: T }, requiring nullable refs to be typed as RefObject<T | null> and useRef(undefined) instead of useRef()
- **changed** — Compress Middleware now sets Vary: Accept-Encoding on negotiated responses
- **fixed** — JSX function components can now return an array of children without throwing during server-side rendering
- **changed** — hono/utils/headers synced with IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in [RFC 10008](https://www.rfc-editor.org/rfc/rfc10008.html), a new Method Not Allowed middleware, and more.

##### Performance improvements

This release includes a series of small optimizations: skipping unnecessary `Headers` allocations, replacing regex tests with `indexOf`, allocating internal state lazily, and more.

Here is [`benchmarks/fetch`](https://github.com/honojs/hono/tree/main/benchmarks/fetch) comparing v4.12 and v4.13 (`ROUNDS=5 ./compare.sh`, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

| Benchmark | v4.12 | v4.13 | Speedup |
| --- | ---: | ---: | ---: |
| `ping` — `GET /` | 165.83 ns | 163.99 ns | 1.01x |
| `query` — `GET /id/1?name=bun` | 674.40 ns | 616.99 ns | **1.09x** |
| `json` — `GET /user` | 528.99 ns | 422.44 ns | **1.25x** |
| `body` — `POST /json` | 1.16 µs | 1.00 µs | **1.15x** |

The individual changes:

- perf(context): iterate the header record with `for..in` https://github.com/honojs/hono/pull/5118
- perf(url): replace regex tests with `indexOf` https://github.com/honojs/hono/pull/5121
- perf(context): skip `Headers` creation when there are no headers to merge https://github.com/honojs/hono/pull/5122
- perf(urls): refactor `tryDecodeURIComponent` https://github.com/honojs/hono/pull/5158
- perf(request): allocate `#validatedData` lazily https://github.com/honojs/hono/pull/5175
- perf(request): probe the body cache without allocating https://github.com/honojs/hono/pull/5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @kibertoad for the contributions!

##### First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with `app.query()`:

```ts
const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})
```

Thanks @shellhaki!

##### QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

###### Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

```ts
app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)
```

**Note**: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form `/.hono/cache?__hono_cache_key=...`. If you purge cache entries by URL outside of the middleware (e.g. calling `caches.delete()` with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

###### ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning `304 Not Modified` when `If-None-Match` matches.

###### CORS Middleware

The CORS Middleware now includes QUERY in the default `Access-Control-Allow-Methods`, which is now `GET, HEAD, PUT, POST, DELETE, PATCH, QUERY`. If you specify `allowMethods` explicitly, nothing changes for you.

Thanks @usualoma and @Cherry!

##### Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a `405 Method Not Allowed` response with a proper `Allow` header when the request path matches a registered route but t

_[Truncated at 4000 characters — full notes: https://github.com/honojs/hono/releases/tag/v4.13.0]_

### v4.12.34

- Date: 2026-08-03
- Version: v4.12.34
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.34
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.34

- **security** — Fix memo() retaining SSR output across requests in hono/jsx, preventing cross-user data disclosure when components read request-scoped values from context
- **security** — Fix ReDoS vulnerability in CORS middleware via Access-Control-Request-Headers header parsing when allowHeaders is not configured
- **security** — Fix algorithmic complexity DoS in Language Middleware caused by quadratic string processing in language-tag normalization
- **security** — Fix Proxy Helper not removing response headers listed in the Connection header, preventing exposure of connection-scoped metadata to clients

##### Security fixes

This release includes fixes for the following security issues:

###### `memo()` retains SSR output across requests, leading to cross-user data disclosure

Affects: `hono/jsx` (server-side rendering). Fixes `memo()` reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — `useContext()`, `useRequestContext()`, or `getContext()` — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

###### ReDoS in CORS middleware via `Access-Control-Request-Headers`

Affects: `hono/cors`. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the `Access-Control-Request-Headers` preflight header when `allowHeaders` is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

###### Algorithmic complexity DoS in Language Middleware

Affects: `hono/language`. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or `Accept-Language` header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

###### Proxy Helper does not remove response headers listed in the `Connection` header

Affects: `hono/proxy`. Fixes `proxy()` forwarding response headers that the origin's `Connection` header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

---

Users who use `hono/jsx` for server-side rendering, `hono/cors`, `hono/language`, or `hono/proxy` are strongly encouraged to upgrade to this version.

