TL;DR

Hono now includes critical security fixes addressing potential vulnerabilities in routing, IP restriction, cookie handling, and JWT authentication. Upgrade is highly recommended, especially if using these features.

Breaking

• Routing: app.mount() now correctly handles percent-encoded paths, preventing incorrect routing.
• IP Restriction: IP address comparisons are stricter, blocking non-canonical IPv6 addresses.
• Cookies: The hono/cookie helper now sanitizes sameSite and priority attributes to prevent header injection.
• JWT: JWT middleware now only accepts Bearer authorization schemes.

New

• Compression: Added support for msgpack as a compressible content type and a customizable content type filter.
• Context: The Context class is now publicly exported, allowing direct access (advanced users).

Fixes Worth Knowing

• File paths with backslashes in serve-static are now normalized.
• MIME type charset parameters are now specified correctly.
• WebSocket subprotocols are echoed correctly in Deno.
• Mounted routes now preserve their base path.
• JSX children types are widened for broader compatibility.

TL;DR

Hono now supports first-party session management, improving security and simplifying user authentication.

New

• First-Party Sessions: Implement secure, cookie-based sessions without external dependencies (session management).
• Context.exec(): Allows middleware to short-circuit request processing (request handling).

Fixes Worth Knowing

• Fixed an issue where next() wasn’t correctly called in middleware, leading to unexpected behavior.
• Resolved a bug causing incorrect content type detection for streamed responses (HTTP responses).

Package: Hono Release:

--- v4.5.0-rc.1 (2024-06-28) --- v4.5.0-rc.1 This is a pre-release.

Breaking

• Context.render() now requires a Content-Type header to be set explicitly (HTTP responses).

New

• Context.exec(): Allows middleware to short-circuit request processing (request handling).

Fixes Worth Knowing

• Fixed an issue where next() wasn’t correctly called in middleware, leading to unexpected behavior.
• Resolved a bug causing incorrect content type detection for streamed responses (HTTP responses).

TL;DR

Hono’s type inference for route parameters (routing definitions) is now more accurate, improving developer experience when working with dynamic routes.

Fixes Worth Knowing

• Resolved an issue where routes with the same parameter name could fail to match correctly (trie-router).
• Fixed a circular dependency in the HTML rendering module, preventing potential errors.
• Improved type definitions to correctly infer parameter types in MergeSchemaPath (type definitions).

TL;DR

Hono now supports request/response transformers (functions to modify data) allowing for middleware-like behavior without full middleware overhead.

New

• Request/Response Transformers: Implement data manipulation logic directly within routes, offering a lightweight alternative to traditional middleware.

TL;DR

Hono now supports first-party authorization using JSON Web Tokens (JWTs), simplifying secure API development.

New

• Added JWT authorization middleware for simplified API security.
• Implemented Context.get and Context.set methods for managing request-specific data (key-value store).

Fixes Worth Knowing

• Resolved an issue where middleware execution order was incorrect when using before hooks.
• Fixed a bug causing incorrect content type detection for streamed responses.

Package: Hono Release:

--- vv3.5.0 (2023-08-22) --- v3.5.0 This is a stable release!

Breaking

• Removed the NextMiddleware type; use Middleware instead (function type).

New

• Added support for custom error handling via the onError hook.

Fixes Worth Knowing

• Corrected handling of query parameters in nested routes.
• Improved performance of route matching.

Before You Upgrade

• Update any code using NextMiddleware to use the Middleware function type instead.

Package: Hono Release:

--- vv3.5.1 (2023-08-23) --- v3.5.1

Fixes Worth Knowing

• Fixed a regression where streamed responses were not being correctly handled in some environments.
• Resolved an issue where the onError hook was not being called for certain types of errors.

TL;DR

Hono now correctly handles errors within sub-routes (nested apps) using the parent app’s error handler, improving error management in complex applications.

Fixes Worth Knowing

• c.req.header() now correctly returns undefined when a header is not present, preventing potential type errors.
• Static file serving (Serve Static Middleware) now correctly handles URL-encoded paths and avoids 404 errors in some cases.
• Additional mime types have been added for broader file support.

Before You Upgrade

If you rely on the return type of c.req.header(), update your code to handle potential undefined values.

TL;DR

Deno users must update how they start their Hono (web framework) applications, replacing app.fire() with serve((req) => app.fetch(req)).

Breaking

• app.fire() (Deno startup method) is removed; use serve((req) => app.fetch(req)) instead.

New

• Deno: All middleware functions are now exported, increasing flexibility.

TL;DR

Hono now includes built-in GraphQL server middleware and improved notFound handling, simplifying API development with this fast web framework (Node.js).

New

• GraphQL Server middleware is now available for easily creating GraphQL endpoints.
• notFound handler now supports async/await for more flexible error handling.

Fixes Worth Knowing

• GraphQL middleware now correctly throws error messages, improving debugging.
• JSON responses can now be pretty-printed for easier readability.

Before You Upgrade

Review the updated middleware documentation to take advantage of the new GraphQL features.