@depup/hono 4.13.4-depup.0 → 4.13.7-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/hono
 
 | Field | Value |
 |-------|-------|
-| Original | [hono](https://www.npmjs.com/package/hono) @ 4.13.4 |
-| Processed | 2026-08-24 |
+| Original | [hono](https://www.npmjs.com/package/hono) @ 4.13.7 |
+| Processed | 2026-09-05 |
 | Smoke test | passed |
 | Deps updated | 0 |
 

package/changes.json

@@ -1,5 +1,5 @@
 {
   "bumped": {},
-  "timestamp": "2026-08-24T16:12:28.189Z",
+  "timestamp": "2026-09-05T00:31:16.725Z",
   "totalUpdated": 0
 }

package/dist/cjs/client/client.js

@@ -157,24 +157,24 @@ const hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
   const path = parts.join("/");
   const url = (0, import_utils.mergePath)(baseUrl, path);
   if (method === "url" || method === "path") {
-    let result = url;
+    let result = (0, import_utils.removeIndexString)(url);
     if (opts.args[0]) {
       if (opts.args[0].param) {
-        result = (0, import_utils.replaceUrlParam)(url, opts.args[0].param);
+        result = (0, import_utils.replaceUrlParam)(result, opts.args[0].param);
       }
       if (opts.args[0].query) {
         result = appendQueryParams(result, buildSearchParamsOption(opts.args[0].query));
       }
     }
-    result = (0, import_utils.removeIndexString)(result);
     if (method === "url") {
       return new URL(result);
     }
     return result.slice(baseUrl.replace(/\/+$/, "").length).replace(/^\/?/, "/");
   }
   if (method === "ws") {
+    const normalizedUrl = (0, import_utils.removeIndexString)(url);
     const webSocketUrl = (0, import_utils.replaceUrlProtocol)(
-      opts.args[0]?.param ? (0, import_utils.replaceUrlParam)(url, opts.args[0].param) : url,
+      opts.args[0]?.param ? (0, import_utils.replaceUrlParam)(normalizedUrl, opts.args[0].param) : normalizedUrl,
       "ws"
     );
     const targetUrl = new URL(webSocketUrl);

package/dist/cjs/helper/ssg/ssg.js

@@ -206,7 +206,7 @@ const saveContentToFile = async (data, fsModule, outDir, extensionMap) => {
   const { routePath, content, mimeType } = awaitedData;
   const filePath = generateFilePath(routePath, outDir, mimeType, extensionMap);
   const dirPath = (0, import_utils2.dirname)(filePath);
-  if (!createdDirs.has(dirPath)) {
+  if (dirPath !== "" && !createdDirs.has(dirPath)) {
     await fsModule.mkdir(dirPath, { recursive: true });
     createdDirs.add(dirPath);
   }

package/dist/cjs/helper/ssg/utils.js

@@ -33,8 +33,14 @@ const dirname = (path) => {
 const normalizePath = (path) => {
   return path.replace(/(\\)/g, "/").replace(/\/$/g, "");
 };
-const handleParent = (resultPaths, beforeParentFlag) => {
-  if (resultPaths.length === 0 || beforeParentFlag) {
+const getUncRoot = (path) => {
+  const uncRoot = path.replace(/\\/g, "/").match(/^\/\/([^/]+)\/([^/]+)/);
+  if (uncRoot) {
+    return `${uncRoot[1].toLowerCase()}/${uncRoot[2].toLowerCase()}`;
+  }
+};
+const handleParent = (resultPaths) => {
+  if (resultPaths.length === 0 || resultPaths[resultPaths.length - 1] === "..") {
     resultPaths.push("..");
   } else {
     resultPaths.pop();
@@ -47,22 +53,20 @@ const handleNonDot = (path, resultPaths) => {
   }
 };
 const handleSegments = (paths, resultPaths) => {
-  let beforeParentFlag = false;
   for (const path of paths) {
     if (path === "..") {
-      handleParent(resultPaths, beforeParentFlag);
-      beforeParentFlag = true;
+      handleParent(resultPaths);
     } else {
       handleNonDot(path, resultPaths);
-      beforeParentFlag = false;
     }
   }
 };
 const joinPaths = (...paths) => {
+  const hasUncPrefix = getUncRoot(paths[0]) !== void 0;
   paths = paths.map(normalizePath);
   const resultPaths = [];
   handleSegments(paths.join("/").split("/"), resultPaths);
-  return (paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
+  return (hasUncPrefix ? "//" : paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
 };
 const filterStaticGenerateRoutes = (hono) => {
   return hono.routes.reduce((acc, { method, handler, path }) => {
@@ -76,10 +80,26 @@ const filterStaticGenerateRoutes = (hono) => {
 const isDynamicRoute = (path) => {
   return path.split("/").some((segment) => segment.startsWith(":") || segment.includes("*"));
 };
+const toSegments = (path) => path === "" ? [] : path.split("/");
+const getPathRoot = (path) => {
+  const normalizedPath = path.replace(/\\/g, "/");
+  const uncRoot = getUncRoot(normalizedPath);
+  if (uncRoot) {
+    return `unc:${uncRoot}`;
+  }
+  const driveRoot = normalizedPath.match(/^([A-Za-z]):/);
+  if (driveRoot) {
+    const kind = normalizedPath[2] === "/" ? "drive-absolute" : "drive-relative";
+    return `${kind}:${driveRoot[1].toLowerCase()}`;
+  }
+  return normalizedPath.startsWith("/") ? "absolute" : "relative";
+};
 const ensureWithinOutDir = (outDir, filePath) => {
-  const normalizedOutDir = joinPaths("/", outDir);
-  const normalizedFilePath = joinPaths("/", filePath);
-  if (normalizedFilePath !== normalizedOutDir && !normalizedFilePath.startsWith(`${normalizedOutDir}/`)) {
+  const outDirSegments = toSegments(joinPaths(outDir));
+  const filePathSegments = toSegments(joinPaths(filePath));
+  const hasMismatchedPathRoot = getPathRoot(outDir) !== getPathRoot(filePath);
+  const climbsAboveOutDir = filePathSegments[outDirSegments.length] === "..";
+  if (hasMismatchedPathRoot || filePathSegments.length <= outDirSegments.length || !outDirSegments.every((segment, i) => segment === filePathSegments[i]) || climbsAboveOutDir) {
     throw new Error(`Path traversal detected: "${filePath}" is outside the output directory`);
   }
 };

