[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.13.13 → 4.13.18

---

Release Notes

honojs/hono (hono)

v4.13.18

Compare Source

Security fixes

This release includes fixes for the following security issues:

validator() skips validation for requests whose Content-Type parameters are formatted differently

Affects: validator('json') and validator('form') in hono/validator. A Content-Type with whitespace before ;, a trailing ;, or an unusual parameter name was not recognized, so the validator saw an empty object while the handler could read all fields. This completes the fix for GHSA-4h7h-rv7c-7m2v. The validator now decides by the media type alone, as c.req.parseBody() does. GHSA-92p4-j3wq-jmqx

bodyLimit() keeps every transfer chunk of a request body in memory

Affects: bodyLimit() in hono/body-limit. A body sent in very small transfer chunks was retained as one object per chunk, so a request within the configured limit could exhaust memory. The body is now buffered in one array bounded by maxSize. GHSA-39q9-qp46-w8xg

mount() and app.mount() forward a wrong path when a custom getPath adds a prefix

Affects: mount() in hono/mount and app.mount() on 4.13.16 and 4.13.17. With a getPath that prepends a prefix such as the host name, one segment too many was removed from the forwarded path, so middleware scoped inside the mount prefix could be skipped. The prefix is removed from the routed path again. Paths that would change meaning when forwarded now get 400, and an optional regular expression parameter in a mount path throws. GHSA-h25j-2p75-qj33

serveStatic() serves a path that was decoded twice when allowPercentInPath is enabled

Affects: serveStatic() in hono/serve-static and the runtime adapters, only with allowPercentInPath: true. A malformed percent escape in the request path was decoded a second time, so a path that middleware registered on the encoded form did not see could still reach a static file. The file path must now be the same as the routed path, and otherwise the response is 404. GHSA-74fm-fwc7-3fwp

---

Users who rely on validator(), bodyLimit(), mount() with a custom getPath, or serveStatic() with allowPercentInPath are strongly encouraged to upgrade to this version.

Full Changelog: honojs/hono@v4.13.17...v4.13.18

v4.13.17

Compare Source

What's Changed

• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in #​5608
• fix(utils/url): do not match a query key across separators in #​5607
• fix(etag,pretty-json): cancel the discarded response body in #​5606
• fix(client): detect the JSON media type with whitespace before a parameter in #​5609
• fix(timing): honor a precision of 0 in setMetric in #​5363
• fix(utils/mime,ssg): match media types case-insensitively in #​5449
• fix(timing): escape double quotes and backslashes in Server-Timing descriptions in #​5478
• fix(etag): preserve commas within quoted entity tags in #​5353
• fix(accepts): preserve exact media type quality over subtype wildcards in #​5427
• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in #​5611
• fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in #​5430
• fix(ssg): do not reuse created directories across toSSG runs in #​5381
• fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in #​5483
• fix(jsx): escape element and object attribute values in #​5512
• fix(jsx): do not render ref objects as attributes in #​5615
• fix(factory): keep independent return types for nine handlers in #​5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

v4.13.16

Compare Source

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

• fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in #​5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

Compare Source

What's Changed

• fix(auth): escape backslashes in the WWW-Authenticate realm by @​yusukebe in #​5590
• docs(contributing): drop the note about linking a fork branch by @​yusukebe in #​5593
• fix(context): allow c.header() after the response body is consumed by @​yusukebe in #​5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

Compare Source

What's Changed

• docs(contributing): ask for issues instead of RPs #​5526
• docs(readme): sync the contributing list with CONTRIBUTING.md #​5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range #​5537
• chore: unified oxfmt and oxlint config #​5518
• docs(readme): remove the deepwiki badge #​5548
• fix(serve-static): only serve GET and HEAD requests #​5514
• fix(build): keep barrel imports in the bundled d.ts #​5557
• fix(jsx): preserve self-closing void elements in cloneElement #​5314
• fix(css): keep "//" inside an unquoted url() when minifying #​5450
• fix(css): keep the descendant combinator before a pseudo-class when minifying #​5451
• fix(serve-static): respect q-values in Accept-Encoding for precompressed files #​5436
• fix(helper/route): match regex params in basePath() the same way as the router #​5498
• fix(trie-router): keep first value for duplicate path params #​5423
• fix(hono-base): disallow getPath when strict is false #​5563
• fix(css): Fix multiline CSS handling in style replacement #​5405
• feat(bearer-auth): allow MessageFunction to return a Response #​5269
• fix(utils/url): preserve encoded duplicate query order #​5495

Full Changelog: honojs/hono@v4.13.13...v4.13.14

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.