fix(deps): update non-major dependencies by renovate[bot] · Pull Request #3 · goodmeta/mpp-example

renovate · 2026-08-17T04:12:06Z

This PR contains the following updates:

Package	Change	Type	Update	Pending
@hono/node-server	`^1.19.14` → `^1.19.17`	dependencies	patch
@types/node (source)	`22.19.17` → `22.20.1`	devDependencies	minor
hono (source)	`^4.12.19` → `^4.13.1`	dependencies	minor	`4.13.3` (+1)
node	`20` → `20.20.2`	uses-with	minor
tsx (source)	`^4.22.2` → `^4.23.11`	devDependencies	minor	`4.23.12`

Release Notes

honojs/node-server (@hono/node-server)

`v1.19.17`

Compare Source

`v1.19.15`

Compare Source

honojs/hono (hono)

`v4.13.1`

Compare Source

`v4.13.0`

Compare Source

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
`ping` — `GET /`	165.83 ns	163.99 ns	1.01x
`query` — `GET /id/1?name=bun`	674.40 ns	616.99 ns	1.09x
`json` — `GET /user`	528.99 ns	422.44 ns	1.25x
`body` — `POST /json`	1.16 µs	1.00 µs	1.15x

The individual changes:

perf(context): iterate the header record with for..in #5118
perf(url): replace regex tests with indexOf #5121
perf(context): skip Headers creation when there are no headers to merge #5122
perf(urls): refactor tryDecodeURIComponent #5158
perf(request): allocate #validatedData lazily #5175
perf(request): probe the body cache without allocating #5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

Thanks @shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @usualoma and @Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'

const app = new Hono()

app.use(methodNotAllowed({ app }))

app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))

// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
  methodNotAllowed({
    app,
    onMethodNotAllowed: (c, methods) =>
      c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
  })
)

Thanks @usualoma!

RegExpRouter throws `UnsupportedPathError` at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @usualoma!

Other improvements

hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @akahoshi1421!
The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @arhxam!
JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @ashunar0!
JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @natsuki-engr!
The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @arhxam!

All changes

perf(hono-base): avoid rest parameter in fetch by @yusukebe in #5113
perf(context): iterate the header record with for..in by @yusukebe in #5118
perf(url/request): replace regex tests with indexOf by @yusukebe in #5121
perf(context): skip Headers creation when there are no headers to merge by @yusukebe in #5122
perf(urls): refactor tryDecodeURIComponent by @yusukebe in #5158
chore(benchmarks): correct src path on Windows, add json and middleware cases by @kibertoad in #5173
perf(context): drop the throwaway env field initializer by @kibertoad in #5174
perf(request): allocate #validatedData lazily by @kibertoad in #5175
perf(request): probe the body cache without allocating by @kibertoad in #5176
chore(benchmarks): stabilize measurements by forcing mitata batching by @yusukebe in #5183
perf(hono-base): restore the rest parameter in fetch by @yusukebe in #5184
perf(context): restore the env field initializer by @yusukebe in #5186
feat: add first-class QUERY method support by @shellhaki in #5070
feat(etag): support conditional requests for the QUERY method by @Cherry in #5111
feat(cors): allow QUERY by default as a first-class method by @usualoma in #5115
feat(cache): add first-class support for QUERY requests by @usualoma in #5119
feat(jsx): add React-compatible overloads to useRef by @ashunar0 in #5063
feat(middleware): add method-not-allowed middleware by @usualoma in #5132
feat(jwt,jwk): add a configurable WWW-Authenticate realm by @arhxam in #5141
feat(utils/headers): sync HTTP field types with the IANA registry by @akahoshi1421 in #5153
fix(jsx): allow a function component to return an array by @natsuki-engr in #5179
feat(reg-exp-router): throw UnsupportedPathError during route registration by @usualoma in #5171
fix(compress): set Vary: Accept-Encoding on negotiated responses by @arhxam in #5137

Full Changelog: honojs/hono@v4.12.34...v4.13.0

Thank you to all contributors!

`v4.12.34`

Compare Source

`v4.12.33`

Compare Source

What's Changed

fix(cookie): relax name validation when parsing Cookie header in #5164
chore: bump @hono/node-server in #5167
fix(jsx): handle useSyncExternalStore subscription and snapshot changes in #5166
chore: remove undici in favor of global fetch in #5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

`v4.12.32`

Compare Source

What's Changed

ci: enable reports for type & bundle size check in #5148
fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #5142
fix(sse): emit empty id field to reset Last-Event-ID in #5138
test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #5145
fix: use Object.create(null) when parsing query, headers, and params in #5161
fix(secure-headers): keep CSP callbacks scoped to their header in #5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

`v4.12.31`

Compare Source

`v4.12.30`

Compare Source

What's Changed

chore(benchmark/routers): bump deps in #5107
chore(benchmark): remove not used benchmarks in #5108
chore: update to ts6 in prep for ts7 in #5104
fix(cache): deduplicate Cache-Control directives case-insensitively in #5025
fix(compress): do not compress 206 Partial Content responses in #5020
fix(client): replaceUrlParam should not match a param that prefixes another in #5096
fix(method-override): set duplex when forwarding a stream body in query mode in #5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

`v4.12.29`

Compare Source

What's Changed

fix(client): merge function headers with per-request headers by @yusukebe in #5092
chore: fix no-op tsc in test script by @yusukebe in #5093
fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in #5094
docs(language): add JSDoc @example to languageDetector by @codebybilal18 in #5081
test(workerd): add compatibilityDate by @yusukebe in #5100
fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in #5099
fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in #5101
fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in #5103
fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in #5102
fix(etag): treat If-None-Match: * as a match by @yusukebe in #5084

New Contributors

@codebybilal18 made their first contribution in #5081
@Arman-Luthra made their first contribution in #5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

`v4.12.28`

Compare Source

What's Changed

fix(serve-static): treat empty string content as found by @yusukebe in #5062
docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in #5047
chore: don't publish *.tsbuildinfo by @yusukebe in #5066
fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @yusukebe in #5067
fix: avoid circular dependency between body.ts and request.ts by @usualoma in #5071
fix(bun): report the requested subprotocol on WSContext.protocol by @greymoth-jp in #5059
chore: bump devDependencies by @yusukebe in #5085
fix(aws-lambda): detect V2 events by request context, not rawPath alone by @VihaanAgarwal in #5033
docs(context-storage): fix JSDoc by @yusukebe in #5086