hono Releases

This is a security hardening release that addresses a potential prototype pollution vulnerability. The fix ignores __proto__ path segments in parseBody when the dot option is enabled, preventing dangerous patterns when merged with unsafe inputs.

Mar 10, 2026

This release includes multiple fixes including ReDoS mitigation for accept header parsing, JSX improvements to align with React 19, build configuration enhancements, and lambda-edge support. It also adds function-based options for JSX renderer.

Mar 10, 2026

This release includes bug fixes for request parameter types, JWT token validation, and JSX state handling. It also upgrades the ESLint configuration. The release improves type safety and adds token format validation for JWT operations.

Mar 4, 2026

Security release fixing three vulnerabilities: SSE control field injection in Streaming Helper, cookie attribute injection in setCookie(), and middleware bypass in Serve Static middleware. Users of these components are strongly encouraged to upgrade.

Mar 3, 2026

This is a release candidate for the Bevy Engine version 0.18.1, with a full diff available on GitHub.

Mar 2, 2026

This release brings significant performance improvements including faster startup, optimized file collection, and a smaller npm package size.

Feb 28, 2026

A patch release focused on bug fixes across validator, JWT, and type modules. Includes fixes for form data parsing type issues, timestamp handling in JWT, context variable mapping, and DOM type dependencies.

Feb 26, 2026

A security fix release addressing a critical vulnerability in the AWS Lambda adapter. Fixed incorrect handling of X-Forwarded-For behind ALB that could allow IP-based access control bypass.

Feb 23, 2026

A minimal patch release that fixes the export of ApplyGlobalResponse type helper from the hono/client module.

Feb 21, 2026

A feature-rich release with new client capabilities, middleware improvements, adapter enhancements, and significant performance optimizations including 1.5x-2x faster TrieRouter and 10.6% improved JSON throughput.

Feb 19, 2026

A patch release focused on timing safety improvements. Fixed implementation to be more properly timing safe.

Feb 18, 2026

Release notes not provided in detail; only a link to the full changelog is available.

Feb 12, 2026

Release notes not provided in detail; only a link to the full changelog is available.

Feb 12, 2026

Includes dependency pinning, static file inclusion, and metadata tracking for Hugging Face files.

Feb 12, 2026

Feb 11, 2026

Bug fix release addressing URL fragment handling and rendering detection in the framework.

Feb 8, 2026

Bug fix release improving JSX context preservation and bearer authentication case sensitivity.

Feb 6, 2026

Major security release fixing four vulnerabilities across IP restriction, cache middleware, serve static, and ErrorBoundary components.

Jan 27, 2026

Refactoring and feature release with improved typing, SSE handling, and Bun server integration.

Jan 26, 2026

This release addresses compatibility issues with xstate and updates dependencies to address security vulnerabilities.

Jan 26, 2026