hono 4.5.1 → 4.5.2

package/dist/cjs/middleware/csrf/index.js

@@ -42,7 +42,7 @@ const csrf = (options) => {
     }
     return handler(origin, c);
   };
-  return async function cors(c, next) {
+  return async function csrf2(c, next) {
     if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "") && !isAllowedOrigin(c.req.header("origin"), c)) {
       const res = new Response("Forbidden", {
         status: 403

package/dist/cjs/middleware/secure-headers/secure-headers.js

@@ -49,7 +49,8 @@ const DEFAULT_OPTIONS = {
   xDownloadOptions: true,
   xFrameOptions: true,
   xPermittedCrossDomainPolicies: true,
-  xXssProtection: true
+  xXssProtection: true,
+  removePoweredBy: true
 };
 const generateNonce = () => {
   const buffer = new Uint8Array(16);
@@ -85,7 +86,9 @@ const secureHeaders = (customOptions) => {
     const headersToSetForReq = callbacks.length === 0 ? headersToSet : callbacks.reduce((acc, cb) => cb(ctx, acc), headersToSet);
     await next();
     setHeaders(ctx, headersToSetForReq);
-    ctx.res.headers.delete("X-Powered-By");
+    if (options?.removePoweredBy) {
+      ctx.res.headers.delete("X-Powered-By");
+    }
   };
 };
 function getFilteredHeaders(options) {

package/dist/middleware/csrf/index.js

@@ -20,7 +20,7 @@ var csrf = (options) => {
     }
     return handler(origin, c);
   };
-  return async function cors(c, next) {
+  return async function csrf2(c, next) {
     if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "") && !isAllowedOrigin(c.req.header("origin"), c)) {
       const res = new Response("Forbidden", {
         status: 403

package/dist/middleware/secure-headers/secure-headers.js

@@ -26,7 +26,8 @@ var DEFAULT_OPTIONS = {
   xDownloadOptions: true,
   xFrameOptions: true,
   xPermittedCrossDomainPolicies: true,
-  xXssProtection: true
+  xXssProtection: true,
+  removePoweredBy: true
 };
 var generateNonce = () => {
   const buffer = new Uint8Array(16);
@@ -62,7 +63,9 @@ var secureHeaders = (customOptions) => {
     const headersToSetForReq = callbacks.length === 0 ? headersToSet : callbacks.reduce((acc, cb) => cb(ctx, acc), headersToSet);
     await next();
     setHeaders(ctx, headersToSetForReq);
-    ctx.res.headers.delete("X-Powered-By");
+    if (options?.removePoweredBy) {
+      ctx.res.headers.delete("X-Powered-By");
+    }
   };
 };
 function getFilteredHeaders(options) {

package/dist/types/context.d.ts

@@ -122,7 +122,7 @@ interface JSONRespond {
  *
  * @returns {Response & TypedResponse<SimplifyDeepArray<T> extends JSONValue ? (JSONValue extends SimplifyDeepArray<T> ? never : JSONParsed<T>) : never, U, 'json'>} - The response after rendering the JSON object, typed with the provided object and status code types.
  */
-type JSONRespondReturn<T extends JSONValue | SimplifyDeepArray<unknown> | InvalidJSONValue, U extends StatusCode> = Response & TypedResponse<SimplifyDeepArray<T> extends JSONValue ? JSONValue extends SimplifyDeepArray<T> ? never : JSONParsed<T> : JSONParsed<T>, U, 'json'>;
+type JSONRespondReturn<T extends JSONValue | SimplifyDeepArray<unknown> | InvalidJSONValue, U extends StatusCode> = Response & TypedResponse<SimplifyDeepArray<T> extends JSONValue ? JSONValue extends SimplifyDeepArray<T> ? never : JSONParsed<T> : never, U, 'json'>;
 /**
  * Interface representing a function that responds with HTML content.
  *

package/dist/types/middleware/secure-headers/secure-headers.d.ts

@@ -62,6 +62,7 @@ interface SecureHeadersOptions {
     xFrameOptions?: overridableHeader;
     xPermittedCrossDomainPolicies?: overridableHeader;
     xXssProtection?: overridableHeader;
+    removePoweredBy?: boolean;
 }
 export declare const NONCE: ContentSecurityPolicyOptionHandler;
 /**
@@ -85,6 +86,7 @@ export declare const NONCE: ContentSecurityPolicyOptionHandler;
  * @param {overridableHeader} [customOptions.xFrameOptions=true] - Settings for the X-Frame-Options header.
  * @param {overridableHeader} [customOptions.xPermittedCrossDomainPolicies=true] - Settings for the X-Permitted-Cross-Domain-Policies header.
  * @param {overridableHeader} [customOptions.xXssProtection=true] - Settings for the X-XSS-Protection header.
+ * @param {boolean} [customOptions.removePoweredBy=true] - Settings for remove X-Powered-By header.
  * @returns {MiddlewareHandler} The middleware handler function.
  *
  * @example

package/dist/types/utils/types.d.ts

@@ -11,7 +11,7 @@ export type IfAnyThenEmptyObject<T> = 0 extends 1 & T ? {} : T;
 export type JSONPrimitive = string | boolean | number | null;
 export type JSONArray = (JSONPrimitive | JSONObject | JSONArray)[];
 export type JSONObject = {
-    [key: string]: JSONPrimitive | JSONArray | JSONObject | object;
+    [key: string]: JSONPrimitive | JSONArray | JSONObject | object | InvalidJSONValue;
 };
 export type InvalidJSONValue = undefined | symbol | ((...args: unknown[]) => unknown);
 type InvalidToNull<T> = T extends InvalidJSONValue ? null : T;
@@ -27,7 +27,7 @@ export type JSONParsed<T> = T extends {
     toJSON(): infer J;
 } ? (() => J) extends () => JSONPrimitive ? J : (() => J) extends () => {
     toJSON(): unknown;
-} ? {} : JSONParsed<J> : T extends JSONPrimitive ? T : T extends InvalidJSONValue ? never : T extends [] ? [] : T extends readonly [infer R, ...infer U] ? [JSONParsed<InvalidToNull<R>>, ...JSONParsed<U>] : T extends Array<infer U> ? Array<JSONParsed<InvalidToNull<U>>> : T extends Set<unknown> | Map<unknown, unknown> ? {} : T extends object ? {
+} ? {} : JSONParsed<J> : T extends JSONPrimitive ? T : T extends InvalidJSONValue ? never : T extends [] ? [] : T extends readonly [infer R, ...infer U] ? [JSONParsed<InvalidToNull<R>>, ...JSONParsed<U>] : T extends Array<infer U> ? Array<JSONParsed<InvalidToNull<U>>> : T extends ReadonlyArray<infer U> ? ReadonlyArray<JSONParsed<InvalidToNull<U>>> : T extends Set<unknown> | Map<unknown, unknown> ? {} : T extends object ? {
     [K in keyof OmitSymbolKeys<T> as IsInvalid<T[K]> extends true ? never : K]: boolean extends IsInvalid<T[K]> ? JSONParsed<T[K]> | undefined : JSONParsed<T[K]>;
 } : never;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.5.1",
+  "version": "4.5.2",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",