Skip to content

chore(deps): update dependency hono to v4 #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency hono to v4 #43

wants to merge 1 commit into from
+1 −1

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 9, 2024 •
edited
Loading

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

This PR contains the following updates:

Package Change Age Confidence
hono (source) ^3.8.1 -> ^4.0.0 age confidence

Release Notes

honojs/hono (hono)

v4.9.10

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.9.9...v4.9.10

v4.9.9

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.9.8...v4.9.9

v4.9.8

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.7...v4.9.8

v4.9.7

Compare Source

Security
  • Fixed an issue in the bodyLimit middleware where the body size limit could be bypassed when both Content-Length and Transfer-Encoding headers were present. If you are using this middleware, please update immediately. Security Advisory
What's Changed
New Contributors

Full Changelog: honojs/hono@v4.9.6...v4.9.7

v4.9.6

Compare Source

Security

Fixed a bug in URL path parsing (getPath) that could cause path confusion under malformed requests.

If you rely on reverse proxies (e.g. Nginx) for ACLs or restrict access to endpoints like /admin, please update immediately.

See advisory for details: GHSA-9hp6-4448-45g2

What's Changed

Full Changelog: honojs/hono@v4.9.5...v4.9.6

v4.9.5

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.4...v4.9.5

v4.9.4

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.9.3...v4.9.4

v4.9.3

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.9.2...v4.9.3

v4.9.2

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.1...v4.9.2

v4.9.1

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.9.0...v4.9.1

v4.9.0

Compare Source

Release Notes

Hono v4.9.0 is now available!

This release introduces several enhancements and utilities.

The main highlight is the new parseResponse utility that makes it easier to work with RPC client responses.

parseResponse Utility

The new parseResponse utility provides a convenient way to parse responses from Hono RPC clients (hc). It automatically handles different response formats and throws structured errors for failed requests.

import { parseResponse, DetailedError } from 'hono/client'

// result contains the parsed response body (automatically parsed based on Content-Type)
const result = await parseResponse(client.hello.$get()).catch(
  // parseResponse automatically throws an error if response is not ok
  (e: DetailedError) => {
    console.error(e)
  }
)

This makes working with RPC client responses much more straightforward and type-safe.

Thanks @​NamesMT!

New features

  • feat(bun): allow importing upgradeWebSocket and websocket directly #​4242
  • feat(aws-lambda): specify content-type as binary #​4250
  • feat(jwt): add validation for the issuer (iss) claim #​4253
  • feat(jwk): add headerName to JWK middleware #​4279
  • feat(cookie): add generateCookie and generateSignedCookie helpers #​4285
  • feat(serve-static): use join to correct path resolution #​4291
  • feat(jwt): expose utility function verifyWithJwks for external use #​4302
  • feat: add parseResponse util to smartly parse hc's Response #​4314
  • feat(ssg): mark old hook options as deprecated #​4331

All changes

New Contributors

Full Changelog: honojs/hono@v4.8.12...v4.9.0

v4.8.12

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.11...v4.8.12

v4.8.11

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.10...v4.8.11

v4.8.10

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.8.9...v4.8.10

v4.8.9

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.8...v4.8.9

v4.8.8

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.7...v4.8.8

v4.8.7

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.6...v4.8.7

v4.8.6

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.5...v4.8.6

v4.8.5

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.4...v4.8.5

v4.8.4

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.3...v4.8.4

v4.8.3

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.8.2...v4.8.3

v4.8.2

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.1...v4.8.2

v4.8.1

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.8.0...v4.8.1

v4.8.0

Compare Source

Release Notes

Hono v4.8.0 is now available!

This release enhances existing features with new options and introduces powerful helpers for routing and static site generation. Additionally, we're introducing new third-party middleware packages.

  • Route Helper
  • JWT Custom Header Location
  • JSX Streaming Nonce Support
  • CORS Dynamic allowedMethods
  • JWK Allow Anonymous Access
  • Cache Status Codes Option
  • Service Worker fire() Function
  • SSG Plugin System

Plus new third-party middleware:

  • MCP Middleware
  • UA Blocker Middleware
  • Zod Validator v4 Support

Let's look at each of these.

