# What changed in hono

> 296 changes in hono 4 from its official release notes, upgrade guides and advisories: 20 breaking, 6 deprecations, 65 security, 45 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/hono/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## hono 4

### Breaking changes

- Rejects request paths that still contain % after decoding, preventing crafted paths from bypassing middleware mounted on a static prefix. (4.13.11) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.11)
- An invalid base64url signature now throws JwtTokenInvalid. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- An empty path segment is no longer matched as a parameter. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- The Cache Middleware caches QUERY responses using a SHA-256 digest of request content and representation metadata; its internal cache key URL format changes for all methods, so external cache-purge logic may need updating. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- RefObject<T> is now { current: T }; type nullable refs as RefObject<T | null> and pass useRef(undefined) instead of useRef(). (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- RegExpRouter detects unsupported path combinations during route registration, so misconfigured routes fail at startup instead of on the first matching request. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- 206 Partial Content responses are no longer compressed. (4.12.30) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.30)
- Any non-identity content encoding is treated as binary. (4.12.29) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.29)
- A single 0 group is no longer compressed to ::. (4.12.23) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.23)
- JWT authentication now validates the Authorization scheme and accepts only Bearer rather than any two-part header value. (4.12.21) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.21), [security advisory](https://github.com/advisories/GHSA-F577-QRJJ-4474)
- JWT verify() now rejects falsy, non-finite, or non-numeric exp, nbf, and iat claims instead of allowing them to bypass time-based checks. (4.12.18) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.18), [security advisory](https://github.com/advisories/GHSA-HM8Q-7F3Q-5F36)
- decode now validates token format. (4.12.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.5)
- decodeHeader now validates token format. (4.12.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.5)
- Rejects `;`, `\r`, and `\n` in domain and path options to prevent cookie attribute manipulation. (4.12.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.4), [security advisory](https://github.com/advisories/GHSA-5PQ2-9X2X-5P6W)
- Rejects CR/LF characters in event, id, and retry to prevent injection of unintended SSE fields. (4.12.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.4), [security advisory](https://github.com/advisories/GHSA-P6XX-57QC-3WXR)
- JWK/JWKS middleware now requires an explicit algorithm configuration, preventing untrusted JWT header values from influencing verification. (4.11.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.4)
- JWT middleware now requires an explicit algorithm configuration, preventing untrusted JWT header values from influencing verification. (4.11.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.4)
- Replaces schema-based path tracking with the `CurrentPath` parameter. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- Deletes the NotSpecified type. (4.10.7) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.7)
- Deletes the StrictVerifyOptions type. (4.10.7) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.7)

