Latest stable Hono: 4.13.13, released (release notes). Newest prerelease: 5.0.0-rc.1, 10 Oct 2026. 209 stable releases since 1 Jan 2024.
Hono
42
security advisories published in 2026
5
in 2024 and 2025 together
195
v4 releases across 14 minor lines
209stable releases since Jan 2024
4days between stable releases, median
15in May 2024, the busiest month
19days, the longest wait (20 Mar 2025 to 8 Apr 2025)
Every Hono 4 release on npm, one cell each, stacked per minor line.security release (20)otherv5 release candidate
Hono has published 42 security advisories in 2026, spread over 15 releases. In 2024 and 2025 together it published five. Most of this year's landed on 4.12, which took 35 releases between February and August, ten of them security fixes. The latest, 4.13.11 on 29 September, fixed serveStatic decoding a request path twice, so a crafted URL could be routed as one path, served as another, and skip middleware on a static prefix.
A day earlier 4.13.10 moved the runtime adapters into their own packages, such as @hono/bun and @hono/cloudflare-workers, and deprecated the hono/<adapter> imports for removal in v5. hono/cloudflare-pages was deprecated with no replacement. 5.0.0-rc.0 and rc.1 followed on 8 and 10 October, both published without release notes.
4.13.13app.mount() becomes Mount middleware, hono/mount; v5 removes app.mount().
4.13.12Keeps internal types out of the bundled declarations; ETag and JSX fixes.
4.13.11Security: serveStatic no longer decodes the request path twice.
4.13.10Runtime adapters move to their own @hono/* packages; hono/<adapter> is deprecated.
4.13.9Case-insensitive Accept matching, router and JWT fixes.
02From @honojs on X
Hono@honojs
Hono v4.13.10 is out, and the runtime adapters are now separate packages like `@.hono/bun` and `@.hono/cloudflare-workers`. hono/<adapter> is deprecated and will be removed in v5. Just change the import path.