Reduced the code size

First, this update reduces the code size! The smallest hono/tiny package has been reduced by about 800 bytes from v4.7.11, bringing it down to approximately 11 KB. When gzipped, it's only 4.5 KB. Very tiny!

Route Helper

New route helper functions provide easy access to route information and path utilities.

import { Hono } from 'hono'
import {
  matchedRoutes,
  routePath,
  baseRoutePath,
  basePath,
} from 'hono/route'

const api = new Hono()

api.get('/users/:id/posts/:postId', (c) => {
  const matched = matchedRoutes(c) // Array of matched route handlers
  const current = routePath(c) // '/api/users/:id/posts/:postId'
  const base = baseRoutePath(c) // '/api' Base route path
  const appBase = basePath(c) // '/api' Base path
  return c.json({ matched, current, base, appBase })
})

const app = new Hono()
app.route('/api', api)

export default app

These helpers make route introspection cleaner and more explicit.

Thanks @​usualoma!

JWT Custom Header Location

JWT middleware now supports custom header locations beyond the standard Authorization header. You can specify any header name to retrieve JWT tokens from.

import { Hono } from 'hono'
import { jwt } from 'hono/jwt'

const app = new Hono()

app.use(
  '/api/*',
  jwt({
    secret: 'secret-key',
    headerName: 'X-Auth-Token', // Custom header name
  })
)

app.get('/api/protected', (c) => {
  return c.json({ message: 'Protected resource' })
})

This is useful when working with APIs that use non-standard authentication headers.

Thanks @​kunalbhagawati!

JSX Streaming Nonce Support

JSX streaming now supports nonce values for Content Security Policy (CSP) compliance. The streaming context can include a nonce that gets applied to inline scripts.

import { Hono } from 'hono'
import {
  renderToReadableStream,
  Suspense,
  StreamingContext,
} from 'hono/jsx/streaming'

const app = new Hono()

app.get('/', (c) => {
  const stream = renderToReadableStream(
    <html>
      <body>
        <StreamingContext
          value={{ scriptNonce: 'random-nonce-value' }}
        >
          <Suspense fallback={<div>Loading...</div>}>
            <AsyncComponent />
          </Suspense>
        </StreamingContext>
      </body>
    </html>
  )

  return c.body(stream, {
    headers: {
      'Content-Type': 'text/html; charset=UTF-8',
      'Transfer-Encoding': 'chunked',
      'Content-Security-Policy':
        "script-src 'nonce-random-nonce-value'",
    },
  })
})

Thanks @​usualoma!

CORS Dynamic allowedMethods

CORS middleware now supports dynamic allowedMethods based on the request origin. You can provide a function that returns different allowed methods depending on the origin.

import { Hono } from 'hono'
import { cors } from 'hono/cors'

const app = new Hono()

app.use(
  '*',
  cors({
    origin: ['https://example.com', 'https://api.example.com'],
    allowMethods: (origin) => {
      if (origin === 'https://api.example.com') {
        return ['GET', 'POST', 'PUT', 'DELETE']
      }
      return ['GET', 'POST'] // Default for other origins
    },
  })
)

This enables fine-grained control over CORS policies per origin.

Thanks @​Kanahiro!

JWK Allow Anonymous Access

JWK middleware now supports anonymous access with the allow_anon option. When enabled, requests without valid tokens can still proceed to your handlers.

import { Hono } from 'hono'
import { jwk } from 'hono/jwk'

const app = new Hono()

app.use(
  '/api/*',
  jwk({
    jwks_uri: 'https://example.com/.well-known/jwks.json',
    allow_anon: true,
  })
)

app.get('/api/data', (c) => {
  const payload = c.get('jwtPayload')
  if (payload) {
    return c.json({ message: 'Authenticated user', user: payload })
  }
  return c.json({ message: 'Anonymous access' })
})

Additionally, keys and jwks_uri options now support functions that receive the context, enabling dynamic key resolution.

