This release includes fixes for the following security issues:

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

• fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in https://github.com/honojs/hono/pull/5597

Full Changelog: https://github.com/honojs/hono/compare/v4.13.15...v4.13.16

• fix(auth): escape backslashes in the WWW-Authenticate realm by @yusukebe in https://github.com/honojs/hono/pull/5590
• docs(contributing): drop the note about linking a fork branch by @yusukebe in https://github.com/honojs/hono/pull/5593
• fix(context): allow c.header() after the response body is consumed by @yusukebe in https://github.com/honojs/hono/pull/5587

Full Changelog: https://github.com/honojs/hono/compare/v4.13.14...v4.13.15

• Upgrade React from a703ca64-20261030 to e84e1492-20261031: #100999
• Upgrade React from dc9aed36-20261027 to a703ca64-20261030: #100965

• Turbopack: resolve per-module data once during module graph construction: #94842

Huge thanks to @lukesandberg for helping!

• @formatjs/intl-datetimeformat: streamline numeric rendering (cc09570)

• The following workspace dependencies were updated
  • dependencies
    • formatjs_intl_datetimeformat bumped from 1.0.0 to 1.0.1
    • formatjs_intl_datetimeformat_calendars bumped from 0.2.1 to 0.2.2

• The following workspace dependencies were updated
  • dependencies
    • formatjs_intl_datetimeformat bumped from 1.0.0 to 1.0.1

• @formatjs/cli-lib: add Intel Mac and Windows ARM64 bindings (#7843) (aafb8e0)

• macOS Apple Silicon: formatjs_cli-darwin-arm64
• Linux ARM64: formatjs_cli-linux-arm64
• Linux x86_64: formatjs_cli-linux-x64
• Windows x64: formatjs_cli-win32-x64.exe

# macOS (Apple Silicon)
curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.10.0/formatjs_cli-darwin-arm64
chmod +x formatjs_cli-darwin-arm64
sudo mv formatjs_cli-darwin-arm64 /usr/local/bin/formatjs

# Linux
curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.10.0/formatjs_cli-linux-x64
chmod +x formatjs_cli-linux-x64
sudo mv formatjs_cli-linux-x64 /usr/local/bin/formatjs

# Linux ARM64
curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.10.0/formatjs_cli-linux-arm64
chmod +x formatjs_cli-linux-arm64
sudo mv formatjs_cli-linux-arm64 /usr/local/bin/formatjs

# Windows x64 (PowerShell)
curl.exe -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.10.0/formatjs_cli-win32-x64.exe

Verify the checksums:

curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.10.0/checksums.txt
shasum -a 256 -c checksums.txt

Release 2026-10-31 19:36

• solid: bump to solid-js 2.0.0-rc.20 and @solidjs/vite-plugin 3.0.0-next.54 (#8837) (887caaf00c) by @brenelz

• @tanstack/solid-router@2.0.0-rc.10
• @tanstack/solid-router-devtools@2.0.0-rc.8
• @tanstack/solid-router-ssr-query@2.0.0-rc.8
• @tanstack/solid-start@2.0.0-rc.10
• @tanstack/solid-start-client@2.0.0-rc.10
• @tanstack/solid-start-server@2.0.0-rc.10

• #8837 887caaf - Bump solid-js and @solidjs/web to ^2.0.0-rc.20 and @solidjs/vite-plugin to ^3.0.0-next.54 across the monorepo (with @solidjs/babel-plugin 2.0.0-rc.20 for the webpack path and the @rsbuild/plugin-solid compiler overrides), and raise the Solid packages' solid-js / @solidjs/web peer floors to 2.0.0-rc.20.

• Updated dependencies [887caaf]:

  • @tanstack/solid-router@2.0.0-rc.10
  • @tanstack/solid-start-client@2.0.0-rc.10
  • @tanstack/solid-start-server@2.0.0-rc.10

• #8837 887caaf - Bump solid-js and @solidjs/web to ^2.0.0-rc.20 and @solidjs/vite-plugin to ^3.0.0-next.54 across the monorepo (with @solidjs/babel-plugin 2.0.0-rc.20 for the webpack path and the @rsbuild/plugin-solid compiler overrides), and raise the Solid packages' solid-js / @solidjs/web peer floors to 2.0.0-rc.20.

• Updated dependencies [887caaf]:

  • @tanstack/solid-router@2.0.0-rc.10