From 6ea514d6ff09e84599ac35c0e885f62be2aa44a3 Mon Sep 17 00:00:00 2001
From: Nanasi <71248588+spellsaif@users.noreply.github.com>
Date: Thu, 13 Aug 2026 17:19:37 +0530
Subject: [PATCH 1/2] feat(secure-headers): add missing W3C Permissions-Policy
 directives (#5214)

* feat(secure-headers): add missing W3C Permissions-Policy directives

* feat(secure-headers): add missing W3C Permissions-Policy directives and spec references

* remove unnecessary directives and comments

---------

Co-authored-by: Yusuke Wada <yusuke@kamawada.com>
---
 src/middleware/secure-headers/index.test.ts       |  5 ++++-
 .../secure-headers/permissions-policy.ts          | 15 +++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/src/middleware/secure-headers/index.test.ts b/src/middleware/secure-headers/index.test.ts
index aa8d8dfcd8..cf56337e3a 100644
--- a/src/middleware/secure-headers/index.test.ts
+++ b/src/middleware/secure-headers/index.test.ts
@@ -181,6 +181,8 @@ describe('Secure Headers Middleware', () => {
           accelerometer: ['https://*.example.com'],
           gyroscope: ['src'],
           magnetometer: ['https://a.example.com', 'https://b.example.com'],
+          mediasession: ['self'],
+          deferredFetch: ['none'],
         },
       })
     )
@@ -190,7 +192,8 @@ describe('Secure Headers Middleware', () => {
       'fullscreen=(self), bluetooth=(), payment=(self "example.com"), sync-xhr=(), camera=(), microphone=*, ' +
         'geolocation=*, usb=(self "https://a.example.com" "https://b.example.com"), ' +
         'accelerometer=("https://*.example.com"), gyroscope=(src), ' +
-        'magnetometer=("https://a.example.com" "https://b.example.com")'
+        'magnetometer=("https://a.example.com" "https://b.example.com"), ' +
+        'mediasession=(self), deferred-fetch=()'
     )
   })
 
diff --git a/src/middleware/secure-headers/permissions-policy.ts b/src/middleware/secure-headers/permissions-policy.ts
index de8c90c357..32b1b6e4f6 100644
--- a/src/middleware/secure-headers/permissions-policy.ts
+++ b/src/middleware/secure-headers/permissions-policy.ts
@@ -21,6 +21,7 @@ type StandardizedFeatures =
   | 'chUaBitness'
   | 'chUaFullVersion'
   | 'chUaFullVersionList'
+  | 'chUaHighEntropyValues'
   | 'chUaMobile'
   | 'chUaModel'
   | 'chUaPlatform'
@@ -41,9 +42,11 @@ type StandardizedFeatures =
   | 'idleDetection'
   | 'keyboardMap'
   | 'magnetometer'
+  | 'mediasession'
   | 'microphone'
   | 'midi'
   | 'navigationOverride'
+  | 'otpCredentials'
   | 'payment'
   | 'pictureInPicture'
   | 'publickeyCredentialsGet'
@@ -51,6 +54,7 @@ type StandardizedFeatures =
   | 'serial'
   | 'storageAccess'
   | 'syncXhr'
+  | 'tools'
   | 'usb'
   | 'webShare'
   | 'windowManagement'
@@ -60,11 +64,20 @@ type StandardizedFeatures =
  * These features have been proposed, but the definitions have not yet been integrated into their respective specs.
  */
 type ProposedFeatures =
+  | 'autofill'
   | 'clipboardRead'
   | 'clipboardWrite'
+  | 'deferredFetch'
   | 'gamepad'
+  | 'languageDetector'
+  | 'languageModel'
+  | 'manualText'
+  | 'rewriter'
   | 'sharedAutofill'
   | 'speakerSelection'
+  | 'summarizer'
+  | 'translator'
+  | 'writer'
 
 /**
  * These features generally have an explainer only, but may be available for experimentation by web developers.
@@ -74,10 +87,12 @@ type ExperimentalFeatures =
   | 'browsingTopics'
   | 'capturedSurfaceControl'
   | 'conversionMeasurement'
+  | 'digitalCredentialsCreate'
   | 'digitalCredentialsGet'
   | 'focusWithoutUserActivation'
   | 'joinAdInterestGroup'
   | 'localFonts'
+  | 'monetization'
   | 'runAdAuction'
   | 'smartCard'
   | 'syncScript'

From 41bdc4288ed7023c24d35f32bd065bd963435e3e Mon Sep 17 00:00:00 2001
From: Yusuke Wada <yusuke@kamawada.com>
Date: Thu, 13 Aug 2026 20:52:44 +0900
Subject: [PATCH 2/2] 4.13.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ce2a644de2..cc5f10e65a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.1",
+  "version": "4.13.2",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",