jonathan/hostr

Watch

Fork 0

Update dependency hono to v4.13.0 #162

Merged

jonathan merged 1 commit from renovate/hono-4.x-lockfile into main

2026-08-11 06:05:20 +00:00

renovatebot commented

2026-08-11 00:08:24 +00:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change	Pending
hono (source)	dependencies	minor	`4.12.34` → `4.13.0`	`4.13.1`

Release Notes

honojs/hono (hono)

`v4.13.0`

Compare Source

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
`ping` — `GET /`	165.83 ns	163.99 ns	1.01x
`query` — `GET /id/1?name=bun`	674.40 ns	616.99 ns	1.09x
`json` — `GET /user`	528.99 ns	422.44 ns	1.25x
`body` — `POST /json`	1.16 µs	1.00 µs	1.15x

The individual changes:

perf(context): iterate the header record with for..in #5118
perf(url): replace regex tests with indexOf #5121
perf(context): skip Headers creation when there are no headers to merge #5122
perf(urls): refactor tryDecodeURIComponent #5158
perf(request): allocate #validatedData lazily #5175
perf(request): probe the body cache without allocating #5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

Thanks @shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @usualoma and @Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'

const app = new Hono()

app.use(methodNotAllowed({ app }))

app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))

// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
  methodNotAllowed({
    app,
    onMethodNotAllowed: (c, methods) =>
      c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
  })
)

Thanks @usualoma!

RegExpRouter throws `UnsupportedPathError` at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @usualoma!

Other improvements

hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @akahoshi1421!
The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @arhxam!
JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @ashunar0!
JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @natsuki-engr!
The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @arhxam!

All changes

perf(hono-base): avoid rest parameter in fetch by @yusukebe in #5113
perf(context): iterate the header record with for..in by @yusukebe in #5118
perf(url/request): replace regex tests with indexOf by @yusukebe in #5121
perf(context): skip Headers creation when there are no headers to merge by @yusukebe in #5122
perf(urls): refactor tryDecodeURIComponent by @yusukebe in #5158
chore(benchmarks): correct src path on Windows, add json and middleware cases by @kibertoad in #5173
perf(context): drop the throwaway env field initializer by @kibertoad in #5174
perf(request): allocate #validatedData lazily by @kibertoad in #5175
perf(request): probe the body cache without allocating by @kibertoad in #5176
chore(benchmarks): stabilize measurements by forcing mitata batching by @yusukebe in #5183
perf(hono-base): restore the rest parameter in fetch by @yusukebe in #5184
perf(context): restore the env field initializer by @yusukebe in #5186
feat: add first-class QUERY method support by @shellhaki in #5070
feat(etag): support conditional requests for the QUERY method by @Cherry in #5111
feat(cors): allow QUERY by default as a first-class method by @usualoma in #5115
feat(cache): add first-class support for QUERY requests by @usualoma in #5119
feat(jsx): add React-compatible overloads to useRef by @ashunar0 in #5063
feat(middleware): add method-not-allowed middleware by @usualoma in #5132
feat(jwt,jwk): add a configurable WWW-Authenticate realm by @arhxam in #5141
feat(utils/headers): sync HTTP field types with the IANA registry by @akahoshi1421 in #5153
fix(jsx): allow a function component to return an array by @natsuki-engr in #5179
feat(reg-exp-router): throw UnsupportedPathError during route registration by @usualoma in #5171
fix(compress): set Vary: Accept-Encoding on negotiated responses by @arhxam in #5137

Full Changelog: https://github.com/honojs/hono/compare/v4.12.34...v4.13.0

Thank you to all contributors!