package/dist/cjs/hono-base.js

@@ -61,13 +61,14 @@ class Hono {
     const allMethods = [...import_router.METHODS, import_router.METHOD_NAME_ALL_LOWERCASE];
     allMethods.forEach((method) => {
       this[method] = (args1, ...args) => {
+        const methodName = method.toUpperCase();
         if (typeof args1 === "string") {
           this.#path = args1;
         } else {
-          this.#addRoute(method, this.#path, args1);
+          this.#addRoute(methodName, this.#path, args1);
         }
         args.forEach((handler) => {
-          this.#addRoute(method, this.#path, handler);
+          this.#addRoute(methodName, this.#path, handler);
         });
         return this;
       };
@@ -76,9 +77,10 @@ class Hono {
       for (const p of [path].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
-          handlers.map((handler) => {
-            this.#addRoute(m.toUpperCase(), this.#path, handler);
-          });
+          const methodName = m.toUpperCase();
+          for (const handler of handlers) {
+            this.#addRoute(methodName, this.#path, handler);
+          }
         }
       }
       return this;
@@ -279,7 +281,6 @@ class Hono {
     return this;
   }
   #addRoute(method, path, handler, baseRoutePath) {
-    method = method.toUpperCase();
     path = (0, import_url.mergePath)(this._basePath, path);
     const r = {
       basePath: baseRoutePath !== void 0 ? (0, import_url.mergePath)(this._basePath, baseRoutePath) : this._basePath,

package/dist/cjs/jsx/base.js

@@ -33,11 +33,14 @@ __export(base_exports, {
   booleanAttributes: () => booleanAttributes,
   cloneElement: () => cloneElement,
   getNameSpaceContext: () => getNameSpaceContext,
+  isUntrustedObject: () => isUntrustedObject,
   isValidElement: () => isValidElement,
   jsx: () => jsx,
   jsxFn: () => jsxFn,
   memo: () => memo,
   reactAPICompatVersion: () => reactAPICompatVersion,
+  renderChildren: () => renderChildren,
+  renderUntrustedObject: () => renderUntrustedObject,
   shallowEqual: () => shallowEqual
 });
 module.exports = __toCommonJS(base_exports);
@@ -101,7 +104,7 @@ const booleanAttributes = [
   "selected"
 ];
 const resolveFunctionComponentResult = (result, suspendedContext) => result.then((resolved) => {
-  if (!Array.isArray(resolved) && !(resolved instanceof JSXNode)) {
+  if (typeof resolved !== "string" && !Array.isArray(resolved) && !(resolved instanceof JSXNode)) {
     return resolved;
   }
   const children = Array.isArray(resolved) ? resolved : [resolved];
@@ -139,6 +142,17 @@ const childrenToStringToBuffer = (children, buffer) => {
     }
   }
 };
+const renderChildren = (children) => (0, import_context.runWithRenderContext)(() => {
+  const buffer = [""];
+  childrenToStringToBuffer(children, buffer);
+  return buffer.length === 1 ? (0, import_html.raw)(buffer[0], buffer.callbacks) : (0, import_html2.stringBufferToString)(buffer, buffer.callbacks);
+});
+const isUntrustedObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof JSXNode) && !(value instanceof Promise) && !value.isEscaped && typeof value.toString === "function";
+const renderUntrustedObject = (value) => {
+  const stringified = value.toString();
+  const escape = (result) => renderChildren([String(result)]);
+  return stringified instanceof Promise ? stringified.then(escape) : escape(stringified);
+};
 class JSXNode {
   tag;
   props;
@@ -369,10 +383,13 @@ const reactAPICompatVersion = "19.0.0-hono-jsx";
   booleanAttributes,
   cloneElement,
   getNameSpaceContext,
+  isUntrustedObject,
   isValidElement,
   jsx,
   jsxFn,
   memo,
   reactAPICompatVersion,
+  renderChildren,
+  renderUntrustedObject,
   shallowEqual
 });