Thanks @​Beyondo!

Cache Status Codes Option

Cache middleware now allows you to specify which status codes should be cached using the cacheableStatusCodes option.

import { Hono } from 'hono'
import { cache } from 'hono/cache'

const app = new Hono()

app.use(
  '*',
  cache({
    cacheName: 'my-cache',
    cacheControl: 'max-age=3600',
    cacheableStatusCodes: [200, 404], // Cache both success and not found responses
  })
)

Thanks @​miyamo2!

Service Worker fire() Function

A new fire() function is available from the Service Worker adapter, providing a cleaner alternative to app.fire().

import { Hono } from 'hono'
import { fire } from 'hono/service-worker'

const app = new Hono()

app.get('/', (c) => c.text('Hello from Service Worker!'))

// Use the standalone fire function
fire(app)

The app.fire() method is now deprecated in favor of this approach. Goodbye app.fire().

SSG Plugin System

Static Site Generation (SSG) now supports a plugin system that allows you to extend the generation process with custom functionality.

For example, the following is easy implementation of a sitemap plugin:

// plugins.ts
import fs from 'node:fs/promises'
import path from 'node:path'
import type { SSGPlugin } from 'hono/ssg'
import { DEFAULT_OUTPUT_DIR } from 'hono/ssg'

export const sitemapPlugin = (baseURL: string): SSGPlugin => {
  return {
    afterGenerateHook: (result, fsModule, options) => {
      const outputDir = options?.dir ?? DEFAULT_OUTPUT_DIR
      const filePath = path.join(outputDir, 'sitemap.xml')
      const urls = result.files.map((file) =>
        new URL(file, baseURL).toString()
      )
      const siteMapText = `<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
${urls.map((url) => `<url><loc>${url}</loc></url>`).join('\n')}
</urlset>`
      fsModule.writeFile(filePath, siteMapText)
    },
  }
}

Applying the plugin:

import { toSSG } from 'hono/ssg'
import { sitemapPlugin } from './plugins'

toSSG(app, fs, {
  plugins: [sitemapPlugin('https://example.com')],
})

Plugins can hook into various stages of the generation process to perform custom actions.

Thanks @​3w36zj6!

Third-party Middleware Updates

In addition to core Hono features, we're excited to introduce new third-party middleware packages that extend Hono's capabilities.

MCP Middleware

A new middleware package @hono/mcp enables creating remote MCP (Model Context Protocol) servers over Streamable HTTP Transport. This is the initial release with more features planned for the future.

import { McpServer } from '@&#8203;modelcontextprotocol/sdk/server/mcp.js'
import { StreamableHTTPTransport } from '@&#8203;hono/mcp'
import { Hono } from 'hono'

const app = new Hono()

// Your MCP server implementation
const mcpServer = new McpServer({
  name: 'my-mcp-server',
  version: '1.0.0',
})

app.all('/mcp', async (c) => {
  const transport = new StreamableHTTPTransport()
  await mcpServer.connect(transport)
  return transport.handleRequest(c)
})

Currently, this is ideal for creating stateless and authentication-less remote MCP servers.

Thanks @​MathurAditya724!

UA Blocker Middleware

The new @hono/ua-blocker middleware allows blocking requests based on user agent headers. It includes blocking AI bots functions.

import { uaBlocker } from '@&#8203;hono/ua-blocker'
import { aiBots } from '@&#8203;hono/ua-blocker/ai-bots'
import { Hono } from 'hono'

const app = new Hono()

// Block specific user agents
app.use(
  '*',
  uaBlocker({
    blocklist: ['ForbiddenBot', 'Not You'],
  })
)

// Block all AI bots
app.use(
  '*',
  uaBlocker({
    blocklist: aiBots,
  })
)

// Serve robots.txt to discourage AI bots
app.use('/robots.txt', useAiRobotsTxt())

Thanks @​finxol!