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [hono](https://hono.dev) ([source](https://github.com/honojs/hono)) | dependencies | minor | [`4.12.34` → `4.13.0`](https://renovatebot.com/diffs/npm/hono/4.12.34/4.13.0) | `4.13.1` | --- ### Release Notes <details> <summary>honojs/hono (hono)</summary> ### [`v4.13.0`](https://github.com/honojs/hono/releases/tag/v4.13.0) [Compare Source](https://github.com/honojs/hono/compare/v4.12.34...v4.13.0) Hono v4.13.0 is now available! The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in [RFC 10008](https://www.rfc-editor.org/rfc/rfc10008.html), a new Method Not Allowed middleware, and more. #### Performance improvements This release includes a series of small optimizations: skipping unnecessary `Headers` allocations, replacing regex tests with `indexOf`, allocating internal state lazily, and more. Here is [`benchmarks/fetch`](https://github.com/honojs/hono/tree/main/benchmarks/fetch) comparing v4.12 and v4.13 (`ROUNDS=5 ./compare.sh`, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias): | Benchmark | v4.12 | v4.13 | Speedup | | ------------------------------ | --------: | --------: | --------: | | `ping` — `GET /` | 165.83 ns | 163.99 ns | 1.01x | | `query` — `GET /id/1?name=bun` | 674.40 ns | 616.99 ns | **1.09x** | | `json` — `GET /user` | 528.99 ns | 422.44 ns | **1.25x** | | `body` — `POST /json` | 1.16 µs | 1.00 µs | **1.15x** | The individual changes: - perf(context): iterate the header record with `for..in` [#5118](https://github.com/honojs/hono/pull/5118) - perf(url): replace regex tests with `indexOf` [#5121](https://github.com/honojs/hono/pull/5121) - perf(context): skip `Headers` creation when there are no headers to merge [#5122](https://github.com/honojs/hono/pull/5122) - perf(urls): refactor `tryDecodeURIComponent` [#5158](https://github.com/honojs/hono/pull/5158) - perf(request): allocate `#validatedData` lazily [#5175](https://github.com/honojs/hono/pull/5175) - perf(request): probe the body cache without allocating [#5176](https://github.com/honojs/hono/pull/5176) In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster. Thanks [@kibertoad](https://github.com/kibertoad) for the contributions! #### First-class QUERY method support The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with `app.query()`: ```ts const app = new Hono() app.query('/search', async (c) => { const conditions = await c.req.json() return c.json(await search(conditions)) }) ``` Thanks [@shellhaki](https://github.com/shellhaki)! #### QUERY support across built-in middleware The built-in middleware has been updated to handle QUERY requests properly: ##### Cache Middleware The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately: ```ts app.query( '/search', cache({ cacheName: 'search-cache', cacheControl: 'max-age=3600', }) ) ``` **Note**: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form `/.hono/cache?__hono_cache_key=...`. If you purge cache entries by URL outside of the middleware (e.g. calling `caches.delete()` with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched. ##### ETag Middleware The ETag Middleware now handles conditional requests for QUERY, returning `304 Not Modified` when `If-None-Match` matches. ##### CORS Middleware The CORS Middleware now includes QUERY in the default `Access-Control-Allow-Methods`, which is now `GET, HEAD, PUT, POST, DELETE, PATCH, QUERY`. If you specify `allowMethods` explicitly, nothing changes for you. Thanks [@usualoma](https://github.com/usualoma) and [@Cherry](https://github.com/Cherry)! #### Method Not Allowed Middleware The new Method Not Allowed Middleware returns a `405 Method Not Allowed` response with a proper `Allow` header when the request path matches a registered route but the method does not: ```ts import { methodNotAllowed } from 'hono/method-not-allowed' const app = new Hono() app.use(methodNotAllowed({ app })) app.get('/hello', (c) => c.text('Hello!')) app.post('/hello', (c) => c.text('Posted!')) // PUT /hello -> 405 Method Not Allowed // Allow: GET, HEAD, POST ``` You can customize the response with the `onMethodNotAllowed` option: ```ts app.use( methodNotAllowed({ app, onMethodNotAllowed: (c, methods) => c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }), }) ) ``` Thanks [@usualoma](https://github.com/usualoma)! #### RegExpRouter throws `UnsupportedPathError` at registration time The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster. Thanks [@usualoma](https://github.com/usualoma)! #### Other improvements - `hono/utils/headers` has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as `Accept-Query`. Thanks [@akahoshi1421](https://github.com/akahoshi1421)! - The JWT and JWK middleware now accept a `realm` option for the `WWW-Authenticate` challenge on `401` responses, and challenge values are properly escaped. Thanks [@arhxam](https://github.com/arhxam)! - JSX: `useRef` and `RefObject` are now aligned with React 19. Note that this is a type-level change — `RefObject<T>` is now `{ current: T }`, so type a nullable ref as `RefObject<T | null>`, and pass `useRef(undefined)` instead of `useRef()`. Thanks [@ashunar0](https://github.com/ashunar0)! - JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks [@natsuki-engr](https://github.com/natsuki-engr)! - The Compress Middleware now sets `Vary: Accept-Encoding` on negotiated responses. Thanks [@arhxam](https://github.com/arhxam)! #### All changes - perf(hono-base): avoid rest parameter in `fetch` by [@yusukebe](https://github.com/yusukebe) in [#5113](https://github.com/honojs/hono/pull/5113) - perf(context): iterate the header record with for..in by [@yusukebe](https://github.com/yusukebe) in [#5118](https://github.com/honojs/hono/pull/5118) - perf(url/request): replace regex tests with `indexOf` by [@yusukebe](https://github.com/yusukebe) in [#5121](https://github.com/honojs/hono/pull/5121) - perf(context): skip Headers creation when there are no headers to merge by [@yusukebe](https://github.com/yusukebe) in [#5122](https://github.com/honojs/hono/pull/5122) - perf(urls): refactor `tryDecodeURIComponent` by [@yusukebe](https://github.com/yusukebe) in [#5158](https://github.com/honojs/hono/pull/5158) - chore(benchmarks): correct src path on Windows, add json and middleware cases by [@kibertoad](https://github.com/kibertoad) in [#5173](https://github.com/honojs/hono/pull/5173) - perf(context): drop the throwaway `env` field initializer by [@kibertoad](https://github.com/kibertoad) in [#5174](https://github.com/honojs/hono/pull/5174) - perf(request): allocate `#validatedData` lazily by [@kibertoad](https://github.com/kibertoad) in [#5175](https://github.com/honojs/hono/pull/5175) - perf(request): probe the body cache without allocating by [@kibertoad](https://github.com/kibertoad) in [#5176](https://github.com/honojs/hono/pull/5176) - chore(benchmarks): stabilize measurements by forcing mitata batching by [@yusukebe](https://github.com/yusukebe) in [#5183](https://github.com/honojs/hono/pull/5183) - perf(hono-base): restore the rest parameter in `fetch` by [@yusukebe](https://github.com/yusukebe) in [#5184](https://github.com/honojs/hono/pull/5184) - perf(context): restore the `env` field initializer by [@yusukebe](https://github.com/yusukebe) in [#5186](https://github.com/honojs/hono/pull/5186) - feat: add first-class QUERY method support by [@shellhaki](https://github.com/shellhaki) in [#5070](https://github.com/honojs/hono/pull/5070) - feat(etag): support conditional requests for the QUERY method by [@Cherry](https://github.com/Cherry) in [#5111](https://github.com/honojs/hono/pull/5111) - feat(cors): allow QUERY by default as a first-class method by [@usualoma](https://github.com/usualoma) in [#5115](https://github.com/honojs/hono/pull/5115) - feat(cache): add first-class support for QUERY requests by [@usualoma](https://github.com/usualoma) in [#5119](https://github.com/honojs/hono/pull/5119) - feat(jsx): add React-compatible overloads to useRef by [@ashunar0](https://github.com/ashunar0) in [#5063](https://github.com/honojs/hono/pull/5063) - feat(middleware): add method-not-allowed middleware by [@usualoma](https://github.com/usualoma) in [#5132](https://github.com/honojs/hono/pull/5132) - feat(jwt,jwk): add a configurable WWW-Authenticate realm by [@arhxam](https://github.com/arhxam) in [#5141](https://github.com/honojs/hono/pull/5141) - feat(utils/headers): sync HTTP field types with the IANA registry by [@akahoshi1421](https://github.com/akahoshi1421) in [#5153](https://github.com/honojs/hono/pull/5153) - fix(jsx): allow a function component to return an array by [@natsuki-engr](https://github.com/natsuki-engr) in [#5179](https://github.com/honojs/hono/pull/5179) - feat(reg-exp-router): throw UnsupportedPathError during route registration by [@usualoma](https://github.com/usualoma) in [#5171](https://github.com/honojs/hono/pull/5171) - fix(compress): set Vary: Accept-Encoding on negotiated responses by [@arhxam](https://github.com/arhxam) in [#5137](https://github.com/honojs/hono/pull/5137) **Full Changelog**: <https://github.com/honojs/hono/compare/v4.12.34...v4.13.0> Thank you to all contributors! </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovatebot added 1 commit

2026-08-11 00:08:24 +00:00

Update dependency hono to v4.13.0

renovate/stability-days Updates have met minimum release age requirement

Details

ci / build-image (pull_request) Successful in 7m39s

Details

ci / test-image (pull_request) Successful in 13s

Details

94e5996ac7

jonathan merged commit 5c62c20ba1 into main

2026-08-11 06:05:20 +00:00

No reviewers

No labels

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jonathan/hostr!162

No description provided.

Rows
Columns

Update dependency hono to v4.13.0 #162

Release Notes

v4.13.0

Performance improvements

First-class QUERY method support

QUERY support across built-in middleware

Cache Middleware

ETag Middleware

CORS Middleware

Method Not Allowed Middleware

RegExpRouter throws UnsupportedPathError at registration time

Other improvements

All changes

Configuration

`v4.13.0`

RegExpRouter throws `UnsupportedPathError` at registration time