package/dist/cjs/jsx/components.js

@@ -31,7 +31,7 @@ var import_streaming = require("./streaming");
 let errorBoundaryCounter = 0;
 const childrenToString = async (children) => {
   try {
-    return children.flat().map((c) => c == null || typeof c === "boolean" ? "" : c.toString());
+    return children.flat().map(resolveChildEarly);
   } catch (e) {
     if (e instanceof Promise) {
       const resume = (0, import_context.captureRenderContext)();
@@ -42,18 +42,16 @@ const childrenToString = async (children) => {
     }
   }
 };
-const resolveChildEarly = (c) => {
-  if (c == null || typeof c === "boolean") {
+const resolveChildEarly = (child) => {
+  if (child == null || typeof child === "boolean") {
     return "";
-  } else if (typeof c === "string") {
-    return c;
+  } else if (typeof child === "string" || Array.isArray(child)) {
+    return (0, import_base.renderChildren)([child]);
+  } else if ((0, import_base.isUntrustedObject)(child)) {
+    return (0, import_base.renderUntrustedObject)(child);
   } else {
-    const str = c.toString();
-    if (!(str instanceof Promise)) {
-      return (0, import_html.raw)(str);
-    } else {
-      return str;
-    }
+    const str = child.toString();
+    return str instanceof Promise ? str : (0, import_html.raw)(str);
   }
 };
 const ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) => {
@@ -69,26 +67,27 @@ const ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) =>
   let fallbackStrPromise;
   const resolveFallbackStr = () => fallbackStrPromise ||= (async () => {
     const awaitedFallback = await fallback;
-    if (typeof awaitedFallback === "string") {
-      return awaitedFallback;
-    } else {
-      const fallbackResult = await getResume()(() => awaitedFallback?.toString());
-      if (typeof fallbackResult === "string") {
-        return (0, import_html.raw)(
-          fallbackResult,
-          fallbackResult.callbacks || awaitedFallback?.callbacks
-        );
-      }
+    if (awaitedFallback === null || awaitedFallback === void 0) {
+      return;
+    }
+    if (typeof awaitedFallback === "string" || Array.isArray(awaitedFallback)) {
+      return getResume()(() => (0, import_base.renderChildren)([awaitedFallback]));
+    }
+    if ((0, import_base.isUntrustedObject)(awaitedFallback)) {
+      return getResume()(() => (0, import_base.renderUntrustedObject)(awaitedFallback));
     }
+    const fallbackResult = await getResume()(() => awaitedFallback.toString());
+    return (0, import_html.raw)(
+      fallbackResult,
+      fallbackResult.callbacks || awaitedFallback.callbacks
+    );
   })();
   const renderFallback = async (error) => {
     const fallbackStr = await resolveFallbackStr();
     return getResume()(async () => {
       onError?.(error);
       const fallbackRes = fallbackStr !== void 0 ? fallbackStr : fallbackRender && (0, import_base.jsx)(import_base.Fragment, {}, fallbackRender(error)) || "";
-      const fallbackResString = await (0, import_base.Fragment)({
-        children: fallbackRes
-      }).toString();
+      const fallbackResString = await (0, import_base.Fragment)({ children: fallbackRes }).toString();
       return (0, import_html.raw)(
         fallbackResString,
         fallbackResString.callbacks || fallbackRes.callbacks
@@ -121,7 +120,7 @@ const ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) =>
       const fallbackResString = await renderFallback(error2);
       const fallbackCallbacks = fallbackResString.callbacks;
       if (buffer) {
-        buffer[0] = buffer[0].replace(replaceRe, fallbackResString);
+        buffer[0] = buffer[0].replace(replaceRe, () => fallbackResString);
         return fallbackCallbacks?.length ? (0, import_html.raw)("", fallbackCallbacks) : "";
       }
       return (0, import_html.raw)(
@@ -160,7 +159,7 @@ d.parentElement.insertBefore(c.content,d.nextSibling)
 </script>`;
           if (htmlArray.every((html2) => !html2.callbacks?.length)) {
             if (buffer) {
-              buffer[0] = buffer[0].replace(replaceRe, content);
+              buffer[0] = buffer[0].replace(replaceRe, () => content);
             }
             return html;
           }

package/dist/cjs/jsx/context.js

@@ -155,18 +155,18 @@ const createContext = (defaultValue) => {
   const context = ((props) => {
     const contextValues = getContextValuesIn(getCurrentStore(), context);
     contextValues.push(props.value);
-    let string;
+    let rendered;
     try {
-      string = props.children ? (Array.isArray(props.children) ? new import_base.JSXFragmentNode("", {}, props.children) : props.children).toString() : "";
+      rendered = typeof props.children === "string" ? (0, import_base.renderChildren)([props.children]) : (0, import_base.isUntrustedObject)(props.children) ? (0, import_base.renderUntrustedObject)(props.children) : props.children ? (Array.isArray(props.children) ? new import_base.JSXFragmentNode("", {}, props.children) : props.children).toString() : (0, import_html.raw)("");
     } catch (e) {
       contextValues.pop();
       throw e;
     }
-    if (string instanceof Promise) {
-      return string.finally(() => contextValues.pop()).then((resString) => (0, import_html.raw)(resString, resString.callbacks));
+    if (rendered instanceof Promise) {
+      return rendered.finally(() => contextValues.pop()).then((resString) => (0, import_html.raw)(resString, resString.callbacks));
     } else {
       contextValues.pop();
-      return (0, import_html.raw)(string);
+      return (0, import_html.raw)(rendered);
     }
   });
   context.values = values;

package/dist/cjs/jsx/dom/server.js

@@ -33,13 +33,16 @@ __export(server_exports, {
   version: () => import__.default
 });
 module.exports = __toCommonJS(server_exports);
+var import_base = require("../base");
 var import_streaming = require("../streaming");
 var import__ = __toESM(require("./"), 1);
+const prepareRoot = (element) => typeof element === "string" || Array.isArray(element) ? (0, import_base.renderChildren)([element]) : element;
 const renderToString = (element, options = {}) => {
   if (Object.keys(options).length > 0) {
     console.warn("options are not supported yet");
   }
-  const res = element?.toString() ?? "";
+  element = prepareRoot(element);
+  const res = element instanceof Promise ? element : element?.toString() ?? "";
   if (typeof res !== "string") {
     throw new Error("Async component is not supported in renderToString");
   }
@@ -49,6 +52,7 @@ const renderToReadableStream = async (element, options = {}) => {
   if (Object.keys(options).some((key) => key !== "onError")) {
     console.warn("options are not supported yet, except onError");
   }
+  element = prepareRoot(element);
   if (!element || typeof element !== "object") {
     element = element?.toString() ?? "";
   }

package/dist/cjs/jsx/intrinsic-element/components.js

@@ -85,10 +85,10 @@ const insertIntoHead = (tagName, tag, props, precedence) => ({ buffer, context }
     insertTags.forEach((tag2) => {
       buffer[0] = buffer[0].replaceAll(tag2, "");
     });
-    buffer[0] = buffer[0].replace(/(?=<\/head>)/, insertTags.join(""));
+    buffer[0] = buffer[0].replace(/(?=<\/head>)/, () => insertTags.join(""));
   }
 };
-const returnWithoutSpecialBehavior = (tag, children, props) => (0, import_html.raw)(new import_base.JSXNode(tag, props, (0, import_children.toArray)(children ?? [])).toString());
+const returnWithoutSpecialBehavior = (tag, children, props) => (0, import_base.renderChildren)([new import_base.JSXNode(tag, props, (0, import_children.toArray)(children ?? []))]);
 const documentMetadataTag = (tag, children, props, sort) => {
   if ("itemProp" in props) {
     return returnWithoutSpecialBehavior(tag, children, props);

