Key Points
- param() returns string | undefined for any path
- JWT decode functions now validate token format
- Fix JSX controller already closed error
Summary
v4.12.5 is a patch release (2026-03-04) focused on bug fixes and a minor tooling chore. It resolves runtime and validation issues affecting request parameter typing, JWT decoding, and a JSX controller lifecycle error. No breaking changes are expected.
Key Points
- fix(request): param() now returns
string | undefinedwhen the path param type isany(regression fix) — PR #4723. - fix(jwt): validate token format in
decodeanddecodeHeaderto avoid silent failures when token shape is invalid — PR #4752. - fix(jsx): resolves "Invalid state: Controller is already closed" by correcting controller lifecycle handling in JSX rendering paths — PR #4770.
- chore(eslint): upgrades
@hono/eslint-config(dev tooling update) — PR #4781. - New contributors: @andrewdamelio, @otoneko1102, @gaearon.
Upgrade
This is a safe patch release. To upgrade:
- npm:
npm install hono@4.12.5 - yarn:
yarn add hono@4.12.5
No code changes are required for these fixes, but review any code that relied on the previous param() typing if you used any-typed path params.
References
See the changelog range: v4.12.4...v4.12.5 for full details and PR links.