### Security

- Plain strings used as children or fallbacks in boundary components, or as root values in server rendering functions, are now HTML-escaped to prevent untrusted strings from being emitted as markup. (4.13.7) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.7), [security advisory](https://github.com/advisories/GHSA-HXH3-VQPV-XPQV)
- hono/jsx renders plain strings unescaped in boundary components, leading to XSS (4.13.7) — [security advisory](https://github.com/advisories/GHSA-HXH3-VQPV-XPQV)
- Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory (4.13.5) — [security advisory](https://github.com/advisories/GHSA-GQVV-2MRQ-WPJV)
- Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials (4.13.5) — [security advisory](https://github.com/advisories/GHSA-CRVJ-82CR-HJCX), [release notes](https://github.com/honojs/hono/releases/tag/v4.13.5)
- Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion (4.13.5) — [security advisory](https://github.com/advisories/GHSA-G6GW-C38X-MQFC), [release notes](https://github.com/honojs/hono/releases/tag/v4.13.5)
- Hono: Algorithmic Complexity DoS in Language Middleware (4.12.34) — [security advisory](https://github.com/advisories/GHSA-54FX-42GC-7VW4), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.34)
- Fixes quadratic backtracking when parsing Access-Control-Request-Headers if allowHeaders is not configured, preventing long whitespace runs from stalling request processing. (4.12.34) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.34), [security advisory](https://github.com/advisories/GHSA-8J4G-W8FX-2239)
- Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure (4.12.34) — [security advisory](https://github.com/advisories/GHSA-F23P-VX2J-J53R), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.34)
- Hono: Proxy Helper does not remove response headers listed in the `Connection` header (4.12.34) — [security advisory](https://github.com/advisories/GHSA-79QM-7RJ5-M7R9), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.34)
- Hono: ReDoS in CORS middleware via Access-Control-Request-Headers (4.12.34) — [security advisory](https://github.com/advisories/GHSA-8J4G-W8FX-2239)
- These values are parsed using Object.create(null). (4.12.32) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.32)
- Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication (4.12.27) — [security advisory](https://github.com/advisories/GHSA-XGM2-5F3F-MVVC)
- hono/jsx does not isolate context per request, leading to cross-request data disclosure (4.12.27) — [security advisory](https://github.com/advisories/GHSA-HVRM-45R6-MJFJ)
- Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility (4.12.27) — [security advisory](https://github.com/advisories/GHSA-W62V-XXXG-MG59), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.27)
- The API Gateway v1 and VPC Lattice adapters no longer drop a repeated header value merely because it is a substring of another value. (4.12.27) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.27), [security advisory](https://github.com/advisories/GHSA-XGM2-5F3F-MVVC)
- During SSR, context is isolated per request, so useContext() and useRequestContext() after an await in an async component no longer read another concurrent request's value. (4.12.27) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.27), [security advisory](https://github.com/advisories/GHSA-HVRM-45R6-MJFJ)
- hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice (4.12.25) — [security advisory](https://github.com/advisories/GHSA-J6C9-X7QJ-28XF), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.25)
- hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` (4.12.25) — [security advisory](https://github.com/advisories/GHSA-RV63-4MWF-QQC2), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.25)
- hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard (4.12.25) — [security advisory](https://github.com/advisories/GHSA-88FW-HQM2-52QC)
- Fixes wildcard origin reflection with credentials enabled and no explicit origin, preventing credentialed cross-origin requests from reading cookie-authenticated responses. (4.12.25) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.25), [security advisory](https://github.com/advisories/GHSA-88FW-HQM2-52QC)
- hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest (4.12.25) — [security advisory](https://github.com/advisories/GHSA-WGPF-JWQJ-8H8P)
- Fixes repeated request headers being overwritten so all values, such as those in X-Forwarded-For, reach the application. (4.12.25) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.25), [security advisory](https://github.com/advisories/GHSA-WGPF-JWQJ-8H8P)
- hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) (4.12.25) — [security advisory](https://github.com/advisories/GHSA-WWFH-H76J-FC44), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.25)
- Mount-prefix stripping now uses the raw URL pathname, preventing percent-encoded paths from being routed incorrectly to the sub-application. (4.12.21) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.21), [security advisory](https://github.com/advisories/GHSA-2GCR-MFCQ-WCC3)
- Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths (4.12.21) — [security advisory](https://github.com/advisories/GHSA-2GCR-MFCQ-WCC3)
- Cookie helper validates sameSite and priority options against injection characters, preventing user-controlled values from injecting attributes into Set-Cookie headers. (4.12.21) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.21), [security advisory](https://github.com/advisories/GHSA-3HRH-PFW6-9M5X)
- Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection (4.12.21) — [security advisory](https://github.com/advisories/GHSA-3HRH-PFW6-9M5X)
- Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 (4.12.21) — [security advisory](https://github.com/advisories/GHSA-XRHX-7G5J-RCJ5), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.21)
- Hono: JWT middleware accepts any Authorization scheme, not only Bearer (4.12.21) — [security advisory](https://github.com/advisories/GHSA-F577-QRJJ-4474)
- Hono has CSS Declaration Injection via Style Object Values in JSX SSR (4.12.18) — [security advisory](https://github.com/advisories/GHSA-QP7P-654G-CW7P), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.18)
- Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() (4.12.18) — [security advisory](https://github.com/advisories/GHSA-HM8Q-7F3Q-5F36)
- Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage (4.12.18) — [security advisory](https://github.com/advisories/GHSA-P77W-8QQV-26RM), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.18)
- Enforces body limits for requests without a reliable Content-Length before oversized requests can reach handlers and return successful responses. (4.12.16) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.16), [security advisory](https://github.com/advisories/GHSA-9VQF-7F2P-GF9V)
- Validates JSX tag names to prevent HTML injection when untrusted input is used as the tag name. (4.12.16) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.16), [security advisory](https://github.com/advisories/GHSA-69XW-7HCM-H432)
- Hono: bodyLimit() can be bypassed for chunked / unknown-length requests (4.12.16) — [security advisory](https://github.com/advisories/GHSA-9VQF-7F2P-GF9V)
- hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR (4.12.14) — [security advisory](https://github.com/advisories/GHSA-458J-XX4X-4375)
- JSX attribute names are validated during server-side rendering to prevent malformed keys from corrupting generated HTML or injecting unintended attributes or elements. (4.12.14) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.14), [security advisory](https://github.com/advisories/GHSA-458J-XX4X-4375)
- Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses (4.12.12) — [security advisory](https://github.com/advisories/GHSA-XPCF-PG52-R92G), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.12)
- Hono: Middleware bypass via repeated slashes in serveStatic (4.12.12) — [security advisory](https://github.com/advisories/GHSA-WMMM-F939-6G9C), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.12)
- Hono missing validation of cookie name on write path in setCookie() (4.12.12) — [security advisory](https://github.com/advisories/GHSA-26PP-8WGV-HJVM), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.12)
- Hono: Non-breaking space prefix bypass in cookie name handling in getCookie() (4.12.12) — [security advisory](https://github.com/advisories/GHSA-R5RP-J6WH-RVV4), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.12)