package/dist/cjs/jsx/streaming.js

@@ -32,6 +32,7 @@ var import_components2 = require("./dom/components");
 var import_render = require("./dom/render");
 const StreamingContext = (0, import_context.createContext)(null);
 let suspenseCounter = 0;
+const serializeBoundaryChild = (child) => typeof child === "string" || Array.isArray(child) ? (0, import_base.renderChildren)([child]) : child == null || typeof child === "boolean" ? "" : (0, import_base.isUntrustedObject)(child) ? (0, import_base.renderUntrustedObject)(child) : child.toString();
 const Suspense = async ({
   children,
   fallback
@@ -48,9 +49,7 @@ const Suspense = async ({
   try {
     stackNode[import_constants.DOM_STASH][0] = 0;
     import_render.buildDataStack.push([[], stackNode]);
-    resArray = children.map(
-      (c) => c == null || typeof c === "boolean" ? "" : c.toString()
-    );
+    resArray = children.map(serializeBoundaryChild);
   } catch (e) {
     if (e instanceof Promise) {
       const resume = (0, import_context.captureRenderContext)();
@@ -71,7 +70,7 @@ const Suspense = async ({
   }
   if (resArray.some((res) => res instanceof Promise)) {
     const index = suspenseCounter++;
-    const fallbackStr = await fallback.toString();
+    const fallbackStr = await (typeof fallback === "string" || Array.isArray(fallback) ? (0, import_base.renderChildren)([fallback]) : (0, import_base.isUntrustedObject)(fallback) ? (0, import_base.renderUntrustedObject)(fallback) : fallback.toString());
     return (0, import_html.raw)(`<template id="H:${index}"></template>${fallbackStr}<!--/$-->`, [
       ...fallbackStr.callbacks || [],
       ({ phase, buffer, context }) => {
@@ -84,7 +83,7 @@ const Suspense = async ({
           if (buffer) {
             buffer[0] = buffer[0].replace(
               new RegExp(`<template id="H:${index}"></template>.*?<!--/\\$-->`),
-              content
+              () => content
             );
           }
           let html = buffer ? "" : `<template data-hono-target="H:${index}">${content}</template><script${nonce ? ` nonce="${nonce}"` : ""}>

package/dist/cjs/middleware/cache/index.js

@@ -44,7 +44,7 @@ const parseVaryDirectives = (vary) => {
 };
 const createCacheKey = (key, requestUrl, request, varyHeaders) => {
   const url = new URL(cacheKeyPath, requestUrl);
-  url.searchParams.append(cacheKeyParameter, key.split("#", 1)[0]);
+  url.searchParams.append(cacheKeyParameter, key);
   url.searchParams.append(cacheMethodKeyParameter, request.method);
   if (request.method === "QUERY") {
     url.searchParams.append(queryDigestKeyParameter, request.digest);

package/dist/cjs/utils/body.js

@@ -21,6 +21,8 @@ __export(body_exports, {
 });
 module.exports = __toCommonJS(body_exports);
 var import_buffer = require("./buffer");
+const MAX_NESTING_DEPTH = 32;
+const MAX_NESTED_OBJECTS = 1e4;
 const isRawRequest = (request) => "headers" in request;
 const parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -53,6 +55,7 @@ async function parseFormData(request, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -65,7 +68,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value);
+        handleParsingNestedValues(form, key, value, nestingState);
         delete form[key];
       }
     });
@@ -88,23 +91,32 @@ const handleParsingAllValues = (form, key, value) => {
     }
   }
 };
-const handleParsingNestedValues = (form, key, value) => {
+const handleParsingNestedValues = (form, key, value, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+const throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   parseBody

package/dist/cjs/utils/url.js

@@ -119,7 +119,11 @@ const getPath = (request) => {
 };
 const getQueryStrings = (url) => {
   const queryIndex = url.indexOf("?", 8);
-  return queryIndex === -1 ? "" : "?" + url.slice(queryIndex + 1);
+  if (queryIndex === -1) {
+    return "";
+  }
+  const hashIndex = url.indexOf("#", 8);
+  return hashIndex === -1 ? url.slice(queryIndex) : queryIndex < hashIndex ? url.slice(queryIndex, hashIndex) : "";
 };
 const getPathNoStrict = (request) => {
   const result = getPath(request);
@@ -166,6 +170,10 @@ const _decodeURI = (value) => {
   return tryDecodeURIComponent(value);
 };
 const _getQueryParam = (url, key, multiple) => {
+  const hashIndex = url.indexOf("#", 8);
+  if (hashIndex !== -1) {
+    url = url.slice(0, hashIndex);
+  }
   let encoded;
   if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
     let keyIndex2 = url.indexOf("?", 8);

package/dist/client/client.js

@@ -143,24 +143,24 @@ var hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
   const path = parts.join("/");
   const url = mergePath(baseUrl, path);
   if (method === "url" || method === "path") {
-    let result = url;
+    let result = removeIndexString(url);
     if (opts.args[0]) {
       if (opts.args[0].param) {
-        result = replaceUrlParam(url, opts.args[0].param);
+        result = replaceUrlParam(result, opts.args[0].param);
       }
       if (opts.args[0].query) {
         result = appendQueryParams(result, buildSearchParamsOption(opts.args[0].query));
       }
     }
-    result = removeIndexString(result);
     if (method === "url") {
       return new URL(result);
     }
     return result.slice(baseUrl.replace(/\/+$/, "").length).replace(/^\/?/, "/");
   }
   if (method === "ws") {
+    const normalizedUrl = removeIndexString(url);
     const webSocketUrl = replaceUrlProtocol(
-      opts.args[0]?.param ? replaceUrlParam(url, opts.args[0].param) : url,
+      opts.args[0]?.param ? replaceUrlParam(normalizedUrl, opts.args[0].param) : normalizedUrl,
       "ws"
     );
     const targetUrl = new URL(webSocketUrl);

