{
 "id": "hono",
 "name": "Hono",
 "url": "https://dev-news.anonyfox.com/hono/",
 "site": "https://hono.dev",
 "ecosystem": "js",
 "title": "Hono release history: 42 security advisories in 2026",
 "description": "Every Hono 4 release from npm as a stack of cells per minor line, the 2026 run of security fixes that dominates it, the adapter split in 4.13.10 and the first v5 release candidates.",
 "lede": {
  "date": "2026-10-24",
  "paragraphs": [
   "Hono has published 42 security advisories in 2026, spread over 15 releases. In 2024 and 2025 together it published five. Most of this year's landed on 4.12, which took 35 releases between February and August, ten of them security fixes. The latest, 4.13.11 on 29 September, fixed serveStatic decoding a request path twice, so a crafted URL could be routed as one path, served as another, and skip middleware on a static prefix.",
   "A day earlier 4.13.10 moved the runtime adapters into their own packages, such as @hono/bun and @hono/cloudflare-workers, and deprecated the hono/<adapter> imports for removal in v5. hono/cloudflare-pages was deprecated with no replacement. 5.0.0-rc.0 and rc.1 followed on 8 and 10 October, both published without release notes."
  ]
 },
 "latest": {
  "version": "4.13.13",
  "date": "2026-10-04",
  "url": "https://github.com/honojs/hono/releases/tag/v4.13.13",
  "summary": "app.mount('/itty-router', ittyRouter.handle)"
 },
 "stable_releases_since_2024": 209,
 "prereleases_since_2024": 12,
 "releases": [
  {
   "version": "4.13.13",
   "date": "2026-10-04",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.13",
   "summary": "app.mount('/itty-router', ittyRouter.handle)"
  },
  {
   "version": "4.13.12",
   "date": "2026-09-30",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.12",
   "summary": "fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in https://github.com/honojs/hono/pull/5485"
  },
  {
   "version": "4.13.11",
   "date": "2026-09-29",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.11",
   "summary": null
  },
  {
   "version": "4.13.10",
   "date": "2026-09-28",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.10",
   "summary": "import { serveStatic } from 'hono/bun'"
  },
  {
   "version": "4.13.9",
   "date": "2026-09-24",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.9",
   "summary": "fix(jsx): replace Suspense and ErrorBoundary content across newlines in https://github.com/honojs/hono/pull/5380"
  },
  {
   "version": "4.13.8",
   "date": "2026-09-15",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.8",
   "summary": "docs: fix typos in code comments and link third-party middleware section in https://github.com/honojs/hono/pull/5343"
  },
  {
   "version": "4.13.7",
   "date": "2026-09-04",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.7",
   "summary": null
  },
  {
   "version": "4.13.6",
   "date": "2026-09-04",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.6",
   "summary": "fix(client): keep a param value of \"index\" in $url() and $path() in https://github.com/honojs/hono/pull/5297"
  },
  {
   "version": "4.13.5",
   "date": "2026-08-26",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.5",
   "summary": null
  },
  {
   "version": "4.13.4",
   "date": "2026-08-24",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.4",
   "summary": "fix(request): handle params on unmatched requests in https://github.com/honojs/hono/pull/5268"
  },
  {
   "version": "4.13.3",
   "date": "2026-08-18",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.3",
   "summary": "fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in https://github.com/honojs/hono/pull/5227"
  },
  {
   "version": "4.13.2",
   "date": "2026-08-13",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.2",
   "summary": "fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in https://github.com/honojs/hono/pull/5197"
  },
  {
   "version": "4.13.1",
   "date": "2026-08-07",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.1",
   "summary": "fix(trie-router): count every slash a pattern consumes by @Jaybhade in https://github.com/honojs/hono/pull/5189"
  },
  {
   "version": "4.13.0",
   "date": "2026-08-03",
   "url": "https://github.com/honojs/hono/releases/tag/v4.13.0",
   "summary": "perf(context): iterate the header record with for..in https://github.com/honojs/hono/pull/5118"
  },
  {
   "version": "4.12.34",
   "date": "2026-08-03",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.34",
   "summary": null
  },
  {
   "version": "4.12.33",
   "date": "2026-07-31",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.33",
   "summary": "fix(cookie): relax name validation when parsing Cookie header in https://github.com/honojs/hono/pull/5164"
  },
  {
   "version": "4.12.32",
   "date": "2026-07-24",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.32",
   "summary": "ci: enable reports for type & bundle size check in https://github.com/honojs/hono/pull/5148"
  },
  {
   "version": "4.12.31",
   "date": "2026-07-18",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.31",
   "summary": "test(context): assert case-insensitive header names in response helpers by @yusukebe in https://github.com/honojs/hono/pull/5116"
  },
  {
   "version": "4.12.30",
   "date": "2026-07-13",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.30",
   "summary": "chore(benchmark/routers): bump deps in https://github.com/honojs/hono/pull/5107"
  },
  {
   "version": "4.12.29",
   "date": "2026-07-10",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.29",
   "summary": "fix(client): merge function headers with per-request headers by @yusukebe in https://github.com/honojs/hono/pull/5092"
  },
  {
   "version": "4.12.28",
   "date": "2026-07-06",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.28",
   "summary": "fix(serve-static): treat empty string content as found by @yusukebe in https://github.com/honojs/hono/pull/5062"
  },
  {
   "version": "4.12.27",
   "date": "2026-06-23",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.27",
   "summary": null
  },
  {
   "version": "4.12.26",
   "date": "2026-06-18",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.26",
   "summary": "fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @yusukebe in https://github.com/honojs/hono/pull/5013"
  },
  {
   "version": "4.12.25",
   "date": "2026-06-09",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.25",
   "summary": null
  },
  {
   "version": "4.12.24",
   "date": "2026-06-08",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.24",
   "summary": "docs(contribution): simplifyAI Usage Policy by @yusukebe in https://github.com/honojs/hono/pull/4972"
  },
  {
   "version": "4.12.23",
   "date": "2026-05-25",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.23",
   "summary": "fix(serve-static): normalize all backslashes in file paths, not just the first in https://github.com/honojs/hono/pull/4962"
  },
  {
   "version": "4.12.22",
   "date": "2026-05-22",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.22",
   "summary": "chore: update vitest to v4 and cleanups by @BlankParticle in https://github.com/honojs/hono/pull/4952"
  },
  {
   "version": "4.12.21",
   "date": "2026-05-19",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.21",
   "summary": null
  },
  {
   "version": "4.12.20",
   "date": "2026-05-19",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.20",
   "summary": "fix(route): preserve the base path of the mounted route() app by @usualoma in https://github.com/honojs/hono/pull/4942"
  },
  {
   "version": "4.12.19",
   "date": "2026-05-16",
   "url": "https://github.com/honojs/hono/releases/tag/v4.12.19",
   "summary": "ci: pin GitHub Actions to SHAs by @yusukebe in https://github.com/honojs/hono/pull/4932"
  }
 ],
 "log": [],
 "then": [],
 "coverage": {
  "ok": true,
  "expected": 221,
  "present": 221,
  "checked_at": "2026-10-24T17:23:21.434Z",
  "since": "2024-01-01T00:00:00.000Z"
 },
 "sources": {
  "releases": {
   "type": "npm",
   "id": "hono",
   "exclude": "-(dev|insiders|nightly|canary|experimental|next)"
  },
  "github": {
   "repo": "honojs/hono",
   "tag_filter": "^v\\d"
  }
 },
 "feed": "https://dev-news.anonyfox.com/hono/feed.xml",
 "markdown": "https://dev-news.anonyfox.com/hono.md"
}