### v4.12.33

- Date: 2026-07-31
- Version: v4.12.33
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.33
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.33

- **fixed** — Relax cookie name validation when parsing Cookie header
- **fixed** — Handle useSyncExternalStore subscription and snapshot changes in JSX
- **removed** — Remove undeci in favor of global fetch

##### What's Changed
* fix(cookie): relax name validation when parsing Cookie header in https://github.com/honojs/hono/pull/5164
* chore: bump `@hono/node-server` in https://github.com/honojs/hono/pull/5167
* fix(jsx): handle useSyncExternalStore subscription and snapshot changes in https://github.com/honojs/hono/pull/5166
* chore: remove undici in favor of global fetch in https://github.com/honojs/hono/pull/5168

**Full Changelog**: https://github.com/honojs/hono/compare/v4.12.32...v4.12.33

### v4.12.32

- Date: 2026-07-24
- Version: v4.12.32
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.32
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.32

- **fixed** — Add JWT and Lambda authorizer types for API Gateway v2 in aws-lambda
- **fixed** — Emit empty id field to reset Last-Event-ID in SSE
- **fixed** — Use Object.create(null) when parsing query, headers, and params
- **fixed** — Keep CSP callbacks scoped to their header in secure-headers

##### What's Changed
* ci: enable reports for type & bundle size check in https://github.com/honojs/hono/pull/5148
* fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in https://github.com/honojs/hono/pull/5142
* fix(sse): emit empty id field to reset Last-Event-ID in https://github.com/honojs/hono/pull/5138
* test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in https://github.com/honojs/hono/pull/5145
* fix: use `Object.create(null)` when parsing query, headers, and params in https://github.com/honojs/hono/pull/5161
* fix(secure-headers): keep CSP callbacks scoped to their header in https://github.com/honojs/hono/pull/5147

**Full Changelog**: https://github.com/honojs/hono/compare/v4.12.31...v4.12.32

### v4.12.31

- Date: 2026-07-18
- Version: v4.12.31
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.31
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.31

- **fixed** — Reuse cached formData in parseBody()
- **fixed** — Fix multipart boundary mismatch in cloneRawRequest
- **fixed** — Emit retry field when retry is 0 in SSE

##### What's Changed
* test(context): assert case-insensitive header names in response helpers by @yusukebe in https://github.com/honojs/hono/pull/5116
* chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in https://github.com/honojs/hono/pull/5117
* refactor(aws-lambada): remove FIXME in `@ts-expect-error` by @yusukebe in https://github.com/honojs/hono/pull/5130
* fix(utils/body): reuse cached formData in `parseBody()` by @yusukebe in https://github.com/honojs/hono/pull/5131
* fix(request): fix multipart boundary mismatch in `cloneRawRequest` by @yusukebe in https://github.com/honojs/hono/pull/5133
* fix(sse): emit retry feild when retry is `0` by @yusukebe in https://github.com/honojs/hono/pull/5135
* test(validator): fix misspelled identifier in transform type test by @yusukebe in https://github.com/honojs/hono/pull/5136

**Full Changelog**: https://github.com/honojs/hono/compare/v4.12.30...v4.12.31

### v4.12.30

- Date: 2026-07-13
- Version: v4.12.30
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.30
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.30

- **fixed** — Deduplicate Cache-Control directives case-insensitively
- **fixed** — Do not compress 206 Partial Content responses
- **fixed** — Prevent replaceUrlParam from matching a param that prefixes another
- **fixed** — Set duplex when forwarding a stream body in query mode for method-override

##### What's Changed
* chore(benchmark/routers): bump deps in https://github.com/honojs/hono/pull/5107
* chore(benchmark): remove not used benchmarks in https://github.com/honojs/hono/pull/5108
* chore: update to ts6 in prep for ts7 in https://github.com/honojs/hono/pull/5104
* fix(cache): deduplicate Cache-Control directives case-insensitively in https://github.com/honojs/hono/pull/5025
* fix(compress): do not compress 206 Partial Content responses in https://github.com/honojs/hono/pull/5020
* fix(client): replaceUrlParam should not match a param that prefixes another in https://github.com/honojs/hono/pull/5096
* fix(method-override): set duplex when forwarding a stream body in query mode in https://github.com/honojs/hono/pull/5110

**Full Changelog**: https://github.com/honojs/hono/compare/v4.12.29...v4.12.30

### v4.12.29

- Date: 2026-07-10
- Version: v4.12.29
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.29
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.29

- **fixed** — Merge function headers with per-request headers in client
- **fixed** — Resolve the handler with the value passed to the callback in lambda-edge
- **fixed** — Base64 encode content-encoded response bodies in lambda-edge
- **fixed** — Treat any non-identity content-encoding as binary in aws-lambda
- **fixed** — Strip extra properties from array types in JSONParsed
- **fixed** — Match empty wildcard remainder after regexp param in trie-router
- **fixed** — Treat If-None-Match: `*` as a match in etag