package/dist/helper/ssg/ssg.js

@@ -184,7 +184,7 @@ var saveContentToFile = async (data, fsModule, outDir, extensionMap) => {
   const { routePath, content, mimeType } = awaitedData;
   const filePath = generateFilePath(routePath, outDir, mimeType, extensionMap);
   const dirPath = dirname(filePath);
-  if (!createdDirs.has(dirPath)) {
+  if (dirPath !== "" && !createdDirs.has(dirPath)) {
     await fsModule.mkdir(dirPath, { recursive: true });
     createdDirs.add(dirPath);
   }

package/dist/helper/ssg/utils.js

@@ -8,8 +8,14 @@ var dirname = (path) => {
 var normalizePath = (path) => {
   return path.replace(/(\\)/g, "/").replace(/\/$/g, "");
 };
-var handleParent = (resultPaths, beforeParentFlag) => {
-  if (resultPaths.length === 0 || beforeParentFlag) {
+var getUncRoot = (path) => {
+  const uncRoot = path.replace(/\\/g, "/").match(/^\/\/([^/]+)\/([^/]+)/);
+  if (uncRoot) {
+    return `${uncRoot[1].toLowerCase()}/${uncRoot[2].toLowerCase()}`;
+  }
+};
+var handleParent = (resultPaths) => {
+  if (resultPaths.length === 0 || resultPaths[resultPaths.length - 1] === "..") {
     resultPaths.push("..");
   } else {
     resultPaths.pop();
@@ -22,22 +28,20 @@ var handleNonDot = (path, resultPaths) => {
   }
 };
 var handleSegments = (paths, resultPaths) => {
-  let beforeParentFlag = false;
   for (const path of paths) {
     if (path === "..") {
-      handleParent(resultPaths, beforeParentFlag);
-      beforeParentFlag = true;
+      handleParent(resultPaths);
     } else {
       handleNonDot(path, resultPaths);
-      beforeParentFlag = false;
     }
   }
 };
 var joinPaths = (...paths) => {
+  const hasUncPrefix = getUncRoot(paths[0]) !== void 0;
   paths = paths.map(normalizePath);
   const resultPaths = [];
   handleSegments(paths.join("/").split("/"), resultPaths);
-  return (paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
+  return (hasUncPrefix ? "//" : paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
 };
 var filterStaticGenerateRoutes = (hono) => {
   return hono.routes.reduce((acc, { method, handler, path }) => {
@@ -51,10 +55,26 @@ var filterStaticGenerateRoutes = (hono) => {
 var isDynamicRoute = (path) => {
   return path.split("/").some((segment) => segment.startsWith(":") || segment.includes("*"));
 };
+var toSegments = (path) => path === "" ? [] : path.split("/");
+var getPathRoot = (path) => {
+  const normalizedPath = path.replace(/\\/g, "/");
+  const uncRoot = getUncRoot(normalizedPath);
+  if (uncRoot) {
+    return `unc:${uncRoot}`;
+  }
+  const driveRoot = normalizedPath.match(/^([A-Za-z]):/);
+  if (driveRoot) {
+    const kind = normalizedPath[2] === "/" ? "drive-absolute" : "drive-relative";
+    return `${kind}:${driveRoot[1].toLowerCase()}`;
+  }
+  return normalizedPath.startsWith("/") ? "absolute" : "relative";
+};
 var ensureWithinOutDir = (outDir, filePath) => {
-  const normalizedOutDir = joinPaths("/", outDir);
-  const normalizedFilePath = joinPaths("/", filePath);
-  if (normalizedFilePath !== normalizedOutDir && !normalizedFilePath.startsWith(`${normalizedOutDir}/`)) {
+  const outDirSegments = toSegments(joinPaths(outDir));
+  const filePathSegments = toSegments(joinPaths(filePath));
+  const hasMismatchedPathRoot = getPathRoot(outDir) !== getPathRoot(filePath);
+  const climbsAboveOutDir = filePathSegments[outDirSegments.length] === "..";
+  if (hasMismatchedPathRoot || filePathSegments.length <= outDirSegments.length || !outDirSegments.every((segment, i) => segment === filePathSegments[i]) || climbsAboveOutDir) {
     throw new Error(`Path traversal detected: "${filePath}" is outside the output directory`);
   }
 };

package/dist/hono-base.js

@@ -40,13 +40,14 @@ var Hono = class _Hono {
     const allMethods = [...METHODS, METHOD_NAME_ALL_LOWERCASE];
     allMethods.forEach((method) => {
       this[method] = (args1, ...args) => {
+        const methodName = method.toUpperCase();
         if (typeof args1 === "string") {
           this.#path = args1;
         } else {
-          this.#addRoute(method, this.#path, args1);
+          this.#addRoute(methodName, this.#path, args1);
         }
         args.forEach((handler) => {
-          this.#addRoute(method, this.#path, handler);
+          this.#addRoute(methodName, this.#path, handler);
         });
         return this;
       };
@@ -55,9 +56,10 @@ var Hono = class _Hono {
       for (const p of [path].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
-          handlers.map((handler) => {
-            this.#addRoute(m.toUpperCase(), this.#path, handler);
-          });
+          const methodName = m.toUpperCase();
+          for (const handler of handlers) {
+            this.#addRoute(methodName, this.#path, handler);
+          }
         }
       }
       return this;
@@ -258,7 +260,6 @@ var Hono = class _Hono {
     return this;
   }
   #addRoute(method, path, handler, baseRoutePath) {
-    method = method.toUpperCase();
     path = mergePath(this._basePath, path);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,