- Hono: Path traversal in toSSG() allows writing files outside the output directory (4.12.12) — [security advisory](https://github.com/advisories/GHSA-XF4J-XP2R-RQQX), [release notes](https://github.com/honojs/hono/releases/tag/v4.13.5), [release notes](https://github.com/honojs/hono/releases/tag/v4.12.12), [security advisory](https://github.com/advisories/GHSA-GQVV-2MRQ-WPJV)
- Regex metacharacters in the bearer auth prefix option are escaped. (4.12.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.8)
- Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true }) (4.12.7) — [security advisory](https://github.com/advisories/GHSA-V8W9-8MX6-G223)
- When dot is enabled, parseBody ignores __proto__ path segments to prevent potential prototype pollution when merged with unsafe patterns. (4.12.7) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.7)
- Replaces regex splitting in accept handling to mitigate ReDoS. (4.12.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.6)
- Hono vulnerable to arbitrary file access via serveStatic vulnerability (4.12.4) — [security advisory](https://github.com/advisories/GHSA-Q5QW-H33P-QVWR)
- Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie() (4.12.4) — [security advisory](https://github.com/advisories/GHSA-5PQ2-9X2X-5P6W)
- Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE() (4.12.4) — [security advisory](https://github.com/advisories/GHSA-P6XX-57QC-3WXR)
- Fixes inconsistent URL decoding that could let protected static resources bypass route-based middleware. (4.12.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.4), [security advisory](https://github.com/advisories/GHSA-Q5QW-H33P-QVWR)
- Uses Math.floor instead of bitwise OR for a safe timestamp. (4.12.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.3)
- Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo (4.12.2) — [security advisory](https://github.com/advisories/GHSA-XH87-MX6M-69F3)
- Fixed incorrect handling of X-Forwarded-For in the AWS Lambda adapter behind ALB to prevent IP-based access control bypass. (4.12.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.2), [security advisory](https://github.com/advisories/GHSA-XH87-MX6M-69F3)
- Hono added timing comparison hardening in basicAuth and bearerAuth (4.11.10) — [security advisory](https://github.com/advisories/GHSA-GQ3J-XVXP-8HRF), [release notes](https://github.com/honojs/hono/releases/tag/v4.11.10)
- Fixed a reflected XSS issue that could occur when untrusted strings were rendered without proper escaping. (4.11.7) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.7)
- Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception (4.11.7) — [security advisory](https://github.com/advisories/GHSA-6WQW-2P9W-4VW4), [release notes](https://github.com/honojs/hono/releases/tag/v4.11.7)
- Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) (4.11.7) — [security advisory](https://github.com/advisories/GHSA-W332-Q679-J88P), [release notes](https://github.com/honojs/hono/releases/tag/v4.11.7)
- Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing (4.11.7) — [security advisory](https://github.com/advisories/GHSA-R354-F388-2FHH), [release notes](https://github.com/honojs/hono/releases/tag/v4.11.7)
- Hono vulnerable to XSS through ErrorBoundary component (4.11.7) — [security advisory](https://github.com/advisories/GHSA-9R54-Q6CX-XMH5)
- Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback) (4.11.4) — [security advisory](https://github.com/advisories/GHSA-3VHC-576X-3QV4)
- Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass (4.11.4) — [security advisory](https://github.com/advisories/GHSA-F67F-6CW9-8MQ4)
- Secure headers now support CSP TrustedTypePolicy. (4.10.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.6)
- Hono vulnerable to Vary Header Injection leading to potential CORS Bypass (4.10.3) — [security advisory](https://github.com/advisories/GHSA-Q7JF-GF43-6X6P), [release notes](https://github.com/honojs/hono/releases/tag/v4.10.3)
- Hono Improper Authorization vulnerability (4.10.2) — [security advisory](https://github.com/advisories/GHSA-M732-5P4W-X69G)
- Adds RFC 7519–compliant audience validation for JWT middleware, allowing applications to reject tokens intended for other audiences. (4.10.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.2)

