Sourced from hono's releases.
v4.9.6
Security
Fixed a bug in URL path parsing (
getPath) that could cause path confusion under malformed requests.If you rely on reverse proxies (e.g. Nginx) for ACLs or restrict access to endpoints like
/admin, please update immediately.See advisory for details: GHSA-9hp6-4448-45g2
What's Changed
- chore: update packages in the router bench by
@yusukebein honojs/hono#4386- chore(benchmarks): remove comment-out from router bench by
@yusukebein honojs/hono#4387Full Changelog: https://github.com/honojs/hono/compare/v4.9.5...v4.9.6
v4.9.5
What's Changed
- chore: replace supertest with undici by
@BarryThePenguinin honojs/hono#4365- fix(aws-lambda): preserve percent-encoded values in query strings by
@yusukebein honojs/hono#4372- feat(cors): Allow async functions for
originandallowMethodsby@jobrkin honojs/hono#4373- feat(cors): Correct origin function return type asynchronously returning null or undefined for origin by
@jobrkin honojs/hono#4375- fix(service-worker): correct args for
app.fetchinhandleby@yusukebein honojs/hono#4374- fix(language-detector): Detect language from path after getPath changed by
@iflamedin honojs/hono#4369New Contributors
@jobrkmade their first contribution in honojs/hono#4373@iflamedmade their first contribution in honojs/hono#4369Full Changelog: https://github.com/honojs/hono/compare/v4.9.4...v4.9.5
v4.9.4
What's Changed
- chore: add a type cast to run
deno publishby@yusukebein honojs/hono#4364Full Changelog: https://github.com/honojs/hono/compare/v4.9.3...v4.9.4
v4.9.3
What's Changed
- feat(csrf): Add modern CSRF protection with Fetch Metadata support by
@meck93in honojs/hono#4353- tests: use vitest projects by
@BarryThePenguinin honojs/hono#4359- feat(proxy): add
customFetchoption to allow custom fetch function by@yusukebein honojs/hono#4360- chore: update
typescriptto5.9.2by@yusukebein honojs/hono#4362- chore: add
packageManagerfield topackage.jsonby@yusukebein honojs/hono#4363Full Changelog: https://github.com/honojs/hono/compare/v4.9.2...v4.9.3
v4.9.2
... (truncated)
7f4311c
4.9.61d79aed
Merge commit from forkadecab1
chore(benchmarks): remove comment-out from router bench (#4387)b3d5b40
chore: update packages in the router bench (#4386)98cb963
4.9.5b3e8cab
fix(language-detector): Detect language from path after getPath changed
(#4369)0e3db67
fix(service-worker): correct args for app.fetch in
handle (#4374)c4577e9
fix(cors): Allow returning null or undefined for origin (#4375)5bfbff8
feat(cors): Allow async functions for origin and
allowMethods (#4373)a268569
fix(aws-lambda): preserve percent-encoded values in query strings (#4372)KwvO5Z=jA3pmJZ-$UDwn-kICn
zp)DX0Ma!ORT!J|paAA36JZ^BbKMsMszFuh0*+g)|UyQ_CbmtiE7vw=lLkD)%o{hUM
zRaF)cdmnq0tcE%@J~1>{RcY9>MPIX$qY=wH >8l3g97{ lyWi{Y=>VTU(*!
zbK>OHwN-AIh$Y(XgB<}Dh_Y`
u8r?yVwWYadnW5{VTmxG>_x`~sA)6z-gvsSs~o9L-b_bl}BzEjzU
z@!vIOG|a?3MeMi<=(&6C4A)Y8C3}LKT4pO${dH}0$D25d_f3f2>%>tjRkfKjY)#ev
zjO9)%x|f5k_-@?rsSa7St<#F!=fZR8bU2I^pZO>zr_P>2dbhS^jGZu=QW?HnLJd54
znj;
B6(b?
z{0*3S4et7q$q@PWUFdktnpUBDnirdrVb;93jaLjmfw_Kk*D{HFV_BZ_!eSH~8tB
z-dLMbJ8R6KT+-KJT48U>E<$&u-Zz3VxfF)N(Tg&L}Va6
zuC-Z6)^A4lcb}QxzKVei+-uDQk+)LchZVclpafgf9M$ZUokr{giQi16NQTr)NiX&ueIy4@O89
2>Y60b1fY
zr0U4DgUi@RF-j&IUm3kz4C}GfZQ2;K;nscJ68{VNGQadydniDpKYf}Pibo*|$0QE3
zwzhIv0UI9w<*sBz#3$sRDOl3ef-GD6lRD6o+Z|9zhWTBMUpJ+oR3XTrdCgo&vgAH<
znnzCOI$BFzAEU*JRs=gbZr7UT0Xzb}s9X}MG`xRIVAr+ptU6$)L%q!pr_z)8WeQG=
zIe>cA0;`CD;?CIzv-8D*sL_Fgos)xP1U{*r`
=Wp$Q$@lj7sR_;*$Cx`pR8yuodjXt>Hum_%X`|6v+Z