v4.9.7

honojs/honov4.9.7Sep 12, 2025by yusukebe

AI Summary

This patch release addresses a critical security vulnerability in the `bodyLimit` middleware where body size limits could be bypassed when both `Content-Length` and `Transfer-Encoding` headers were present. Additionally, it fixes a bug where `parseResponse` was not parsing JSON correctly in React Native environments and adds tests for JWK token verification.

Key Highlights

Critical security fix: bodyLimit middleware now properly enforces body size limits when both Content-Length and Transfer-Encoding headers are present
Fixed parseResponse not parsing JSON in React Native environments
Added JWK token verification tests
Updated bun install commands to use --frozen-lockfile for improved CI/CD reliability
Added .tool-versions file for development environment consistency

New Features

Fixed parseResponse to properly parse JSON in React Native
Added test coverage for JWK token verification

Full Release Notes

## Security

- Fixed an issue in the `bodyLimit` middleware where the body size limit could be bypassed when both `Content-Length` and `Transfer-Encoding` headers were present. If you are using this middleware, please update immediately.  [Security Advisory](https://github.com/honojs/hono/security/advisories/GHSA-92vj-g62v-jqhh)

## What's Changed
* fix(client): Fix `parseResponse` not parsing json in react native by @lr0pb in https://github.com/honojs/hono/pull/4399
* chore: add `.tool-versions` file by @3w36zj6 in https://github.com/honojs/hono/pull/4397
* chore: update `bun install` commands to use `--frozen-lockfile` by @3w36zj6 in https://github.com/honojs/hono/pull/4398
* test(jwk): Add tests of JWK token verification by @buckett in https://github.com/honojs/hono/pull/4402

## New Contributors
* @lr0pb made their first contribution in https://github.com/honojs/hono/pull/4399
* @buckett made their first contribution in https://github.com/honojs/hono/pull/4402

**Full Changelog**: https://github.com/honojs/hono/compare/v4.9.6...v4.9.7