Skip to content

fix(deps): update dependency hono to v4.8.4 #147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency hono to v4.8.4 #147

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 28, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
hono (source) 4.6.14 -> 4.8.4 age confidence

Release Notes

honojs/hono (hono)

v4.8.4

Compare Source

v4.8.3

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.8.2...v4.8.3

v4.8.2

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.8.1...v4.8.2

v4.8.1

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.8.0...v4.8.1

v4.8.0

Compare Source

Release Notes

Hono v4.8.0 is now available!

This release enhances existing features with new options and introduces powerful helpers for routing and static site generation. Additionally, we're introducing new third-party middleware packages.

  • Route Helper
  • JWT Custom Header Location
  • JSX Streaming Nonce Support
  • CORS Dynamic allowedMethods
  • JWK Allow Anonymous Access
  • Cache Status Codes Option
  • Service Worker fire() Function
  • SSG Plugin System

Plus new third-party middleware:

  • MCP Middleware
  • UA Blocker Middleware
  • Zod Validator v4 Support

Let's look at each of these.

Reduced the code size

First, this update reduces the code size! The smallest hono/tiny package has been reduced by about 800 bytes from v4.7.11, bringing it down to approximately 11 KB. When gzipped, it's only 4.5 KB. Very tiny!

Route Helper

New route helper functions provide easy access to route information and path utilities.

import { Hono } from 'hono'
import {
  matchedRoutes,
  routePath,
  baseRoutePath,
  basePath,
} from 'hono/route'

const api = new Hono()

api.get('/users/:id/posts/:postId', (c) => {
  const matched = matchedRoutes(c) // Array of matched route handlers
  const current = routePath(c) // '/api/users/:id/posts/:postId'
  const base = baseRoutePath(c) // '/api' Base route path
  const appBase = basePath(c) // '/api' Base path
  return c.json({ matched, current, base, appBase })
})

const app = new Hono()
app.route('/api', api)

export default app

These helpers make route introspection cleaner and more explicit.

Thanks @​usualoma!

JWT Custom Header Location

JWT middleware now supports custom header locations beyond the standard Authorization header. You can specify any header name to retrieve JWT tokens from.

import { Hono } from 'hono'
import { jwt } from 'hono/jwt'

const app = new Hono()

app.use(
  '/api/*',
  jwt({
    secret: 'secret-key',
    headerName: 'X-Auth-Token', // Custom header name
  })
)

app.get('/api/protected', (c) => {
  return c.json({ message: 'Protected resource' })
})

This is useful when working with APIs that use non-standard authentication headers.

Thanks @​kunalbhagawati!

JSX Streaming Nonce Support

JSX streaming now supports nonce values for Content Security Policy (CSP) compliance. The streaming context can include a nonce that gets applied to inline scripts.

import { Hono } from 'hono'
import {
  renderToReadableStream,
  Suspense,
  StreamingContext,
} from 'hono/jsx/streaming'

const app = new Hono()

app.get('/', (c) => {
  const stream = renderToReadableStream(
    <html>
      <body>
        <StreamingContext
          value={{ scriptNonce: 'random-nonce-value' }}
        >
          <Suspense fallback={<div>Loading...</div>}>
            <AsyncComponent />
          </Suspense>
        </StreamingContext>
      </body>
    </html>
  )

  return c.body(stream, {
    headers: {
      'Content-Type': 'text/html; charset=UTF-8',
      'Transfer-Encoding': 'chunked',
      'Content-Security-Policy':
        "script-src 'nonce-random-nonce-value'",
    },
  })
})

Thanks @​usualoma!

CORS Dynamic allowedMethods

CORS middleware now supports dynamic allowedMethods based on the request origin. You can provide a function that returns different allowed methods depending on the origin.

import { Hono } from 'hono'
import { cors } from 'hono/cors'

const app = new Hono()

app.use(
  '*',
  cors({
    origin: ['https://example.com', 'https://api.example.com'],
    allowMethods: (origin) => {
      if (origin === 'https://api.example.com') {
        return ['GET', 'POST', 'PUT', 'DELETE']
      }
      return ['GET', 'POST'] // Default for other origins
    },
  })
)

This enables fine-grained control over CORS policies per origin.

Thanks @​Kanahiro!

