Hono 4.13.2

Hono 4.13.2 dropped on August 13, 2026, and it is a tidy little patch train — nine changes, mostly bug squashes, one sneaky performance win, and a fresh batch of Permissions-Policy directives. Here is the rundown.

🐛 Bug Bashes

• JSX async children fixed — document metadata tags now render async children properly instead of spitting out [object Promise] (#5204)
• ETag consistency — incorrect incremental hashing for chunked responses resolved, and the digest is now stable across stream chunks (#5199, #5205)
• Client cookie serialization — multiple cookies are now serialized correctly (#5202)
• Falsy JSON bodies — the client now sends falsy JSON bodies instead of dropping them (#5215)
• URL tidy-up — trailing question marks are stripped correctly for optional params with regex quantifiers (#5209)

🔒 Header Highlights

Two secure-headers fixes land in this release: disabled Permissions-Policy directives now output standard empty parentheses () rather than the string none (#5197), and the missing W3C Permissions-Policy directives were added to the built-in list (#5214). If you are strict about your security headers, this one is for you.

⚡ Performance Push

CORS handling gets a quiet speed-up: static array header options are pre-joined during initialization instead of on every request (#5210). Nothing flashy — just fewer cycles per response.

⬆️ Upgrade Update

No breaking changes, no deprecations, no migration drama. A standard bun update hono or npm install hono@latest gets you there. If you have been putting off a Hono upgrade, this patch-sized release is the safest one to jump on in a while.