Zod Validator v4 Support

The @hono/zod-validator middleware now supports Zod v4!

All Changes

New Contributors

Full Changelog: honojs/hono@v4.7.11...v4.8.0

v4.7.11

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.10...v4.7.11

v4.7.10

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.7.9...v4.7.10

v4.7.9

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.8...v4.7.9

v4.7.8

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.7...v4.7.8

v4.7.7

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.6...v4.7.7

v4.7.6

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.5...v4.7.6

v4.7.5

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.4...v4.7.5

v4.7.4

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.7.3...v4.7.4

v4.7.3

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.2...v4.7.3

v4.7.2

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.7.1...v4.7.2

v4.7.1

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.0...v4.7.1

v4.7.0

Compare Source

Release Notes

Hono v4.7.0 is now available!

This release introduces one helper and two middleware.

  • Proxy Helper
  • Language Middleware
  • JWK Auth Middleware

Plus, Standard Schema Validator has been born.

Let's look at each of these.

Proxy Helper

We sometimes use the Hono application as a reverse proxy. In that case, it accesses the backend using fetch. However, it sends an unintended headers.

app.all('/proxy/:path', (c) => {
  // Send unintended header values to the origin server
  return fetch(`http://${originServer}/${c.req.param('path')}`)
})

For example, fetch may send Accept-Encoding, causing the origin server to return a compressed response. Some runtimes automatically decode it, leading to a Content-Length mismatch and potential client-side errors.

Also, you should probably remove some of the headers sent from the origin server, such as Transfer-Encoding.

Proxy Helper will send requests to the origin and handle responses properly. The above headers problem is solved simply by writing as follows.

import { Hono } from 'hono'
import { proxy } from 'hono/proxy'

app.get('/proxy/:path', (c) => {
  return proxy(`http://${originServer}/${c.req.param('path')}`)
})

You can also use it in more complex ways.

app.get('/proxy/:path', async (c) => {
  const res = await proxy(
    `http://${originServer}/${c.req.param('path')}`,
    {
      headers: {
        ...c.req.header(),
        'X-Forwarded-For': '127.0.0.1',
        'X-Forwarded-Host': c.req.header('host'),
        Authorization: undefined,
      },
    }
  )
  res.headers.delete('Set-Cookie')
  return res
})

Thanks [@​usualoma](https://redirect.github.c

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the deps label Feb 9, 2024
@renovate renovate bot force-pushed the renovate/hono-4.x branch 4 times, most recently from f997c2e to c730140 Compare March 2, 2024 17:06
@renovate renovate bot force-pushed the renovate/hono-4.x branch from c730140 to 35258d1 Compare July 25, 2025 10:45
@coderabbitai coderabbitai
Copy link

coderabbitai bot commented Jul 25, 2025 •
edited
Loading

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Note

Free review on us!

CodeRabbit is offering free reviews until Wed Oct 08 2025 to showcase some of the refinements we've made.

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate bot force-pushed the renovate/hono-4.x branch 3 times, most recently from 398703a to 6010bf0 Compare July 29, 2025 08:53
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from b7485f6 to eee0a9e Compare August 8, 2025 01:25
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from b85be43 to e76f4fb Compare August 15, 2025 10:01
@renovate renovate bot force-pushed the renovate/hono-4.x branch from e76f4fb to 2e35c93 Compare August 22, 2025 04:47
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 271d6c0 to 8e92841 Compare September 3, 2025 05:32
@renovate renovate bot force-pushed the renovate/hono-4.x branch 2 times, most recently from 7f12ef4 to ace1bda Compare September 18, 2025 09:40
@renovate renovate bot force-pushed the renovate/hono-4.x branch from ace1bda to a234216 Compare September 27, 2025 02:06
@renovate renovate bot force-pushed the renovate/hono-4.x branch from a234216 to 8bd32ac Compare October 5, 2025 17:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
deps
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants