hono 4.9.4 → 4.9.6

package/dist/adapter/aws-lambda/handler.js

@@ -165,9 +165,11 @@ var EventV1Processor = class extends EventProcessor {
   }
   getQueryString(event) {
     if (event.multiValueQueryStringParameters) {
-      return Object.entries(event.multiValueQueryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${key}=${value.join(`&${key}=`)}`).join("&");
+      return Object.entries(event.multiValueQueryStringParameters || {}).filter(([, value]) => value).map(
+        ([key, values]) => values.map((value) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&")
+      ).join("&");
     } else {
-      return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${key}=${value}`).join("&");
+      return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value || "")}`).join("&");
     }
   }
   getCookies(event, headers) {

package/dist/adapter/service-worker/handler.js

@@ -5,7 +5,7 @@ var handle = (app, opts = {
   return (evt) => {
     evt.respondWith(
       (async () => {
-        const res = await app.fetch(evt.request, evt);
+        const res = await app.fetch(evt.request, {}, evt);
         if (opts.fetch && res.status === 404) {
           return await opts.fetch(evt.request);
         }

package/dist/cjs/adapter/aws-lambda/handler.js

@@ -195,9 +195,11 @@ class EventV1Processor extends EventProcessor {
   }
   getQueryString(event) {
     if (event.multiValueQueryStringParameters) {
-      return Object.entries(event.multiValueQueryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${key}=${value.join(`&${key}=`)}`).join("&");
+      return Object.entries(event.multiValueQueryStringParameters || {}).filter(([, value]) => value).map(
+        ([key, values]) => values.map((value) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&")
+      ).join("&");
     } else {
-      return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${key}=${value}`).join("&");
+      return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value || "")}`).join("&");
     }
   }
   getCookies(event, headers) {

package/dist/cjs/adapter/service-worker/handler.js

@@ -27,7 +27,7 @@ const handle = (app, opts = {
   return (evt) => {
     evt.respondWith(
       (async () => {
-        const res = await app.fetch(evt.request, evt);
+        const res = await app.fetch(evt.request, {}, evt);
         if (opts.fetch && res.status === 404) {
           return await opts.fetch(evt.request);
         }

package/dist/cjs/middleware/cors/index.js

@@ -58,7 +58,7 @@ const cors = (options) => {
     function set(key, value) {
       c.res.headers.set(key, value);
     }
-    const allowOrigin = findAllowOrigin(c.req.header("origin") || "", c);
+    const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
     if (allowOrigin) {
       set("Access-Control-Allow-Origin", allowOrigin);
     }
@@ -80,7 +80,7 @@ const cors = (options) => {
       if (opts.maxAge != null) {
         set("Access-Control-Max-Age", opts.maxAge.toString());
       }
-      const allowMethods = findAllowMethods(c.req.header("origin") || "", c);
+      const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
       if (allowMethods.length) {
         set("Access-Control-Allow-Methods", allowMethods.join(","));
       }

package/dist/cjs/middleware/language/language.js

@@ -108,7 +108,8 @@ function detectFromHeader(c, options) {
 }
 function detectFromPath(c, options) {
   try {
-    const pathSegments = c.req.path.split("/").filter(Boolean);
+    const url = new URL(c.req.url);
+    const pathSegments = url.pathname.split("/").filter(Boolean);
     const langSegment = pathSegments[options.lookupFromPathIndex];
     return normalizeLanguage(langSegment, options);
   } catch {

package/dist/cjs/utils/url.js

@@ -100,10 +100,7 @@ const tryDecode = (str, decoder) => {
 const tryDecodeURI = (str) => tryDecode(str, decodeURI);
 const getPath = (request) => {
   const url = request.url;
-  const start = url.indexOf(
-    "/",
-    url.charCodeAt(9) === 58 ? 13 : 8
-  );
+  const start = url.indexOf("/", url.indexOf(":") + 4);
   let i = start;
   for (; i < url.length; i++) {
     const charCode = url.charCodeAt(i);