JWK Allow Anonymous Access

JWK middleware now supports anonymous access with the allow_anon option. When enabled, requests without valid tokens can still proceed to your handlers.

import { Hono } from 'hono'
import { jwk } from 'hono/jwk'

const app = new Hono()

app.use(
  '/api/*',
  jwk({
    jwks_uri: 'https://example.com/.well-known/jwks.json',
    allow_anon: true,
  })
)

app.get('/api/data', (c) => {
  const payload = c.get('jwtPayload')
  if (payload) {
    return c.json({ message: 'Authenticated user', user: payload })
  }
  return c.json({ message: 'Anonymous access' })
})

Additionally, keys and jwks_uri options now support functions that receive the context, enabling dynamic key resolution.

Thanks @​Beyondo!

Cache Status Codes Option

Cache middleware now allows you to specify which status codes should be cached using the cacheableStatusCodes option.

import { Hono } from 'hono'
import { cache } from 'hono/cache'

const app = new Hono()

app.use(
  '*',
  cache({
    cacheName: 'my-cache',
    cacheControl: 'max-age=3600',
    cacheableStatusCodes: [200, 404], // Cache both success and not found responses
  })
)

Thanks @​miyamo2!

Service Worker fire() Function

A new fire() function is available from the Service Worker adapter, providing a cleaner alternative to app.fire().

import { Hono } from 'hono'
import { fire } from 'hono/service-worker'

const app = new Hono()

app.get('/', (c) => c.text('Hello from Service Worker!'))

// Use the standalone fire function
fire(app)

The app.fire() method is now deprecated in favor of this approach. Goodbye app.fire().

SSG Plugin System

Static Site Generation (SSG) now supports a plugin system that allows you to extend the generation process with custom functionality.

For example, the following is easy implementation of a sitemap plugin:

// plugins.ts
import fs from 'node:fs/promises'
import path from 'node:path'
import type { SSGPlugin } from 'hono/ssg'
import { DEFAULT_OUTPUT_DIR } from 'hono/ssg'

export const sitemapPlugin = (baseURL: string): SSGPlugin => {
  return {
    afterGenerateHook: (result, fsModule, options) => {
      const outputDir = options?.dir ?? DEFAULT_OUTPUT_DIR
      const filePath = path.join(outputDir, 'sitemap.xml')
      const urls = result.files.map((file) =>
        new URL(file, baseURL).toString()
      )
      const siteMapText = `<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
${urls.map((url) => `<url><loc>${url}</loc></url>`).join('\n')}
</urlset>`
      fsModule.writeFile(filePath, siteMapText)
    },
  }
}

Applying the plugin:

import { toSSG } from 'hono/ssg'
import { sitemapPlugin } from './plugins'

toSSG(app, fs, {
  plugins: [sitemapPlugin('https://example.com')],
})

Plugins can hook into various stages of the generation process to perform custom actions.

Thanks @​3w36zj6!

Third-party Middleware Updates

In addition to core Hono features, we're excited to introduce new third-party middleware packages that extend Hono's capabilities.

MCP Middleware

A new middleware package @hono/mcp enables creating remote MCP (Model Context Protocol) servers over Streamable HTTP Transport. This is the initial release with more features planned for the future.

import { McpServer } from '@&#8203;modelcontextprotocol/sdk/server/mcp.js'
import { StreamableHTTPTransport } from '@&#8203;hono/mcp'
import { Hono } from 'hono'

const app = new Hono()

// Your MCP server implementation
const mcpServer = new McpServer({
  name: 'my-mcp-server',
  version: '1.0.0',
})

app.all('/mcp', async (c) => {
  const transport = new StreamableHTTPTransport()
  await mcpServer.connect(transport)
  return transport.handleRequest(c)
})

Currently, this is ideal for creating stateless and authentication-less remote MCP servers.

Thanks @​MathurAditya724!

UA Blocker Middleware

The new @hono/ua-blocker middleware allows blocking requests based on user agent headers. It includes blocking AI bots functions.

import { uaBlocker } from '@&#8203;hono/ua-blocker'
import { aiBots } from '@&#8203;hono/ua-blocker/ai-bots'
import { Hono } from 'hono'

const app = new Hono()

// Block specific user agents
app.use(
  '*',
  uaBlocker({
    blocklist: ['ForbiddenBot', 'Not You'],
  })
)

// Block all AI bots
app.use(
  '*',
  uaBlocker({
    blocklist: aiBots,
  })
)

// Serve robots.txt to discourage AI bots
app.use('/robots.txt', useAiRobotsTxt())

Thanks @​finxol!

