Hono is a small, fast web framework built on Web Standards, designed to run on many JavaScript runtimes including Cloudflare Workers, Deno, Bun, Vercel, and Node.js. It provides routing and middleware features, with built-in support for first-class TypeScript development. Useful if you want to write the same web app code across different platforms.
Project status
- Actively maintained, with upstream GitHub activity as recent as 2026-08-27 and a steady stream of frequent updates (v4.13.1 on 2026-08-07, v4.13.2 on 2026-08-13, v4.13.3 on 2026-08-18, v4.13.4 on 2026-08-24, v4.13.5 on 2026-08-26).
- Apparent update cadence is high, roughly weekly (and sometimes multiple times within a few weeks), suggesting ongoing active development rather than maintenance mode.
AI summary generated
Recent updates
v4.13.7
v4.13.7 patches an XSS issue in `hono/jsx` where plain strings could be emitted unescaped by boundary components (`Suspense`, `ErrorBoundary`, `Context.Provider`) and by server rendering (`renderToString`, `renderToReadableStream`). The implementation broadens the escaping logic beyond those exact cases, changing how JSX children, fallbacks, and server root values are serialized.
BreakingSecurityv4.13.6
v4.13.6 contains targeted fixes to the client URL, path, and WebSocket URL generation logic, specifically around the synthetic "index" route segment and param values of "index". It also updates Context get and set typing and runtime behavior to support symbol keys, plus a small internal refactor and a dependency bump.
v4.13.5
v4.13.5 ships security fixes addressing incorrect query parsing after URL fragments, a path traversal issue in `toSSG()` output containment, and unbounded memory growth from dot-notation nesting in `parseBody({ dot: true })`. The code changes also expand related handling in cache key generation, URL query parsing, and SSG path normalization (UNC and current-directory output roots).
Securityv4.13.4
v4.13.4 is a collection of targeted fixes across request handling, client serialization, routing, ETag matching, cookie parsing, JSX ref cleanup, and stream abort robustness. Most release notes describe behavior changes as bug fixes and minor performance improvements, with no explicitly called out breaking API changes.
v4.13.3
v4.13.3 is primarily a bug fix release, covering CORS, CSRF, ETag handling, client URL parameter replacement, IP address expansion, and multiple router wildcard edge cases. It also adds a feature to the pretty-json middleware to format structured JSON content types (for example, application/problem+json).
Featuresv4.13.2
v4.13.2 is a patch release focused on correctness fixes across several middleware and utilities, including secure header Permissions-Policy rendering, JSX metadata handling, ETag digest stability, CORS behavior, and client request serialization. It also includes a small performance improvement in the CORS middleware. The release notes enumerate several targeted fixes, but the code diff reveals a couple of additional behavior-affecting adjustments not explicitly called out.
Featuresv4.13.1
v4.13.1 contains three targeted bug fixes: trie-router path pattern matching was corrected to count slashes properly, stream piping now reliably re-acquires the writer lock after errors, and etag middleware was tightened to avoid returning 304 responses for unsafe methods and error responses. The release notes only mention the documented fix intents, but the code diff shows at least one additional behavioral change in the streaming pipe implementation.
v4.13.0
v4.13.0 focuses on performance and adds first-class support for the HTTP QUERY method. It also introduces a new Method Not Allowed middleware, updates built-in middleware (Cache, ETag, CORS) to correctly handle QUERY, and improves route registration behavior in the RegExp router.
BreakingFeaturesv4.12.34
v4.12.34 ships multiple security-focused fixes across proxy, CORS, language, and JSX memoization. The code changes align with the listed GHSA issues, but there is at least one major behavioral change in `jsx` memo that is not explicitly documented in the release notes.
Securityv4.12.33
This release makes cookie parsing more permissive for real-world cookie name formats and improves the JSX useSyncExternalStore behavior around subscription and snapshot changes. It also removes direct usage of undici in favor of the global fetch approach, alongside a @hono/node-server bump.
v4.12.32
v4.12.32 includes a set of fixes and test additions across secure headers CSP handling, SSE streaming behavior, AWS Lambda adapter typing, and Cloudflare Workers websocket adapter tests. It also hardens request parsing by using Object.create(null) for header/query/parameter-like objects to avoid prototype-related issues.
Securityv4.12.31
v4.12.31 is a small patch release focused on correctness fixes and additional tests. The main runtime behavior changes are in SSE retry rendering (ensuring retry: 0 is emitted) and request body handling (reusing cached FormData and fixing multipart boundary issues when cloning requests).
v4.12.30
v4.12.30 includes several fixes around HTTP semantics and request handling, plus benchmark cleanup and a TypeScript 6 upgrade. Notably, it prevents the compress middleware from compressing 206 Partial Content responses, deduplicates Cache-Control directives case-insensitively, and tightens URL param replacement and method override streaming behavior.
v4.12.29
v4.12.29 is a bug-fix focused release touching the client request header handling, Lambda and Lambda@Edge adapters, etag middleware, and router edge cases. The release notes describe fixes for base64 encoding decisions, content-encoding binary detection, and ETag wildcard behavior, plus related test/type updates.
v4.12.28
v4.12.28 focuses on a set of bug fixes around request parsing and adapter behavior. Notable changes include serve-static handling empty string content correctly, case-insensitive Content-Type matching for body parsing and validation, and more accurate AWS Lambda V1 vs V2 event detection.
v4.12.27
v4.12.27 ships security-focused fixes addressing cross-request context leakage in hono/jsx during SSR, an SSR XSS issue involving hono/css cx() escaping, and a header de-duplication bug in the hono/aws-lambda API Gateway v1 / VPC Lattice adapters. The code diff shows substantial internal refactoring around JSX context isolation, plus additional hardening in CSS class selector handling.
Securityv4.12.26
v4.12.26 focuses on internal build and release pipeline changes. It updates the Lambda Edge adapter for Deno type compatibility, refactors the build script to use Bun-native APIs instead of arg and glob, and adjusts CI so npm publication is performed from GitHub Actions using OIDC trusted publishing. It also removes unused devcontainer and Gitpod configurations.
v4.12.25
v4.12.25 is a security-focused release, primarily hardening CORS behavior, request body size enforcement on AWS Lambda adapters, Windows static file path handling, and HTTP header and Set-Cookie handling in serverless adapters. The release notes describe fixes across hono/cors, hono/body-limit, serve-static, hono/aws-lambda, and hono/lambda-edge.
BreakingSecurityv4.12.24
v4.12.24 focuses on middleware-related fixes (Bearer Auth option validation message, IPv6 unspecified address handling), plus several test improvements around language detection and the timing middleware. It also includes package/config hygiene work, including removing an unused dev dependency and updating TypeScript/types packaging mappings.
Breakingv4.12.23
v4.12.23 includes several middleware and utility fixes plus new public exports. It adds a `contentTypeFilter` option to the `compress` middleware (with a `COMPRESSIBLE_CONTENT_TYPE_REGEX` re-export), exports the `Context` class publicly, normalizes all backslashes in file paths for static serving, and adjusts IPv6 zero-run compression behavior per RFC 5952.
Features