| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-09-04 | 766 Bytes | |
| v4.13.7 source code.tar.gz | 2026-09-04 | 1.7 MB | |
| v4.13.7 source code.zip | 2026-09-04 | 1.9 MB | |
| Totals: 3 Items | 3.6 MB | 3 | |
Security fixes
This release includes a fix for the following security issue:
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv
Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.
