hono Releases

This release addresses a critical XSS vulnerability in the `hono/jsx` library where plain strings were rendered unescaped in boundary components and server rendering functions. The update ensures proper HTML escaping for untrusted data within Suspense, ErrorBoundary, Context.Provider, and related server-side rendering methods.

Sep 4, 2026

This release focuses on bug fixes and internal improvements. It addresses issues with URL parameter handling in client methods, normalizes WebSocket root URLs, and improves type safety for symbol keys in the Context object. Additionally, it refactors handler iteration logic for consistency.

Sep 4, 2026

This release addresses critical security vulnerabilities affecting Cache Middleware, Static Site Generation, and request body parsing. It fixes a query parser issue that reads parameters after URL fragments and resolves a memory exhaustion vulnerability in `parseBody()`.

Aug 26, 2026

A maintenance release focusing on bug fixes for client request handling, routing, ETag matching, and stream utilities. It resolves issues with wildcard middleware, abort listeners, and cookie parsing.

Aug 24, 2026

Improves router matching precision, ETag handling, and CSRF validation. This release adds support for structured JSON content-types in the pretty-json feature.

Aug 18, 2026

Enhances secure headers output, JSX rendering, and ETag incremental hashing. It also fixes client cookie serialization and adds missing W3C Permissions-Policy directives.

Aug 13, 2026

Bug fixes for router counting, stream handling, and ETag logic. It ensures proper slash counting in routes and handles writer lock re-acquisition on pipe errors.

Aug 7, 2026

A major performance release featuring first-class support for the QUERY method, significant speed improvements (up to 1.25x), and a new Method Not Allowed middleware. It also introduces fail-fast route registration.

Aug 3, 2026

Critical security fixes addressing SSR data leakage, DoS vulnerabilities in CORS and Language middleware, and header exposure in Proxy Helper.

Aug 3, 2026

This release is a maintenance update focused on security hardening and stability, specifically addressing Address Book ACL bypass vulnerabilities, legacy SQLite role migration issues, and MeshAgent file generation.

Aug 1, 2026

A major version update introducing a new beta User Experience (UX 3.5) interface alongside the classic UI, and adding FreeBSD community support.

Jul 31, 2026

Bug fixes for cookie parsing, JSX state management, and dependency management. It relaxes cookie name validation and removes the `undici` dependency.

Jul 31, 2026

A hotfix release focused on security hardening, specifically masking client configuration keys and resolving OIDC authentication issues.

Jul 30, 2026

A hotfix restoring Web Remote functionality that was disrupted by recent changes to the enrollment outbound gate.

Jul 28, 2026

A hotfix ensuring the Console service remains active and starts correctly after online GitHub updates.

Jul 25, 2026

Bug fixes for AWS Lambda types, Server-Sent Events (SSE), and object parsing. It adds AWS Lambda authorizer types for API Gateway v2 and fixes SSE ID reset logic.

Jul 24, 2026

Bug fixes for response header helpers, multipart request handling, and SSE retry logic. It also adds app.fetch() overhead benchmarks.

Jul 18, 2026

This release updates TypeScript to version 6 in preparation for version 7, removes unused benchmarks, and fixes edge cases in caching, compression, and method-override middleware.

Jul 13, 2026

This release focuses on bug fixes for various adapters like Lambda Edge and AWS Lambda, along with improvements to the trie-router and client functionality.

Jul 10, 2026

0.34.1 is a patch release for Rerun addressing critical bug fixes related to MP4 playback, live-streaming stability, and collection refreshing issues.

Jul 7, 2026