hono 4.12.31 → 4.12.33

package/dist/cjs/helper/streaming/sse.js

@@ -42,7 +42,7 @@ class SSEStreamingApi extends import_stream.StreamingApi {
     const sseData = [
       message.event && `event: ${message.event}`,
       dataLines,
-      message.id && `id: ${message.id}`,
+      message.id !== void 0 && `id: ${message.id}`,
       message.retry !== void 0 && `retry: ${message.retry}`
     ].filter(Boolean).join("\n") + "\n\n";
     await this.write(sseData);

package/dist/cjs/jsx/hooks/index.js

@@ -330,19 +330,22 @@ const useSyncExternalStore = (subscribe, getSnapshot, getServerSnapshot) => {
     }
     return getServerSnapshot();
   }
-  const [serverSnapshotIsUsed] = useState(!!(buildData[0][4] && getServerSnapshot));
-  const [state, setState] = useState(
-    () => serverSnapshotIsUsed ? getServerSnapshot() : getSnapshot()
-  );
+  const snapshot = buildData[0][4] && getServerSnapshot ? getServerSnapshot() : getSnapshot();
+  const [, setVersion] = useState(0);
+  const latestSnapshot = useRef([snapshot, getSnapshot]);
+  latestSnapshot.current = [snapshot, getSnapshot];
+  const unsubscribeRef = useRef(null);
   useEffect(() => {
-    if (serverSnapshotIsUsed) {
-      setState(getSnapshot());
+    const update2 = () => setVersion((version) => version + 1);
+    unsubscribeRef.current?.();
+    unsubscribeRef.current = subscribe(update2);
+    const [snapshot2, getSnapshot2] = latestSnapshot.current;
+    if (!Object.is(snapshot2, getSnapshot2())) {
+      update2();
     }
-    return subscribe(() => {
-      setState(getSnapshot());
-    });
-  }, []);
-  return state;
+  }, [subscribe]);
+  useEffect(() => () => unsubscribeRef.current?.(), []);
+  return snapshot;
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/middleware/secure-headers/secure-headers.js

@@ -71,14 +71,20 @@ const secureHeaders = (customOptions) => {
   const headersToSet = getFilteredHeaders(options);
   const callbacks = [];
   if (options.contentSecurityPolicy) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicy);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicy,
+      "Content-Security-Policy"
+    );
     if (callback) {
       callbacks.push(callback);
     }
     headersToSet.push(["Content-Security-Policy", value]);
   }
   if (options.contentSecurityPolicyReportOnly) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicyReportOnly);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicyReportOnly,
+      "Content-Security-Policy-Report-Only"
+    );
     if (callback) {
       callbacks.push(callback);
     }
@@ -111,7 +117,7 @@ function getFilteredHeaders(options) {
     return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
   });
 }
-function getCSPDirectives(contentSecurityPolicy) {
+function getCSPDirectives(contentSecurityPolicy, headerName) {
   const callbacks = [];
   const resultValues = [];
   for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
@@ -136,7 +142,7 @@ function getCSPDirectives(contentSecurityPolicy) {
   resultValues.pop();
   return callbacks.length === 0 ? [void 0, resultValues.join("")] : [
     (ctx, headersToSet) => headersToSet.map((values) => {
-      if (values[0] === "Content-Security-Policy" || values[0] === "Content-Security-Policy-Report-Only") {
+      if (values[0] === headerName) {
         const clone = values[1].slice();
         callbacks.forEach((cb) => {
           cb(ctx, clone);

package/dist/cjs/request.js

@@ -98,7 +98,7 @@ class HonoRequest {
     if (name) {
       return this.raw.headers.get(name) ?? void 0;
     }
-    const headerData = {};
+    const headerData = /* @__PURE__ */ Object.create(null);
     this.raw.headers.forEach((value, key) => {
       headerData[key] = value;
     });

package/dist/cjs/utils/accept.js

@@ -146,7 +146,7 @@ const getNextParam = (acceptHeader, startIndex) => {
 const getNextAcceptValue = (acceptHeader, startIndex) => {
   const accept = {
     type: "",
-    params: {},
+    params: /* @__PURE__ */ Object.create(null),
     q: 1
   };
   startIndex = consumeWhitespace(acceptHeader, startIndex);

package/dist/cjs/utils/cookie.js

@@ -47,6 +47,7 @@ const verifySignature = async (base64Signature, value, secret) => {
   }
 };
 const validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+const relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
 const validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
 const trimCookieWhitespace = (value) => {
   let start = 0;
@@ -79,7 +80,7 @@ const parse = (cookie, name) => {
       continue;
     }
     const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
-    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
+    if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
       continue;
     }
     let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));

package/dist/cjs/utils/url.js

@@ -192,7 +192,7 @@ const _getQueryParam = (url, key, multiple) => {
       return void 0;
     }
   }
-  const results = {};
+  const results = /* @__PURE__ */ Object.create(null);
   encoded ??= /[%+]/.test(url);
   let keyIndex = url.indexOf("?", 8);
   while (keyIndex !== -1) {

package/dist/helper/streaming/sse.js

@@ -20,7 +20,7 @@ var SSEStreamingApi = class extends StreamingApi {
     const sseData = [
       message.event && `event: ${message.event}`,
       dataLines,
-      message.id && `id: ${message.id}`,
+      message.id !== void 0 && `id: ${message.id}`,
       message.retry !== void 0 && `retry: ${message.retry}`
     ].filter(Boolean).join("\n") + "\n\n";
     await this.write(sseData);

