v4.10.3

honojs/honov4.10.3Oct 24, 2025by yusukebe

AI Summary

This is a security-focused release that patches a vulnerability in the CORS middleware where request headers could improperly affect the Vary response header. The release also includes bug fixes for AWS Lambda (serving Microsoft Office files as binary) and request-id validation, plus a JWT refactor to reduce minified code size.

Key Highlights

Security fix in CORS middleware - request headers could affect Vary response header
Fixed AWS Lambda to serve Microsoft Office files as binary
Fixed request-id validation to accept `=` character
Refactored JWT to reduce minified code size
New contributor @matthiasfeist added support for Microsoft Office files in Lambda

New Features

Security patch for CORS middleware vulnerability
AWS Lambda now properly serves Microsoft Office files as binary
Request-id validation now accepts `=` character

Full Release Notes

## Securiy Fix

A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware.

## What's Changed
* fix(aws-lambda): serve microsoft office files as binary in lambda handler by @matthiasfeist in https://github.com/honojs/hono/pull/4469
* fix(request-id): validation accepts `=` by @ryuapp in https://github.com/honojs/hono/pull/4478
* refactor(jwt): reduce the size of the code generated by minification by @usualoma in https://github.com/honojs/hono/pull/4480

## New Contributors
* @matthiasfeist made their first contribution in https://github.com/honojs/hono/pull/4469

**Full Changelog**: https://github.com/honojs/hono/compare/v4.10.2...v4.10.3