Hono Releases

GET https://watchchangelog.com/api/v1/entries?source=hono.releases

{
  "source": "hono.releases",
  "vendor": "Hono",
  "id": "tag:github.com,2008:Repository/438384984/v4.13.5",
  "published_at": "2026-08-26T02:00:33.000Z",
  "title": "v4.13.5",
  "url": "https://github.com/honojs/hono/releases/tag/v4.13.5",
  "summary": "Security fixes This release includes fixes for the following security issues: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx Incomplete fix for CVE-2026-39408 : toSSG() still writes files outside the output directory Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv Unbounded dot-notation nesting in parseBody() can cause memory exhaustion Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.",
  "tags": [
    "Hono",
    "hono.releases",
    "framework",
    "edge",
    "typescript"
  ]
}