Zod Validator v4 Support

The @hono/zod-validator middleware now supports Zod v4!

All Changes

New Contributors

Full Changelog: honojs/hono@v4.7.11...v4.8.0

v4.7.11

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.10...v4.7.11

v4.7.10

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.7.9...v4.7.10

v4.7.9

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.8...v4.7.9

v4.7.8

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.7...v4.7.8

v4.7.7

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.7.6...v4.7.7

v4.7.6

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.5...v4.7.6

v4.7.5

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.4...v4.7.5

v4.7.4

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.7.3...v4.7.4

v4.7.3

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.7.2...v4.7.3

v4.7.2

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.7.1...v4.7.2

v4.7.1

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.7.0...v4.7.1

v4.7.0

Compare Source

Release Notes

Hono v4.7.0 is now available!

This release introduces one helper and two middleware.

  • Proxy Helper
  • Language Middleware
  • JWK Auth Middleware

Plus, Standard Schema Validator has been born.

Let's look at each of these.

Proxy Helper

We sometimes use the Hono application as a reverse proxy. In that case, it accesses the backend using fetch. However, it sends an unintended headers.

app.all('/proxy/:path', (c) => {
  // Send unintended header values to the origin server
  return fetch(`http://${originServer}/${c.req.param('path')}`)
})

For example, fetch may send Accept-Encoding, causing the origin server to return a compressed response. Some runtimes automatically decode it, leading to a Content-Length mismatch and potential client-side errors.

Also, you should probably remove some of the headers sent from the origin server, such as Transfer-Encoding.

Proxy Helper will send requests to the origin and handle responses properly. The above headers problem is solved simply by writing as follows.

import { Hono } from 'hono'
import { proxy } from 'hono/proxy'

app.get('/proxy/:path', (c) => {
  return proxy(`http://${originServer}/${c.req.param('path')}`)
})

You can also use it in more complex ways.

app.get('/proxy/:path', async (c) => {
  const res = await proxy(
    `http://${originServer}/${c.req.param('path')}`,
    {
      headers: {
        ...c.req.header(),
        'X-Forwarded-For': '127.0.0.1',
        'X-Forwarded-Host': c.req.header('host'),
        Authorization: undefined,
      },
    }
  )
  res.headers.delete('Set-Cookie')
  return res
})

Thanks @​usualoma!

Language Middleware

Language Middleware provides 18n functions to Hono applications. By using the languageDetector function, you can get the language that your application should support.

import { Hono } from 'hono'
import { languageDetector } from 'hono/language'

const app = new Hono()

app.use(
  languageDetector({
    supportedLanguages: ['en', 'ar', 'ja'], // Must include fallback
    fallbackLanguage: 'en', // Required
  })
)

app.get('/', (c) => {
  const lang = c.get('language')
  return c.text(`Hello! Your language is ${lang}`)
})

You can get the target language in various ways, not just by using Accept-Language.

  • Query parameters
  • Cookies
  • Accept-Language header
  • URL path

Thanks @​lord007tn!

JWK Auth Middleware

Finally, middleware that supports JWK (JSON Web Key) has landed. Using JWK Auth Middleware, you can authenticate by verifying JWK tokens. It can access keys fetched from the specified URL.

import { Hono } from 'hono'
import { jwk } from 'hono/jwk'

app.use(
  '/auth/*',
  jwk({
    jwks_uri: `https://${backendServer}/.well-known/jwks.json`,
  })
)

app.get('/auth/page', (c) => {
  return c.text('You are authorized')
})

Thanks @​Beyondo!

Standard Schema Validator

Standard Schema provides a common interface for TypeScript validator libraries. Standard Schema Validator is a validator that uses it. This means that Standard Schema Validator can handle several validators, such as Zod, Valibot, and ArkType, with the same interface.

The code below really works!

import { Hono } from 'hono'
import { sValidator } from '@&#8203;hono/standard-validator'
import { type } from 'arktype'
import * as v from 'valibot'
import { z } from 'zod'

const aSchema = type({
  agent: 'string',
})

const vSchema = v.object({
  slag: v.string(),
})

const zSchema = z.object({
  name: z.string(),
})

const app = new Hono()

app.get(
  '/:slag',
  sValidator('header', aSchema),
  sValidator('param', vSchema),
  sValidator('query', zSchema),
  (c) => {
    const headerValue = c.req.valid('header')
    const paramValue = c.req.valid('param')
    const queryValue = c.req.valid('query')
    return c.json({ headerValue, paramValue, queryValue })
  }
)

const res = await app.request('/foo?name=foo', {
  headers: {
    agent: 'foo',
  },
})

console.log(await res.json())

Thanks @​muningis!