### Deprecations

- app.mount() still works in v4 but is deprecated and will be removed in v5; use Mount Middleware with app.all() instead. (4.13.13) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.13)
- Adapter imports through hono/<adapter> still work in v4 but are deprecated and will be removed in v5; migrate imports to the separate adapter packages. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- Deprecated; use invalidAuthenticationHeader.message instead. (4.10.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.6)
- Deprecated; use invalidToken.message instead. (4.10.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.6)
- Deprecated; use noAuthenticationHeader.message instead. (4.10.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.6)

### New APIs and options

- Mount Middleware is available from hono/mount as a handler that can be registered with app.all(). (4.13.13) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.13)
- Set allowPercentInPath to true to serve files whose names contain a literal %. (4.13.11) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.11)
- The AWS Lambda runtime adapter is published as its own package. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- The Bun runtime adapter is published as its own package, so imports can use @hono/bun. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- The Cloudflare Workers runtime adapter is published as its own package. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- The Deno runtime adapter is published as its own package and is also available on JSR. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- The Lambda@Edge runtime adapter is published as its own package. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- The Netlify runtime adapter is published as its own package. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- The service-worker runtime adapter is published as its own package. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- The Vercel runtime adapter is published as its own package. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- The WebSocket client supports custom buildSearchParams and filters undefined query values. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Adds first-class support for defining handlers for the HTTP QUERY method. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- Adds middleware that returns 405 with an Allow header when a path matches a registered route but the request method does not. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- Lets you customize the response produced by the Method Not Allowed Middleware. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- The JWT and JWK middleware accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- Adds JWT and Lambda authorizer types for API Gateway v2. (4.12.32) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.32)
- COMPRESSIBLE_CONTENT_TYPE_REGEX is now re-exported. (4.12.23) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.23)
- The compress middleware adds a contentTypeFilter option. (4.12.23) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.23)
- The Context class is now publicly exported. (4.12.23) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.23)
- A new bytes() method is available on requests. (4.12.19) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.19)
- Adds the `onCacheNotAvailable` option to cache handling. (4.12.13) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.13)
- Adds the `skip` option to trailing-slash handling. (4.12.13) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.13)
- Adds the classNameSlug option to createCssContext. (4.12.11) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.11)
- Adds the PickResponseByStatusCode type to the client API. (4.12.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.9)
- Supports providing jsxRenderer options as a function. (4.12.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.6)
- This type helper adds global error response types to all routes in the RPC client. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- The ExecutionContext type includes an exports property for Cloudflare Workers, which can be typed through module augmentation with Wrangler's generated types. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- getConnInfo() is now available in the AWS Lambda, Cloudflare Pages, and Netlify adapters. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- Basic Auth accepts a callback invoked after successful authentication, allowing context variables or logging without re-parsing the Authorization header; async callbacks and verifyUser mode are supported. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- The Hono client adds $path(), which returns a path string with optional path and query parameters instead of a full URL. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- The SSG plugin generates static HTML redirect pages for HTTP redirect responses, including a refresh tag, canonical link, and robots noindex tag. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- When enabled, the middleware redirects before executing handlers, allowing trailing slash handling to work with wildcard routes. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- getBunServer is now exported for Bun users. (4.11.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.6)
- AlgorithmTypes is exported for use by developers. (4.11.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.5)
- The Hono client option customizes how query parameters are serialized. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- Module augmentation can customize the `NotFoundResponse` type so `c.notFound()` returns a typed response and the client can infer its 404 response type. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- The pretty-json middleware supports a `force` option. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- Secure Headers adds support for the CSP `report-to` directive. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- Secure Headers adds support for the CSP `report-uri` directive. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- The Context Storage middleware helper returns `undefined` instead of throwing an error when the context is not available. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- Hono client `$url()` now returns the exact URL type, including protocol, host, and path, when the base URL is supplied as the second type parameter to `hc`. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- Adds `wrapTime` to simplify usage. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- AWS Lambda handling now supports AWS Lattice events. (4.10.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.6)
- Adds a utility to clone the raw Request object after it has been consumed by validators or middleware. (4.10.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.0)
- Adds a default SSG plugin that defines the recommended behavior. (4.10.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.0)

### Performance

- Reduces lookup work for large keyed updates and optimizes matching-head child lookup during reconciliation. (4.13.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.8)
- Static array header options are pre-joined during initialization. (4.13.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.2)
- Low-level optimizations make common routes up to 1.25x faster in the benchmark; route registration plus the first match is roughly 20% faster. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- c.json() now creates the Response directly when there is no custom status, headers, or finalized state, avoiding allocation of a Headers object. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- TrieRouter performance is improved by approximately 1.5x to 2.0x across the listed route benchmarks. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)

### Behavior and default changes

- Media type matching supports wildcards and specificity ordering. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- pretty-json supports structured JSON content types ending in +json. (4.13.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.3)
- Appends Origin to the Vary header on OPTIONS preflight requests. (4.13.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.3)
- The CORS Middleware includes QUERY in the default Access-Control-Allow-Methods list; explicitly configured allowMethods values are unchanged. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- The ETag Middleware handles conditional QUERY requests and returns 304 Not Modified when If-None-Match matches. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- The Compress Middleware sets Vary: Accept-Encoding on negotiated responses. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- Cookie names are validated less strictly when parsing the Cookie header. (4.12.33) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.33)
- Function headers are merged with per-request headers in the client. (4.12.29) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.29)
- Charset parameters are specified per MIME type instead of being mechanically detected. (4.12.22) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.22)
- MessagePack is now a compressible content type. (4.12.22) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.22)
- Widens the children type to Child[] for jsx. (4.12.20) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.20)
- bearerAuth is generic for typed context in verifyToken, allowing token verification to use the context type. (4.12.19) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.19)
- The options parameter is now optional in all adapters, so callers can use serveStatic without passing options. (4.12.19) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.19)
- The origin option is now optional in CORSOptions. (4.12.17) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.17)
- The map now includes atom+xml and rss+xml. (4.12.17) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.17)
- normalizeLanguage uses RFC 4647 Lookup-based progressive truncation, so a locale such as ja-JP can match ja when only the base language is supported. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- IsAllowedOriginHandler can now be asynchronous, allowing origin checks to complete asynchronously. (4.10.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.8)
- IsAllowedSecFetchSiteHandler can now be asynchronous, allowing Sec-Fetch-Site checks to complete asynchronously. (4.10.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.8)

### Fixes and other changes

- JSXNode function component results are now allowed. (4.13.13) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.13)
- Internal types remain private in bundled declarations, avoiding a self-referencing JSX.IntrinsicElements type. (4.13.12) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.12)
- Numeric gridColumnGap values now receive px units. (4.13.12) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.12)
- Numeric gridGap values now receive px units. (4.13.12) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.12)
- Numeric gridRowGap values now receive px units. (4.13.12) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.12)
- The retainedHeader option correctly matches mixed-case header names. (4.13.12) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.12)
- some() now returns a Response when middleware short-circuits. (4.13.12) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.12)
- Types now allow returning a Blob as a response body. (4.13.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.10)
- Binary +xml archive media types are treated as binary. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- Empty query parameters are preserved. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- ErrorBoundary content is replaced across newlines. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- Content type detection is synchronized with aws-lambda. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- Malformed events fail with a descriptive error. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- Media types and language tags are matched case-insensitively. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- Responses with unparseable JSON bodies are no longer broken. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- Suspense content is replaced across newlines. (4.13.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.9)
- Treats the q parameter name as case-insensitive. (4.13.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.8)
- Clamps a negative q value to 0 instead of 1. (4.13.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.8)
- Skips accept entries with quality 0 when matching. (4.13.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.8)
- Respects backpressure when streaming the response body. (4.13.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.8)
- Skips accept entries with quality 0 when matching. (4.13.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.8)
- Keeps the request media type when reusing a cached body. (4.13.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.8)
- Allows symbol keys in get and set fallbacks for Context<any>. (4.13.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.6)
- Keeps a parameter value of "index" in $path(). (4.13.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.6)
- Normalizes root WebSocket URLs. (4.13.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.6)
- Keeps a parameter value of "index" in $url(). (4.13.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.6)
- Abort listeners no longer crash abort(). (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Cached JSON bodies are serialized when cloning a raw request. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Cloned FormData requests drop stale content length. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Undefined header and cookie values are skipped. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Undefined entries inside query arrays are skipped. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Undefined entries inside form arrays are skipped. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- An empty query omits the query delimiter. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- ETag matching accepts optional whitespace before the comma in If-None-Match tags. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Previous ref cleanup executes when the ref prop changes on re-render. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Parameters are handled on unmatched requests. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Signed cookies with empty string values can be parsed. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Wildcard middleware is associated with matching routes. (4.13.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.4)
- Avoids skipping headers when filtering headers for a 304 response. (4.13.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.3)
- Copies pending stream bytes so they are not lost during ETag processing. (4.13.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.3)
- Avoids truncating embedded IPv4 addresses when expanding IPv6 addresses. (4.13.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.3)
- OPTIONS requests are exempt from CSRF validation. (4.13.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.3)
- Prevents URL corruption when replacement values contain $ replacement tokens. (4.13.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.3)
- Trie-router matching now handles suffix wildcard routes. (4.13.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.3)
- Pattern and linear routers no longer overmatch route prefixes when matching wildcard routes. (4.13.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.3)
- Async children of document metadata tags are rendered instead of appearing as [object Promise]. (4.13.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.2)
- Incremental hashing for chunked responses is corrected and digests are stable across stream chunks. (4.13.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.2)
- The client correctly serializes multiple cookies in a request. (4.13.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.2)
