Skip to content

[Snyk] Upgrade hono from 4.6.12 to 4.7.9#122

Open
nerdy-tech-com-gitub wants to merge 1 commit intodevfrom
snyk-upgrade-3de7b1f5cb4b457d110f62771eca83a1
Open

[Snyk] Upgrade hono from 4.6.12 to 4.7.9#122
nerdy-tech-com-gitub wants to merge 1 commit intodevfrom
snyk-upgrade-3de7b1f5cb4b457d110f62771eca83a1

Conversation

@nerdy-tech-com-gitub
Copy link
Owner

@nerdy-tech-com-gitub nerdy-tech-com-gitub commented Jun 5, 2025 •
edited by sourcery-ai bot
Loading

snyk-top-banner

Snyk has created this PR to upgrade hono from 4.6.12 to 4.7.9.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 18 versions ahead of your current version.

  • The recommended version was released a month ago.

Release notes
Package name: hono
  • 4.7.9 - 2025-05-09

    What's Changed

    New Contributors

    Full Changelog: v4.7.8...v4.7.9

  • 4.7.8 - 2025-04-28

    What's Changed

    • chore(deps): bump wrangler to 4.12.0 by @ yusukebe in #4096
    • feat(ws): allow to use upgradeWebSocket in handler by @ nakasyou in #3942
    • feat(hono-base): Added replaceRequest: false option for .mount by @ geelen in #4113

    New Contributors

    Full Changelog: v4.7.7...v4.7.8

  • 4.7.7 - 2025-04-15

    What's Changed

    New Contributors

    Full Changelog: v4.7.6...v4.7.7

  • 4.7.6 - 2025-04-08

    What's Changed

    New Contributors

    Full Changelog: v4.7.5...v4.7.6

  • 4.7.5 - 2025-03-20

    What's Changed

    New Contributors

    Full Changelog: v4.7.4...v4.7.5

  • 4.7.4 - 2025-03-05

    What's Changed

    Full Changelog: v4.7.3...v4.7.4

  • 4.7.3 - 2025-03-05

    What's Changed

    • refactor: support TypeScript 5.7 for Deno 2.2 by @ yusukebe in #3939
    • refactor(pattern-router): reduce bundle size and fix comments by @ EdamAme-x in #3936
    • fix(bun): export BunWebSocketHandler by @ yusukebe in #3964
    • fix(hono-base): prevent options object mutation by @ yusukebe in #3975
    • perf(utils/url): Short circuit the regex in checkOptionalParameter by @ csainty in #3974

    New Contributors

    Full Changelog: v4.7.2...v4.7.3

  • 4.7.2 - 2025-02-18

    What's Changed

    Full Changelog: v4.7.1...v4.7.2

  • 4.7.1 - 2025-02-13

    What's Changed

    • refactor(helper/streaming): remove unused variables by @ EdamAme-x in #3904
    • fix(combine): halt middleware evaluation if error in next() by @ usualoma in #3905
    • fix(utils/url): calculate ends with slash on every iteration by @ luxass in #3910
    • perf(utils/url): shorten mergePath and optimize for normal use cases. by @ usualoma in #3911
    • fix(adapter/aws-lambda): remove unneeded import and compatibility for LLRT by @ EdamAme-x in #3915
    • fix(etag): change where to check for crypto by @ EdamAme-x in #3916

    New Contributors

    Full Changelog: v4.7.0...v4.7.1

  • 4.7.0 - 2025-02-07

    Release Notes

    Hono v4.7.0 is now available!

    This release introduces one helper and two middleware.

    • Proxy Helper
    • Language Middleware
    • JWK Auth Middleware

    Plus, Standard Schema Validator has been born.

    Let's look at each of these.

    Proxy Helper

    We sometimes use the Hono application as a reverse proxy. In that case, it accesses the backend using fetch. However, it sends an unintended headers.

    app.all('/proxy/:path', (c) => {
  // Send unintended header values to the origin server
  return fetch(`http://${originServer}/${c.req.param('path')}`)
})

    For example, fetch may send Accept-Encoding, causing the origin server to return a compressed response. Some runtimes automatically decode it, leading to a Content-Length mismatch and potential client-side errors.

    Also, you should probably remove some of the headers sent from the origin server, such as Transfer-Encoding.