##### What's Changed
* fix(client): merge function headers with per-request headers by @yusukebe in https://github.com/honojs/hono/pull/5092
* chore: fix no-op tsc in test script by @yusukebe in https://github.com/honojs/hono/pull/5093
* fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in https://github.com/honojs/hono/pull/5094
* docs(language): add JSDoc @example to languageDetector by @codebybilal18 in https://github.com/honojs/hono/pull/5081
* test(workerd): add `compatibilityDate` by @yusukebe in https://github.com/honojs/hono/pull/5100
* fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in https://github.com/honojs/hono/pull/5099
* fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in https://github.com/honojs/hono/pull/5101
* fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in https://github.com/honojs/hono/pull/5103
* fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in https://github.com/honojs/hono/pull/5102
* fix(etag): treat If-None-Match: `*` as a match by @yusukebe in https://github.com/honojs/hono/pull/5084

##### New Contributors
* @codebybilal18 made their first contribution in https://github.com/honojs/hono/pull/5081
* @Arman-Luthra made their first contribution in https://github.com/honojs/hono/pull/5103

**Full Changelog**: https://github.com/honojs/hono/compare/v4.12.28...v4.12.29

### v4.12.28

- Date: 2026-07-06
- Version: v4.12.28
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.28
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.28

- **fixed** — Treat empty string content as found in serve-static
- **fixed** — Normalize Content-Type media type for case-insensitive matching in utils/body and validator
- **fixed** — Avoid circular dependency between body.ts and request.ts
- **fixed** — Report the requested subprotocol on WSContext.protocol in bun
- **fixed** — Detect V2 events by request context, not rawPath alone in aws-lambda

##### What's Changed
* fix(serve-static): treat empty string content as found by @yusukebe in https://github.com/honojs/hono/pull/5062
* docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in https://github.com/honojs/hono/pull/5047
* chore: don't publish `*.tsbuildinfo` by @yusukebe in https://github.com/honojs/hono/pull/5066
* fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @yusukebe in https://github.com/honojs/hono/pull/5067
* fix: avoid circular dependency between body.ts and request.ts by @usualoma in https://github.com/honojs/hono/pull/5071
* fix(bun): report the requested subprotocol on WSContext.protocol by @greymoth-jp in https://github.com/honojs/hono/pull/5059
* chore: bump `devDependencies` by @yusukebe in https://github.com/honojs/hono/pull/5085
* fix(aws-lambda): detect V2 events by request context, not rawPath alone by @VihaanAgarwal in https://github.com/honojs/hono/pull/5033
* docs(context-storage): fix JSDoc by @yusukebe in https://github.com/honojs/hono/pull/5086

##### New Contributors
* @EduardF1 made their first contribution in https://github.com/honojs/hono/pull/5047
* @greymoth-jp made their first contribution in https://github.com/honojs/hono/pull/5059
* @VihaanAgarwal made their first contribution in https://github.com/honojs/hono/pull/5033

**Full Changelog**: https://github.com/honojs/hono/compare/v4.12.27...v4.12.28

### v4.12.27

- Date: 2026-06-23
- Version: v4.12.27
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.27
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.27

- **security** — Fix hono/jsx and hono/jsx-renderer context isolation during SSR to prevent useContext()/useRequestContext() from reading another concurrent request's context value after an await in an async component
- **security** — Fix Server-Side XSS vulnerability in hono/css cx() function by properly escaping untrusted input passed as class names
- **security** — Fix hono/aws-lambda API Gateway v1 and VPC Lattice adapter to correctly match repeated header values by exact match instead of substring matching

##### Security fixes

This release includes fixes for the following security issues:

###### hono/jsx does not isolate context per request

Affects: `hono/jsx`, `hono/jsx-renderer`. During SSR, context was stored process-wide instead of per request, so `useContext()`/`useRequestContext()` read after an `await` in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

###### Server-Side XSS via JSX escaping bypass in cx()

Affects: `hono/css`. `cx()` marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX `class` attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

###### API Gateway v1 adapter can drop a repeated request header value

Affects: `hono/aws-lambda`. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. `203.0.113.1` dropped when `203.0.113.10` is present) — affecting logic such as `X-Forwarded-For`-based IP restriction. GHSA-xgm2-5f3f-mvvc

---

Users of `hono/jsx`/`hono/jsx-renderer`, `hono/css` (`cx()`), or the `hono/aws-lambda` API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.