chore(deps): update dependency hono to v4.13.7

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.12.33 → 4.13.7

---

Release Notes

honojs/hono (hono)

v4.13.7

Compare Source

v4.13.6

Compare Source

v4.13.5

Compare Source

v4.13.4

Compare Source

v4.13.3

Compare Source

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #​5227
• fix(etag): copy pending stream bytes in #​5239
• fix(etag): avoid skipping headers when filtering 304 response headers in #​5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in #​5235
• docs(context): add custom headers append option example to Context JSDoc in #​5248
• fix(trie-router): match suffix wildcard routes in #​5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in #​5252
• fix(csrf): exempt OPTIONS request from CSRF validation in #​5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in #​5247
• feat(pretty-json): support structured JSON content-types (+json) in #​5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

Compare Source

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #​5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in #​5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in #​5199
• fix(client): serialize multiple cookies correctly in #​5202
• fix(etag): stabilize digest across stream chunks in #​5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in #​5209
• perf(cors): pre-join static array header options during initialization in #​5210
• fix(client): send falsy JSON bodies in #​5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in #​5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

Compare Source

v4.13.0

Compare Source

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
ping — GET /	165.83 ns	163.99 ns	1.01x
query — GET /id/1?name=bun	674.40 ns	616.99 ns	1.09x
json — GET /user	528.99 ns	422.44 ns	1.25x
body — POST /json	1.16 µs	1.00 µs	1.15x

The individual changes:

• perf(context): iterate the header record with for..in #​5118
• perf(url): replace regex tests with indexOf #​5121
• perf(context): skip Headers creation when there are no headers to merge #​5122
• perf(urls): refactor tryDecodeURIComponent #​5158
• perf(request): allocate #validatedData lazily #​5175
• perf(request): probe the body cache without allocating #​5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @​usualoma and @​Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'

const app = new Hono()

app.use(methodNotAllowed({ app }))

app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))

// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
  methodNotAllowed({
    app,
    onMethodNotAllowed: (c, methods) =>
      c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
  })
)

Thanks @​usualoma!

RegExpRouter throws UnsupportedPathError at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @​usualoma!

Other improvements

• hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @​akahoshi1421!
• The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @​arhxam!
• JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @​ashunar0!
• JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @​natsuki-engr!
• The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @​arhxam!

All changes

• perf(hono-base): avoid rest parameter in fetch by @​yusukebe in #​5113
• perf(context): iterate the header record with for..in by @​yusukebe in #​5118
• perf(url/request): replace regex tests with indexOf by @​yusukebe in #​5121
• perf(context): skip Headers creation when there are no headers to merge by @​yusukebe in #​5122
• perf(urls): refactor tryDecodeURIComponent by @​yusukebe in #​5158
• chore(benchmarks): correct src path on Windows, add json and middleware cases by @​kibertoad in #​5173
• perf(context): drop the throwaway env field initializer by @​kibertoad in #​5174
• perf(request): allocate #validatedData lazily by @​kibertoad in #​5175
• perf(request): probe the body cache without allocating by @​kibertoad in #​5176
• chore(benchmarks): stabilize measurements by forcing mitata batching by @​yusukebe in #​5183
• perf(hono-base): restore the rest parameter in fetch by @​yusukebe in #​5184
• perf(context): restore the env field initializer by @​yusukebe in #​5186
• feat: add first-class QUERY method support by @​shellhaki in #​5070
• feat(etag): support conditional requests for the QUERY method by @​Cherry in #​5111
• feat(cors): allow QUERY by default as a first-class method by @​usualoma in #​5115
• feat(cache): add first-class support for QUERY requests by @​usualoma in #​5119
• feat(jsx): add React-compatible overloads to useRef by @​ashunar0 in #​5063
• feat(middleware): add method-not-allowed middleware by @​usualoma in #​5132
• feat(jwt,jwk): add a configurable WWW-Authenticate realm by @​arhxam in #​5141
• feat(utils/headers): sync HTTP field types with the IANA registry by @​akahoshi1421 in #​5153
• fix(jsx): allow a function component to return an array by @​natsuki-engr in #​5179
• feat(reg-exp-router): throw UnsupportedPathError during route registration by @​usualoma in #​5171
• fix(compress): set Vary: Accept-Encoding on negotiated responses by @​arhxam in #​5137

Full Changelog: honojs/hono@v4.12.34...v4.13.0

Thank you to all contributors!

v4.12.34

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	hono@​4.12.33 ⏵ 4.13.7		+5	+1

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud