honojs/hono
 Watch   
 Star   
 Fork   
简介统计版本
2 hours ago
hono
honojs

v4.11.4

Security

Fixed a JWT algorithm confusion issue in the JWT and JWK/JWKS middleware.

Both middlewares now require an explicit algorithm configuration to prevent the verification algorithm from being influenced by untrusted JWT header values.

If you are using the JWT or JWK/JWKS middleware, please update to the latest version as soon as possible.

JWT middleware

import { jwt } from 'hono/jwt'

app.use(
  '/auth/*',
  jwt({
    secret: 'it-is-very-secret',
    alg: 'HS256', // required
  })
)

JWK/JWKS middleware

import { jwk } from 'hono/jwk'

app.use(
  '/auth/*',
  jwk({
    jwks_uri: 'https://example.com/.well-known/jwks.json',
    alg: ['RS256'], // required (asymmetric algorithms only)
  })
)

For more details, see the Security Advisory.

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.11.3...v4.11.4

17 days ago
hono
honojs

v4.11.3

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.11.2...v4.11.3

18 days ago
hono
honojs

v4.11.2

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.11.1...v4.11.2

29 days ago
hono
honojs

v4.11.1

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.11.0...v4.11.1

2025-12-13 17:29:39
hono
honojs

v4.11.0

Release Notes

Hono v4.11.0 is now available!

This release includes new features for the Hono client, middleware improvements, and an important type system fix.

Type System Fix for Middleware

We've fixed a bug in the type system for middleware. Previously, app did not have the correct type with pathless handlers:

const app = new Hono()
  .use(async (c, next) => {
    await next()
  })
  .get('/a', async (c, next) => {
    await next()
  })
  .get((c) => {
    return c.text('Hello')
  })

// app's type was incorrect

This has now been fixed.

Thanks @kosei28!

Typed URL for Hono Client

You can now pass the base URL as the second type parameter to hc to get more precise URL types:

const client = hc<typeof app, 'http://localhost:8787'>(
  'http://localhost:8787/'
)

const url = client.api.posts.$url()
// url is TypedURL with precise type information
// including protocol, host, and path

This is useful when you want to use the URL as a type-safe key for libraries like SWR.

Thanks @miyaji255!

Custom NotFoundResponse Type

You can now customize the NotFoundResponse type using module augmentation. This allows c.notFound() to return a typed response:

import { Hono, TypedResponse } from 'hono'

declare module 'hono' {
  interface NotFoundResponse
    extends Response,
      TypedResponse<{ error: string }, 404, 'json'> {}
}

const app = new Hono()
  .get('/posts/:id', async (c) => {
    const post = await getPost(c.req.param('id'))
    if (!post) {
      return c.notFound()
    }
    return c.json({ post }, 200)
  })
  .notFound((c) => c.json({ error: 'not found' }, 404))

Now the client can correctly infer the 404 response type.

Thanks @miyaji255!

tryGetContext Helper

The new tryGetContext() helper in the Context Storage middleware returns undefined instead of throwing an error when the context is not available:

import { tryGetContext } from 'hono/context-storage'

const context = tryGetContext<Env>()
if (context) {
  // Context is available
  console.log(context.var.message)
}

Thanks @AyushCoder9!

Custom Query Serializer

You can now customize how query parameters are serialized using the buildSearchParams option:

const client = hc<AppType>('http://localhost', {
  buildSearchParams: (query) => {
    const searchParams = new URLSearchParams()
    for (const [k, v] of Object.entries(query)) {
      if (v === undefined) continue
      if (Array.isArray(v)) {
        v.forEach((item) => searchParams.append(`${k}[]`, item))
      } else {
        searchParams.set(k, v)
      }
    }
    return searchParams
  },
})

Thanks @bolasblack!

New features

All changes

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.8...v4.11.0

2025-12-09 16:26:34
hono
honojs

v4.10.8

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.7...v4.10.8

2025-11-26 19:40:12
hono
honojs

v4.10.7

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.6...v4.10.7

2025-11-14 22:33:02
hono
honojs

v4.10.6

Deperecated

bearer-auth options

The following options are deprecated and will be removed in a future version:

  • noAuthenticationHeaderMessage => use noAuthenticationHeader.message
  • invalidAuthenticationHeaderMessage => use invalidAuthenticationHeader.message
  • invalidTokenMessage => use invalidToken.message

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.5...v4.10.6

2025-11-11 20:13:44
hono
honojs

v4.10.5

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.4...v4.10.5

2025-10-30 09:19:58
hono
honojs

v4.10.4

What's Changed

New Contributors

Full Changelog: https://github.com/honojs/hono/compare/v4.10.3...v4.10.4