package/dist/jsx/base.js

@@ -70,7 +70,7 @@ var booleanAttributes = [
   "selected"
 ];
 var resolveFunctionComponentResult = (result, suspendedContext) => result.then((resolved) => {
-  if (!Array.isArray(resolved) && !(resolved instanceof JSXNode)) {
+  if (typeof resolved !== "string" && !Array.isArray(resolved) && !(resolved instanceof JSXNode)) {
     return resolved;
   }
   const children = Array.isArray(resolved) ? resolved : [resolved];
@@ -108,6 +108,17 @@ var childrenToStringToBuffer = (children, buffer) => {
     }
   }
 };
+var renderChildren = (children) => runWithRenderContext(() => {
+  const buffer = [""];
+  childrenToStringToBuffer(children, buffer);
+  return buffer.length === 1 ? raw(buffer[0], buffer.callbacks) : stringBufferToString(buffer, buffer.callbacks);
+});
+var isUntrustedObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof JSXNode) && !(value instanceof Promise) && !value.isEscaped && typeof value.toString === "function";
+var renderUntrustedObject = (value) => {
+  const stringified = value.toString();
+  const escape = (result) => renderChildren([String(result)]);
+  return stringified instanceof Promise ? stringified.then(escape) : escape(stringified);
+};
 var JSXNode = class {
   tag;
   props;
@@ -337,10 +348,13 @@ export {
   booleanAttributes,
   cloneElement,
   getNameSpaceContext,
+  isUntrustedObject,
   isValidElement,
   jsx,
   jsxFn,
   memo,
   reactAPICompatVersion,
+  renderChildren,
+  renderUntrustedObject,
   shallowEqual
 };

package/dist/jsx/components.js

@@ -1,7 +1,7 @@
 // src/jsx/components.ts
 import { raw } from "../helper/html/index.js";
 import { HtmlEscapedCallbackPhase, resolveCallback } from "../utils/html.js";
-import { jsx, Fragment } from "./base.js";
+import { jsx, Fragment, isUntrustedObject, renderChildren, renderUntrustedObject } from "./base.js";
 import { DOM_RENDERER } from "./constants.js";
 import { captureRenderContext, useContext } from "./context.js";
 import { ErrorBoundary as ErrorBoundaryDomRenderer } from "./dom/components.js";
@@ -9,7 +9,7 @@ import { StreamingContext } from "./streaming.js";
 var errorBoundaryCounter = 0;
 var childrenToString = async (children) => {
   try {
-    return children.flat().map((c) => c == null || typeof c === "boolean" ? "" : c.toString());
+    return children.flat().map(resolveChildEarly);
   } catch (e) {
     if (e instanceof Promise) {
       const resume = captureRenderContext();
@@ -20,18 +20,16 @@ var childrenToString = async (children) => {
     }
   }
 };
-var resolveChildEarly = (c) => {
-  if (c == null || typeof c === "boolean") {
+var resolveChildEarly = (child) => {
+  if (child == null || typeof child === "boolean") {
     return "";
-  } else if (typeof c === "string") {
-    return c;
+  } else if (typeof child === "string" || Array.isArray(child)) {
+    return renderChildren([child]);
+  } else if (isUntrustedObject(child)) {
+    return renderUntrustedObject(child);
   } else {
-    const str = c.toString();
-    if (!(str instanceof Promise)) {
-      return raw(str);
-    } else {
-      return str;
-    }
+    const str = child.toString();
+    return str instanceof Promise ? str : raw(str);
   }
 };
 var ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) => {
@@ -47,26 +45,27 @@ var ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) => {
   let fallbackStrPromise;
   const resolveFallbackStr = () => fallbackStrPromise ||= (async () => {
     const awaitedFallback = await fallback;
-    if (typeof awaitedFallback === "string") {
-      return awaitedFallback;
-    } else {
-      const fallbackResult = await getResume()(() => awaitedFallback?.toString());
-      if (typeof fallbackResult === "string") {
-        return raw(
-          fallbackResult,
-          fallbackResult.callbacks || awaitedFallback?.callbacks
-        );
-      }
+    if (awaitedFallback === null || awaitedFallback === void 0) {
+      return;
+    }
+    if (typeof awaitedFallback === "string" || Array.isArray(awaitedFallback)) {
+      return getResume()(() => renderChildren([awaitedFallback]));
+    }
+    if (isUntrustedObject(awaitedFallback)) {
+      return getResume()(() => renderUntrustedObject(awaitedFallback));
     }
+    const fallbackResult = await getResume()(() => awaitedFallback.toString());
+    return raw(
+      fallbackResult,
+      fallbackResult.callbacks || awaitedFallback.callbacks
+    );
   })();
   const renderFallback = async (error) => {
     const fallbackStr = await resolveFallbackStr();
     return getResume()(async () => {
       onError?.(error);
       const fallbackRes = fallbackStr !== void 0 ? fallbackStr : fallbackRender && jsx(Fragment, {}, fallbackRender(error)) || "";
-      const fallbackResString = await Fragment({
-        children: fallbackRes
-      }).toString();
+      const fallbackResString = await Fragment({ children: fallbackRes }).toString();
       return raw(
         fallbackResString,
         fallbackResString.callbacks || fallbackRes.callbacks
@@ -99,7 +98,7 @@ var ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) => {
       const fallbackResString = await renderFallback(error2);
       const fallbackCallbacks = fallbackResString.callbacks;
       if (buffer) {
-        buffer[0] = buffer[0].replace(replaceRe, fallbackResString);
+        buffer[0] = buffer[0].replace(replaceRe, () => fallbackResString);
         return fallbackCallbacks?.length ? raw("", fallbackCallbacks) : "";
       }
       return raw(
@@ -138,7 +137,7 @@ d.parentElement.insertBefore(c.content,d.nextSibling)
 </script>`;
           if (htmlArray.every((html2) => !html2.callbacks?.length)) {
             if (buffer) {
-              buffer[0] = buffer[0].replace(replaceRe, content);
+              buffer[0] = buffer[0].replace(replaceRe, () => content);
             }
             return html;
           }