New features

All changes

New Contributors

Full Changelog: honojs/hono@v4.6.20...v4.7.0

v4.6.20

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.6.19...v4.6.20

v4.6.19

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.6.18...v4.6.19

v4.6.18

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.6.17...v4.6.18

v4.6.17

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.6.16...v4.6.17

v4.6.16

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.6.15...v4.6.16

v4.6.15

Compare Source

c.json() etc. throwing type error when the status is contentless code, e.g., 204

From this release, when c.json(), c.text(), or c.html() returns content, specifying a contentless status code such as 204 will now throw a type error.

CleanShot 2024-12-28 at 16 47 39@​2x

At first glance, this seems like a breaking change but not. It is not possible to return a contentless response with c.json() or c.text(). So, in that case, please use c.body().

app.get('/', (c) => {
  return c.body(null, 204)
})
What's Changed
New Contributors

Full Changelog: honojs/hono@v4.6.14...v4.6.15

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot changeset-bot
Copy link

changeset-bot bot commented Dec 28, 2024 •
edited
Loading

⚠️ No Changeset found

Latest commit: 4e89728

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate bot changed the title fix(deps): update dependency hono to v4.6.15 fix(deps): update dependency hono to v4.6.16 Jan 5, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.6.16 fix(deps): update dependency hono to v4.6.17 Jan 18, 2025
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch from 692d77a to cd1f9ed Compare January 18, 2025 09:25
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.6.17 fix(deps): update dependency hono to v4.6.18 Jan 23, 2025
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch 2 times, most recently from 271f877 to 200b8a4 Compare January 26, 2025 10:24
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.6.18 fix(deps): update dependency hono to v4.6.19 Jan 26, 2025
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch from 200b8a4 to 1088163 Compare January 31, 2025 06:44
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.6.19 fix(deps): update dependency hono to v4.6.20 Jan 31, 2025
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch from 1088163 to 9add45d Compare February 7, 2025 06:39
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.6.20 fix(deps): update dependency hono to v4.7.0 Feb 7, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.0 fix(deps): update dependency hono to v4.7.1 Feb 13, 2025
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch from 9add45d to a35314e Compare February 13, 2025 13:56
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.1 fix(deps): update dependency hono to v4.7.2 Feb 19, 2025
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch from a35314e to 516e733 Compare February 19, 2025 00:41
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch 2 times, most recently from 47a5f4a to bd81257 Compare March 5, 2025 05:04
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.2 fix(deps): update dependency hono to v4.7.4 Mar 5, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.4 fix(deps): update dependency hono to v4.7.5 Mar 20, 2025
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch from bd81257 to 743155a Compare March 20, 2025 09:33
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch 2 times, most recently from 6c6498b to 0a897f2 Compare April 8, 2025 08:26
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.5 fix(deps): update dependency hono to v4.7.6 Apr 8, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.6 fix(deps): update dependency hono to v4.7.7 Apr 16, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.7 fix(deps): update dependency hono to v4.7.8 Apr 28, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.8 fix(deps): update dependency hono to v4.7.9 May 9, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.9 fix(deps): update dependency hono to v4.7.10 May 17, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.10 fix(deps): update dependency hono to v4.7.11 May 31, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.7.11 fix(deps): update dependency hono to v4.8.0 Jun 18, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.8.0 fix(deps): update dependency hono to v4.8.1 Jun 19, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.8.1 fix(deps): update dependency hono to v4.8.2 Jun 21, 2025
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.8.2 fix(deps): update dependency hono to v4.8.3 Jun 25, 2025
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch from 0a897f2 to 239acaf Compare July 2, 2025 20:32
@renovate renovate bot force-pushed the renovate/hono-4.x-lockfile branch from 239acaf to 4e89728 Compare July 4, 2025 09:26
@renovate renovate bot changed the title fix(deps): update dependency hono to v4.8.3 fix(deps): update dependency hono to v4.8.4 Jul 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants