Hono 4.13

Apply the included TypeScript 7 and JavaScript ES2026 baselines first. These rules target Hono 4.13.x across Fetch-compatible runtimes and were checked against 4.13.8.

Version and runtime boundaries

• Run the newest Hono 4 release and take each one as it ships, moving to a new minor when it appears: Hono publishes fixes in its newest release and stops patching an older minor once the next one is out. Keep hono and its hono/* imports on the same release, including Deno import maps, and update separately versioned @hono/* adapters and third-party middleware by their own compatibility requirements. Read Hono's repository security advisories when you update, because some are published only there and don't appear in the database npm audit reads.
• Use an actively maintained runtime compatible with the selected adapter. The core package's Node.js >=16.9.0 engine declaration is not a deployment support policy: @hono/node-server 2.1.1 requires Node.js >=20 and Hono ^4. Verify Fetch, Web Crypto, filesystem, connection metadata, and execution-context support on each selected Workers, Deno, Bun, or Node deployment.
• Keep authenticated identity and tenant state in the current request's c.set()/c.get() values. Require the middleware that populates them to run; a global ContextVariableMap declaration does not establish their presence. Construct explicit response objects instead of serializing c.env, c.var, or the entire JWT payload, and never retain a Context in module-level state.

Routing and middleware

• Register mandatory checks with app.use()