package/dist/jsx/hooks/index.js

@@ -289,19 +289,22 @@ var useSyncExternalStore = (subscribe, getSnapshot, getServerSnapshot) => {
     }
     return getServerSnapshot();
   }
-  const [serverSnapshotIsUsed] = useState(!!(buildData[0][4] && getServerSnapshot));
-  const [state, setState] = useState(
-    () => serverSnapshotIsUsed ? getServerSnapshot() : getSnapshot()
-  );
+  const snapshot = buildData[0][4] && getServerSnapshot ? getServerSnapshot() : getSnapshot();
+  const [, setVersion] = useState(0);
+  const latestSnapshot = useRef([snapshot, getSnapshot]);
+  latestSnapshot.current = [snapshot, getSnapshot];
+  const unsubscribeRef = useRef(null);
   useEffect(() => {
-    if (serverSnapshotIsUsed) {
-      setState(getSnapshot());
+    const update2 = () => setVersion((version) => version + 1);
+    unsubscribeRef.current?.();
+    unsubscribeRef.current = subscribe(update2);
+    const [snapshot2, getSnapshot2] = latestSnapshot.current;
+    if (!Object.is(snapshot2, getSnapshot2())) {
+      update2();
     }
-    return subscribe(() => {
-      setState(getSnapshot());
-    });
-  }, []);
-  return state;
+  }, [subscribe]);
+  useEffect(() => () => unsubscribeRef.current?.(), []);
+  return snapshot;
 };
 export {
   STASH_EFFECT,

package/dist/middleware/secure-headers/secure-headers.js

@@ -49,14 +49,20 @@ var secureHeaders = (customOptions) => {
   const headersToSet = getFilteredHeaders(options);
   const callbacks = [];
   if (options.contentSecurityPolicy) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicy);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicy,
+      "Content-Security-Policy"
+    );
     if (callback) {
       callbacks.push(callback);
     }
     headersToSet.push(["Content-Security-Policy", value]);
   }
   if (options.contentSecurityPolicyReportOnly) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicyReportOnly);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicyReportOnly,
+      "Content-Security-Policy-Report-Only"
+    );
     if (callback) {
       callbacks.push(callback);
     }
@@ -89,7 +95,7 @@ function getFilteredHeaders(options) {
     return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
   });
 }
-function getCSPDirectives(contentSecurityPolicy) {
+function getCSPDirectives(contentSecurityPolicy, headerName) {
   const callbacks = [];
   const resultValues = [];
   for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
@@ -114,7 +120,7 @@ function getCSPDirectives(contentSecurityPolicy) {
   resultValues.pop();
   return callbacks.length === 0 ? [void 0, resultValues.join("")] : [
     (ctx, headersToSet) => headersToSet.map((values) => {
-      if (values[0] === "Content-Security-Policy" || values[0] === "Content-Security-Policy-Report-Only") {
+      if (values[0] === headerName) {
         const clone = values[1].slice();
         callbacks.forEach((cb) => {
           cb(ctx, clone);

package/dist/request.js

@@ -76,7 +76,7 @@ var HonoRequest = class {
     if (name) {
       return this.raw.headers.get(name) ?? void 0;
     }
-    const headerData = {};
+    const headerData = /* @__PURE__ */ Object.create(null);
     this.raw.headers.forEach((value, key) => {
       headerData[key] = value;
     });

package/dist/types/adapter/aws-lambda/types.d.ts

@@ -96,6 +96,15 @@ interface Authorizer {
         userArn: string;
         userId: string;
     };
+    jwt?: {
+        claims: Record<string, string | number | boolean | string[]>;
+        scopes: string[] | null;
+    };
+    /**
+     * The `context` object returned by a Lambda (REQUEST) authorizer.
+     * It is `null` when the authorizer returns no context.
+     */
+    lambda?: Record<string, unknown> | null;
 }
 export interface ApiGatewayRequestContextV2 {
     accountId: string;

package/dist/utils/accept.js

@@ -125,7 +125,7 @@ var getNextParam = (acceptHeader, startIndex) => {
 var getNextAcceptValue = (acceptHeader, startIndex) => {
   const accept = {
     type: "",
-    params: {},
+    params: /* @__PURE__ */ Object.create(null),
     q: 1
   };
   startIndex = consumeWhitespace(acceptHeader, startIndex);

package/dist/utils/cookie.js

@@ -23,6 +23,7 @@ var verifySignature = async (base64Signature, value, secret) => {
   }
 };
 var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+var relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
 var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
 var trimCookieWhitespace = (value) => {
   let start = 0;
@@ -55,7 +56,7 @@ var parse = (cookie, name) => {
       continue;
     }
     const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
-    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
+    if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
       continue;
     }
     let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));

package/dist/utils/url.js

@@ -159,7 +159,7 @@ var _getQueryParam = (url, key, multiple) => {
       return void 0;
     }
   }
-  const results = {};
+  const results = /* @__PURE__ */ Object.create(null);
   encoded ??= /[%+]/.test(url);
   let keyIndex = url.indexOf("?", 8);
   while (keyIndex !== -1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.12.31",
+  "version": "4.12.33",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",
@@ -667,7 +667,7 @@
   ],
   "devDependencies": {
     "@hono/eslint-config": "^2.1.1",
-    "@hono/node-server": "^2.0.2",
+    "@hono/node-server": "^2.0.12",
     "@types/jsdom": "^21.1.7",
     "@types/node": "^24.3.0",
     "@types/ws": "^8.18.1",
@@ -685,7 +685,6 @@
     "prettier": "3.7.4",
     "publint": "0.3.15",
     "typescript": "^6.0.3",
-    "undici": "^6.27.0",
     "vite-plugin-fastly-js-compute": "^0.4.2",
     "vitest": "^4.1.9",
     "wrangler": "4.107.0",