hono Releases

This minor release includes several bug fixes and new features for the Hono web framework. Key improvements include making the serveStatic options parameter optional, fixing cookie handling to return the first cookie when duplicates exist, adding generic type support to bearer-auth, implementing vary headers for cache keying, and adding a bytes() method to request.

May 16, 2026

Security-focused release addressing three critical vulnerabilities in Cache Middleware, JSX SSR, and JWT verify(). Users of JWT helper, hono/jsx, or Cache middleware are strongly encouraged to upgrade.

May 6, 2026

This patch release includes four bug fixes across JSX, SSG, CORS, and type definitions. The most notable change makes the origin parameter optional in CORSOptions, improving flexibility for CORS configuration.

May 5, 2026

Security-focused release addressing two vulnerabilities in the Hono framework. Fixes unvalidated JSX tag names that could allow HTML injection when using jsx() or createElement(), and resolves a bodyLimit() bypass vulnerability for chunked or unknown-length requests where oversized requests could reach handlers before being rejected.

Apr 30, 2026

A major performance overhaul that reduces repository packing time by approximately 58% (from 3.3s to 1.4s) through various optimizations including pipeline parallelization and startup improvements.

Apr 26, 2026

A bug fix release addressing a specific security advisory identified in the repository.

Apr 24, 2026

This is a patch release that fixes JWT PEM key handling to support single-line PEM keys, addressing a compatibility issue in the jwt package.

Apr 24, 2026

Adds new scraping capabilities, localization support for Turkish, and improves CLI robustness to prevent crashes.

Apr 22, 2026

A security-focused release addressing improper handling of JSX attribute names in hono/jsx SSR that could allow malformed attribute keys to corrupt HTML output and inject unintended attributes. Also includes a fix for handling invalid header names in AWS Lambda request processing.

Apr 15, 2026

This release introduces new options for trailing slash handling and cache behavior, along with improved type inference for response types in multi-handler on() routes.

Apr 15, 2026

Major version release introducing installation packages for Debian-based distributions.

Apr 9, 2026

Added support for Claude Opus 4.6 and Claude Sonnet 4.6 models with 1M context windows, reasoning capabilities, prompt caching, tool use, and cross-region inference profiles.

Apr 9, 2026

This release focuses on dependency updates, security improvements, and bug fixes. It includes a major change regarding Node.js support and addresses several build and UI issues.

Apr 8, 2026

A critical security release addressing five distinct vulnerabilities affecting Serve Static, Static Site Generation (toSSG), IP Restriction middleware, and Cookie utilities. Users are strongly encouraged to upgrade.

Apr 7, 2026

A minor feature release adding a classNameSlug option to the CSS context creation for more flexible CSS class name generation.

Apr 6, 2026

A maintenance release focusing on bug fixes and documentation improvements across multiple components including JSX/DOM, compress middleware, and IP restriction documentation.

Apr 2, 2026

This release fixes a false positive in base64 detection and migrates the clipboard dependency to a lighter library to reduce package size.

Mar 26, 2026

This release strengthens security with remote config sandboxing and delivers significant performance improvements across the core pipeline.

Mar 24, 2026

This release includes several bug fixes across request handling, client types, SSG, service workers, and CORS. It adds a new type for picking responses by status code and fixes CORS behavior to properly reflect request origin when credentials are enabled with wildcard.

Mar 23, 2026

This release includes two bug fixes: one for MIME type handling normalization and one for bearer authentication security. The MIME extension is now normalized to lowercase before checking, and regex metacharacters are properly escaped in bearer auth.

Mar 14, 2026