package/dist/jsx/context.js

@@ -1,6 +1,6 @@
 // src/jsx/context.ts
 import { raw } from "../helper/html/index.js";
-import { JSXFragmentNode } from "./base.js";
+import { isUntrustedObject, JSXFragmentNode, renderChildren, renderUntrustedObject } from "./base.js";
 import { DOM_RENDERER } from "./constants.js";
 import { createContextProviderFunction } from "./dom/context.js";
 var globalContexts = [];
@@ -130,18 +130,18 @@ var createContext = (defaultValue) => {
   const context = ((props) => {
     const contextValues = getContextValuesIn(getCurrentStore(), context);
     contextValues.push(props.value);
-    let string;
+    let rendered;
     try {
-      string = props.children ? (Array.isArray(props.children) ? new JSXFragmentNode("", {}, props.children) : props.children).toString() : "";
+      rendered = typeof props.children === "string" ? renderChildren([props.children]) : isUntrustedObject(props.children) ? renderUntrustedObject(props.children) : props.children ? (Array.isArray(props.children) ? new JSXFragmentNode("", {}, props.children) : props.children).toString() : raw("");
     } catch (e) {
       contextValues.pop();
       throw e;
     }
-    if (string instanceof Promise) {
-      return string.finally(() => contextValues.pop()).then((resString) => raw(resString, resString.callbacks));
+    if (rendered instanceof Promise) {
+      return rendered.finally(() => contextValues.pop()).then((resString) => raw(resString, resString.callbacks));
     } else {
       contextValues.pop();
-      return raw(string);
+      return raw(rendered);
     }
   });
   context.values = values;

package/dist/jsx/dom/server.js

@@ -1,11 +1,14 @@
 // src/jsx/dom/server.ts
+import { renderChildren } from "../base.js";
 import { renderToReadableStream as renderToReadableStreamHono } from "../streaming.js";
 import version from "./index.js";
+var prepareRoot = (element) => typeof element === "string" || Array.isArray(element) ? renderChildren([element]) : element;
 var renderToString = (element, options = {}) => {
   if (Object.keys(options).length > 0) {
     console.warn("options are not supported yet");
   }
-  const res = element?.toString() ?? "";
+  element = prepareRoot(element);
+  const res = element instanceof Promise ? element : element?.toString() ?? "";
   if (typeof res !== "string") {
     throw new Error("Async component is not supported in renderToString");
   }
@@ -15,6 +18,7 @@ var renderToReadableStream = async (element, options = {}) => {
   if (Object.keys(options).some((key) => key !== "onError")) {
     console.warn("options are not supported yet, except onError");
   }
+  element = prepareRoot(element);
   if (!element || typeof element !== "object") {
     element = element?.toString() ?? "";
   }

package/dist/jsx/intrinsic-element/components.js

@@ -1,6 +1,6 @@
 // src/jsx/intrinsic-element/components.ts
 import { raw } from "../../helper/html/index.js";
-import { JSXNode, getNameSpaceContext } from "../base.js";
+import { JSXNode, getNameSpaceContext, renderChildren } from "../base.js";
 import { toArray } from "../children.js";
 import { PERMALINK } from "../constants.js";
 import { useContext } from "../context.js";
@@ -62,10 +62,10 @@ var insertIntoHead = (tagName, tag, props, precedence) => ({ buffer, context })
     insertTags.forEach((tag2) => {
       buffer[0] = buffer[0].replaceAll(tag2, "");
     });
-    buffer[0] = buffer[0].replace(/(?=<\/head>)/, insertTags.join(""));
+    buffer[0] = buffer[0].replace(/(?=<\/head>)/, () => insertTags.join(""));
   }
 };
-var returnWithoutSpecialBehavior = (tag, children, props) => raw(new JSXNode(tag, props, toArray(children ?? [])).toString());
+var returnWithoutSpecialBehavior = (tag, children, props) => renderChildren([new JSXNode(tag, props, toArray(children ?? []))]);
 var documentMetadataTag = (tag, children, props, sort) => {
   if ("itemProp" in props) {
     return returnWithoutSpecialBehavior(tag, children, props);

package/dist/jsx/streaming.js

@@ -1,7 +1,7 @@
 // src/jsx/streaming.ts
 import { raw } from "../helper/html/index.js";
 import { HtmlEscapedCallbackPhase, resolveCallback } from "../utils/html.js";
-import { JSXNode } from "./base.js";
+import { isUntrustedObject, JSXNode, renderChildren, renderUntrustedObject } from "./base.js";
 import { childrenToString } from "./components.js";
 import { DOM_RENDERER, DOM_STASH } from "./constants.js";
 import { captureRenderContext, createContext, useContext } from "./context.js";
@@ -9,6 +9,7 @@ import { Suspense as SuspenseDomRenderer } from "./dom/components.js";
 import { buildDataStack } from "./dom/render.js";
 var StreamingContext = createContext(null);
 var suspenseCounter = 0;
+var serializeBoundaryChild = (child) => typeof child === "string" || Array.isArray(child) ? renderChildren([child]) : child == null || typeof child === "boolean" ? "" : isUntrustedObject(child) ? renderUntrustedObject(child) : child.toString();
 var Suspense = async ({
   children,
   fallback
@@ -25,9 +26,7 @@ var Suspense = async ({
   try {
     stackNode[DOM_STASH][0] = 0;
     buildDataStack.push([[], stackNode]);
-    resArray = children.map(
-      (c) => c == null || typeof c === "boolean" ? "" : c.toString()
-    );
+    resArray = children.map(serializeBoundaryChild);
   } catch (e) {
     if (e instanceof Promise) {
       const resume = captureRenderContext();
@@ -48,7 +47,7 @@ var Suspense = async ({
   }
   if (resArray.some((res) => res instanceof Promise)) {
     const index = suspenseCounter++;
-    const fallbackStr = await fallback.toString();
+    const fallbackStr = await (typeof fallback === "string" || Array.isArray(fallback) ? renderChildren([fallback]) : isUntrustedObject(fallback) ? renderUntrustedObject(fallback) : fallback.toString());
     return raw(`<template id="H:${index}"></template>${fallbackStr}<!--/$-->`, [
       ...fallbackStr.callbacks || [],
       ({ phase, buffer, context }) => {
@@ -61,7 +60,7 @@ var Suspense = async ({
           if (buffer) {
             buffer[0] = buffer[0].replace(
               new RegExp(`<template id="H:${index}"></template>.*?<!--/\\$-->`),
-              content
+              () => content
             );
           }
           let html = buffer ? "" : `<template data-hono-target="H:${index}">${content}</template><script${nonce ? ` nonce="${nonce}"` : ""}>