    Proxy Helper will send requests to the origin and handle responses properly. The above headers problem is solved simply by writing as follows.

    import { Hono } from 'hono'
    import { proxy } from 'hono/proxy'

    app.get('/proxy/:path', (c) => {
    return proxy(http://<span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">originServer</span><span class="pl-kos">}</span></span>/<span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">c</span><span class="pl-kos">.</span><span class="pl-c1">req</span><span class="pl-kos">.</span><span class="pl-en">param</span><span class="pl-kos">(</span><span class="pl-s">'path'</span><span class="pl-kos">)</span><span class="pl-kos">}</span></span>)
    })

    You can also use it in more complex ways.

    app.get('/proxy/:path', async (c) => {
  const res = await proxy(
    `http://${originServer}/${c.req.param('path')}`,
    {
      headers: {
        ...c.req.header(),
        'X-Forwarded-For': '127.0.0.1',
        'X-Forwarded-Host': c.req.header('host'),
        Authorization: undefined,
      },
    }
  )
  res.headers.delete('Set-Cookie')
  return res
})

    Thanks @ usualoma!

    Language Middleware

    Language Middleware provides 18n functions to Hono applications. By using the languageDetector function, you can get the language that your application should support.

    import { Hono } from 'hono'
    import { languageDetector } from 'hono/language'

    const app = new Hono()

    app.use(
    languageDetector({
    supportedLanguages: ['en', 'ar', 'ja'], // Must include fallback
    fallbackLanguage: 'en', // Required
    })
    )

    app.get('/', (c) => {
    const lang = c.get('language')
    return c.text(Hello! Your language is <span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">lang</span><span class="pl-kos">}</span></span>)
    })

    You can get the target language in various ways, not just by using Accept-Language.

    • Query parameters
    • Cookies
    • Accept-Language header
    • URL path

    Thanks @ lord007tn!

    JWK Auth Middleware

    Finally, middleware that supports JWK (JSON Web Key) has landed. Using JWK Auth Middleware, you can authenticate by verifying JWK tokens. It can access keys fetched from the specified URL.

    import { Hono } from 'hono'
    import { jwk } from 'hono/jwk'

    app.use(
    '/auth/*',
    jwk({
    jwks_uri: https://<span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">backendServer</span><span class="pl-kos">}</span></span>/.well-known/jwks.json,
    })
    )

    app.get('/auth/page', (c) => {
    return c.text('You are authorized')
    })

    Thanks @ Beyondo!

    Standard Schema Validator

    Standard Schema provides a common interface for TypeScript validator libraries. Standard Schema Validator is a validator that uses it. This means that Standard Schema Validator can handle several validators, such as Zod, Valibot, and ArkType, with the same interface.

    The code below really works!

    import { Hono } from 'hono'
    import { sValidator } from '@ hono/standard-validator'
    import { type } from 'arktype'
    import * as v from 'valibot'
    import { z } from 'zod'

    const aSchema = type({
    agent: 'string',
    })

    const vSchema = v.object({
    slag: v.string(),
    })

    const zSchema = z.object({
    name: z.string(),
    })

    const app = new Hono()

    app.get(
    '/:slag',
    sValidator('header', aSchema),
    sValidator('param', vSchema),
    sValidator('query', zSchema),
    (c) => {
    const headerValue = c.req.valid('header')
    const paramValue = c.req.valid('param')
    const queryValue = c.req.valid('query')
    return c.json({ headerValue, paramValue, queryValue })
    }
    )

    const res = await app.request('/foo?name=foo', {
    headers: {
    agent: 'foo',
    },
    })

    console.log(await res.json())

    Thanks @ muningis!

    New features

    • feat(helper/proxy): introduce proxy helper #3589
    • feat(logger): include query params #3702
    • feat: add language detector middleware and helpers #3787
    • feat(hono/context): add buffer returns #3813
    • feat(hono/jwk): JWK Auth Middleware #3826
    • feat(etag): allow for custom hashing methods to be used to etag #3832
    • feat(router): support greedy matches with subsequent static components #3888

    All changes

@snyk-bot
fix: upgrade hono from 4.6.12 to 4.7.9
da9c2c5 
Snyk has created this PR to upgrade hono from 4.6.12 to 4.7.9.

See this package in npm:
hono

See this project in Snyk:
https://app.snyk.io/org/nerds-github/project/7ac3a559-e245-43bc-aea8-6d68ed454985?utm_source=github&utm_medium=referral&page=upgrade-pr
@sourcery-ai
Copy link

sourcery-ai bot commented Jun 5, 2025 •
edited
Loading

Reviewer's Guide

This PR bumps the project's Hono dependency from version 4.6.12 to 4.7.9 by updating the version string in package.json to incorporate the latest fixes and improvements.

File-Level Changes

Change Details Files
Upgrade Hono dependency
  • Replace Hono version 4.6.12 with 4.7.9 in dependencies
 apps/main/package.json
Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@nerdy-tech-com-gitub @snyk-bot

Comments