package/dist/middleware/cors/index.js

@@ -36,7 +36,7 @@ var cors = (options) => {
     function set(key, value) {
       c.res.headers.set(key, value);
     }
-    const allowOrigin = findAllowOrigin(c.req.header("origin") || "", c);
+    const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
     if (allowOrigin) {
       set("Access-Control-Allow-Origin", allowOrigin);
     }
@@ -58,7 +58,7 @@ var cors = (options) => {
       if (opts.maxAge != null) {
         set("Access-Control-Max-Age", opts.maxAge.toString());
       }
-      const allowMethods = findAllowMethods(c.req.header("origin") || "", c);
+      const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
       if (allowMethods.length) {
         set("Access-Control-Allow-Methods", allowMethods.join(","));
       }

package/dist/middleware/language/language.js

@@ -77,7 +77,8 @@ function detectFromHeader(c, options) {
 }
 function detectFromPath(c, options) {
   try {
-    const pathSegments = c.req.path.split("/").filter(Boolean);
+    const url = new URL(c.req.url);
+    const pathSegments = url.pathname.split("/").filter(Boolean);
     const langSegment = pathSegments[options.lookupFromPathIndex];
     return normalizeLanguage(langSegment, options);
   } catch {

package/dist/types/middleware/cors/index.d.ts

@@ -5,8 +5,8 @@
 import type { Context } from '../../context';
 import type { MiddlewareHandler } from '../../types';
 type CORSOptions = {
-    origin: string | string[] | ((origin: string, c: Context) => string | undefined | null);
-    allowMethods?: string[] | ((origin: string, c: Context) => string[]);
+    origin: string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null);
+    allowMethods?: string[] | ((origin: string, c: Context) => Promise<string[]> | string[]);
     allowHeaders?: string[];
     maxAge?: number;
     credentials?: boolean;
@@ -18,8 +18,8 @@ type CORSOptions = {
  * @see {@link https://hono.dev/docs/middleware/builtin/cors}
  *
  * @param {CORSOptions} [options] - The options for the CORS middleware.
- * @param {string | string[] | ((origin: string, c: Context) => string | undefined | null)} [options.origin='*'] - The value of "Access-Control-Allow-Origin" CORS header.
- * @param {string[] | ((origin: string, c: Context) => string[])} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']] - The value of "Access-Control-Allow-Methods" CORS header.
+ * @param {string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null)} [options.origin='*'] - The value of "Access-Control-Allow-Origin" CORS header.
+ * @param {string[] | ((origin: string, c: Context) => Promise<string[]> | string[])} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']] - The value of "Access-Control-Allow-Methods" CORS header.
  * @param {string[]} [options.allowHeaders=[]] - The value of "Access-Control-Allow-Headers" CORS header.
  * @param {number} [options.maxAge] - The value of "Access-Control-Max-Age" CORS header.
  * @param {boolean} [options.credentials] - The value of "Access-Control-Allow-Credentials" CORS header.

package/dist/utils/url.js

@@ -67,10 +67,7 @@ var tryDecode = (str, decoder) => {
 var tryDecodeURI = (str) => tryDecode(str, decodeURI);
 var getPath = (request) => {
   const url = request.url;
-  const start = url.indexOf(
-    "/",
-    url.charCodeAt(9) === 58 ? 13 : 8
-  );
+  const start = url.indexOf("/", url.indexOf(":") + 4);
   let i = start;
   for (; i < url.length; i++) {
     const charCode = url.charCodeAt(i);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.9.4",
+  "version": "4.9.6",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",
@@ -661,7 +661,6 @@
     "@types/glob": "^9.0.0",
     "@types/jsdom": "^21.1.7",
     "@types/node": "^24.3.0",
-    "@types/supertest": "^6.0.3",
     "@typescript/native-preview": "7.0.0-dev.20250523.1",
     "@vitest/coverage-v8": "^3.2.4",
     "arg": "^5.0.2",
@@ -676,8 +675,8 @@
     "pkg-pr-new": "^0.0.53",
     "prettier": "^2.6.2",
     "publint": "^0.1.16",
-    "supertest": "^6.3.4",
     "typescript": "^5.9.2",
+    "undici": "^6.21.3",
     "vite-plugin-fastly-js-compute": "^0.4.2",
     "vitest": "^3.2.4",
     "wrangler": "4.12.0",