package/dist/middleware/cache/index.js

@@ -23,7 +23,7 @@ var parseVaryDirectives = (vary) => {
 };
 var createCacheKey = (key, requestUrl, request, varyHeaders) => {
   const url = new URL(cacheKeyPath, requestUrl);
-  url.searchParams.append(cacheKeyParameter, key.split("#", 1)[0]);
+  url.searchParams.append(cacheKeyParameter, key);
   url.searchParams.append(cacheMethodKeyParameter, request.method);
   if (request.method === "QUERY") {
     url.searchParams.append(queryDigestKeyParameter, request.digest);

package/dist/types/context.d.ts

@@ -347,7 +347,7 @@ export declare class Context<E extends Env = any, P extends string = any, I exte
      * ```
      */
     set: Set<IsAny<E> extends true ? {
-        Variables: ContextVariableMap & Record<string, any>;
+        Variables: ContextVariableMap & Record<PropertyKey, any>;
     } : E>;
     /**
      * `.get()` can use the value specified by the key.
@@ -363,7 +363,7 @@ export declare class Context<E extends Env = any, P extends string = any, I exte
      * ```
      */
     get: Get<IsAny<E> extends true ? {
-        Variables: ContextVariableMap & Record<string, any>;
+        Variables: ContextVariableMap & Record<PropertyKey, any>;
     } : E>;
     /**
      * `.var` can access the value of a variable.

package/dist/types/jsx/base.d.ts

@@ -26,6 +26,9 @@ export declare namespace JSX {
 export declare const getNameSpaceContext: () => Context<string> | undefined;
 export declare const booleanAttributes: string[];
 export type Child = string | Promise<string> | number | JSXNode | null | undefined | boolean | Child[];
+export declare const renderChildren: (children: Child[]) => HtmlEscapedString | Promise<HtmlEscapedString>;
+export declare const isUntrustedObject: (value: unknown) => boolean;
+export declare const renderUntrustedObject: (value: unknown) => HtmlEscapedString | Promise<HtmlEscapedString>;
 export declare class JSXNode implements HtmlEscaped {
     tag: string | Function;
     props: Props;

package/dist/types/utils/url.d.ts

@@ -19,6 +19,10 @@ export declare const tryDecode: (str: string, decoder: Decoder) => string;
  */
 export declare const tryDecodeURI: (str: string) => string;
 export declare const getPath: (request: Request) => string;
+/**
+ * @deprecated
+ * Use the `URL` API instead.
+ */
 export declare const getQueryStrings: (url: string) => string;
 export declare const getPathNoStrict: (request: Request) => string;
 /**

package/dist/utils/body.js

@@ -1,5 +1,7 @@
 // src/utils/body.ts
 import { bufferToFormData } from "./buffer.js";
+var MAX_NESTING_DEPTH = 32;
+var MAX_NESTED_OBJECTS = 1e4;
 var isRawRequest = (request) => "headers" in request;
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -32,6 +34,7 @@ async function parseFormData(request, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -44,7 +47,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value);
+        handleParsingNestedValues(form, key, value, nestingState);
         delete form[key];
       }
     });
@@ -67,23 +70,32 @@ var handleParsingAllValues = (form, key, value) => {
     }
   }
 };
-var handleParsingNestedValues = (form, key, value) => {
+var handleParsingNestedValues = (form, key, value, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+var throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 export {
   parseBody
 };

package/dist/utils/url.js

@@ -85,7 +85,11 @@ var getPath = (request) => {
 };
 var getQueryStrings = (url) => {
   const queryIndex = url.indexOf("?", 8);
-  return queryIndex === -1 ? "" : "?" + url.slice(queryIndex + 1);
+  if (queryIndex === -1) {
+    return "";
+  }
+  const hashIndex = url.indexOf("#", 8);
+  return hashIndex === -1 ? url.slice(queryIndex) : queryIndex < hashIndex ? url.slice(queryIndex, hashIndex) : "";
 };
 var getPathNoStrict = (request) => {
   const result = getPath(request);
@@ -132,6 +136,10 @@ var _decodeURI = (value) => {
   return tryDecodeURIComponent(value);
 };
 var _getQueryParam = (url, key, multiple) => {
+  const hashIndex = url.indexOf("#", 8);
+  if (hashIndex !== -1) {
+    url = url.slice(0, hashIndex);
+  }
   let encoded;
   if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
     let keyIndex2 = url.indexOf("?", 8);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/hono",
-  "version": "4.13.4-depup.0",
+  "version": "4.13.7-depup.0",
   "description": "Web framework built on Web Standards (with updated dependencies)",
   "main": "dist/cjs/index.js",
   "type": "module",
@@ -686,7 +686,7 @@
     "@typescript/native-preview": "7.0.0-dev.20260210.1",
     "@vitest/coverage-v8": "^4.1.7",
     "bun-types": "^1.2.20",
-    "editorconfig-checker": "6.1.1",
+    "editorconfig-checker": "6.2.0",
     "esbuild": "^0.27.1",
     "eslint": "^9.39.3",
     "jsdom": "22.1.0",
@@ -711,8 +711,8 @@
     "changes": {},
     "depsUpdated": 0,
     "originalPackage": "hono",
-    "originalVersion": "4.13.4",
-    "processedAt": "2026-08-24T16:12:52.176Z",
+    "originalVersion": "4.13.7",
+    "processedAt": "2026-09-05T00:31:41.567Z",
     "smokeTest": "passed"
   }
 }