- The client sends falsy JSON bodies. (4.13.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.2)
- Trailing question marks are stripped correctly for optional parameters with regex quantifiers. (4.13.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.2)
- Disabled Permissions-Policy directives now output standard empty parentheses instead of none. (4.13.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.2)
- Missing W3C Permissions-Policy directives are now supported. (4.13.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.2)
- ETag handling skips unsafe methods or error responses in the non-* case. (4.13.1) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.1)
- When pipe() throws, the stream utility re-acquires the writer lock. (4.13.1) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.1)
- Trie routing now counts every slash consumed by a pattern, fixing route matching. (4.13.1) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.1)
- A function component can return an array of children without throwing during server-side rendering. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- HTTP field types are synced with the IANA HTTP Field Name Registry, including newly registered fields such as Accept-Query. (4.13.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.13.0)
- Fixes handling of subscription and snapshot changes for useSyncExternalStore in JSX. (4.12.33) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.33)
- CSP callbacks are kept scoped to their header. (4.12.32) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.32)
- An empty SSE id field is emitted to reset Last-Event-ID. (4.12.32) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.32)
- Fixes multipart boundary mismatches in cloned raw requests. (4.12.31) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.31)
- parseBody() reuses cached formData. (4.12.31) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.31)
- The SSE retry field is emitted when retry is 0. (4.12.31) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.31)
- Cache-Control directives are deduplicated case-insensitively. (4.12.30) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.30)
- A duplex value is set when forwarding a stream body in query mode. (4.12.30) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.30)
- replaceUrlParam no longer matches a parameter that prefixes another parameter. (4.12.30) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.30)
- The trie router matches an empty wildcard remainder after a regexp parameter. (4.12.29) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.29)
- An If-None-Match header with the value * is treated as a match. (4.12.29) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.29)
- Extra properties are stripped from array types in JSONParsed. (4.12.29) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.29)
- The handler is resolved with the value passed to the callback. (4.12.29) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.29)
- Content-encoded response bodies are base64 encoded. (4.12.29) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.29)
- V2 events are detected by request context rather than rawPath alone. (4.12.28) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.28)
- Content-Type media types are normalized for case-insensitive matching in body utilities and the validator. (4.12.28) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.28)
- Static serving now treats empty string content as found. (4.12.28) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.28)
- On Bun, WSContext.protocol now reports the requested subprotocol. (4.12.28) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.28)
- Fixed Content-Length body encoding in lambda-edge to satisfy Deno lib types. (4.12.26) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.26)
- The parser expands :: to eight zero groups. (4.12.24) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.24)
- The binary representation of the unspecified address is rendered as ::. (4.12.24) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.24)
- The missing-options error message now mentions verifyToken, making the required option clearer. (4.12.24) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.24)
- Static file paths now normalize all backslashes, not just the first. (4.12.23) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.23)
- The encoding option now respects Accept-Encoding. (4.12.22) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.22)
- The Deno WebSocket upgrade response now echoes the negotiated subprotocol. (4.12.22) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.22)
- Widens the children type to Child[] for jsxFn. (4.12.20) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.20)
- Preserves the base path of a mounted route() app. (4.12.20) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.20)
- Cache entries are keyed by configured vary headers, so requests with different values for those headers use distinct entries. (4.12.19) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.19)
- When multiple cookies have the same name, cookie lookup returns the first one. (4.12.19) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.19)
- Abort handling for streams is fixed. (4.12.19) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.19)
- Middleware response types now propagate to app.on overloads. (4.12.17) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.17)
- SVG attributes on the root svg element are now normalized. (4.12.17) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.17)
- JWT now supports single-line PEM keys. (4.12.15) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.15)
- Request processing now handles invalid header names. (4.12.14) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.14)
- The 9- and 10-handler overloads now infer the response type from the last handler. (4.12.13) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.13)
- Strong ETags are converted to weak ETags when compressing. (4.12.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.10)
- The select value is applied after its children are rendered. (4.12.10) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.10)
- Reflects the request origin when credentials is true and the origin is a wildcard. (4.12.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.9)
- Makes fire() fallback behavior consistent with handle(). (4.12.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.9)
- Removes parseBody from bodyCache to prevent a TypeError. (4.12.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.9)
- Passes SSG_CONTEXT to forGetInfoURLRequest. (4.12.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.9)
- Input extensions are normalized to lowercase before the MIME check. (4.12.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.8)
- Aligns link hoisting and deduplication with React 19. (4.12.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.6)
- Avoids callback handler deprecation when running on NODEJS_24_X. (4.12.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.6)
- Fixes the “Invalid state: Controller is already closed” error in JSX. (4.12.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.5)
- When the path type is any, param() returns string | undefined. (4.12.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.5)
- Preserves the route schema in ApplyGlobalResponse. (4.12.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.4)
- Removes DOM type dependencies from ClientResponse and the request method. (4.12.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.3)
- Prevents a type diff bug when parsing form data. (4.12.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.3)
- Avoids mutating the options object to prevent a memory leak. (4.12.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.3)
- Corrects JwtVariables for ContextVariableMap. (4.12.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.3)
- Corrects middleware types. (4.12.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.3)
- Removes DOM type dependencies from ClientResponse and the request method. (4.12.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.3)
- Exported from hono/client so developers can use ApplyGlobalResponse from the client package. (4.12.1) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.1)
- JSX DOM rendering now handles empty arrays in the render children loop. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- Client form data serialization now skips undefined values. (4.12.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.12.0)
- getPath() ignores fragment identifiers when determining the path. (4.11.9) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.9)
- Makes the auth scheme case-insensitive. (4.11.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.8)
- Preserves context when using await before the html helper. (4.11.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.8)
- writeSSE now handles \r and \r\n line endings. (4.11.6) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.6)
- The JWKS allowedAlgorithms typing is marked to let users pass a const value. (4.11.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.5)
- The ClientRequest type excludes $all. (4.11.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.5)
- Fixes middleware union type merging in MergeMiddlewareResponse. (4.11.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.3)
- Preserves literal union types in input type inference. (4.11.2) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.2)
- Fixed array type inference for the app.on method. (4.11.1) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.1)
- Hono JSX displays blank when children is nullish. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- Fixes incorrect `app` typing with pathless handlers. (4.11.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.11.0)
- Fixes incorrect path matching in the linear router. (4.10.8) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.8)
- Fixes a TypeError: null is not an object in the Bun adapter. (4.10.7) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.7)
- Adds a JSX type for hono/jsx/dom. (4.10.7) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.7)
- Fixes incomplete types for the validator. (4.10.7) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.7)
- The cache middleware skips caching when the response includes Vary: *. (4.10.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.5)
- Wrapped empty JSX tags are now self-closed. (4.10.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.5)
- Query parameter lookup now searches behind the question mark. (4.10.5) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.5)
- Preserves handler response typing in createHandlers, allowing developers to retain response types when using the helper. (4.10.4) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.4)
- The Lambda handler serves Microsoft Office files as binary. (4.10.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.3)
- Request ID validation accepts the = character. (4.10.3) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.3)
- Fixes types so `.use` accepts non-returning middleware created with `createMiddleware`. (4.10.1) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.1)
- Corrects proxy handling of hop-by-hop headers per RFC 9110. (4.10.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.0)
- Middleware response types are now passed through so RPC clients can correctly infer response types. (4.10.0) — [release notes](https://github.com/honojs/hono/releases/tag/v4.10.0)