v4.13.7
DavidHDev/react-bitsv4.13.7Sep 4, 2026by yusukebe
Upgrading?
AI Summary
A critical security release addressing an XSS vulnerability in the `hono/jsx` library where plain strings were rendered unescaped in boundary components.
Key Highlights
- Fixes XSS in `Suspense`, `ErrorBoundary`, and `Context.Provider`
- Fixes missing HTML escaping for untrusted strings in server rendering functions
- Updates `renderToString` and `renderToReadableStream` to escape root values
- Addresses GHSA-hxh3-vqpv-xpqv
Full Release Notes
## Security fixes This release includes a fix for the following security issue: ### `hono/jsx` renders plain strings unescaped in boundary components, leading to XSS Affects: `Suspense`, `ErrorBoundary`, and `Context.Provider` in `hono/jsx`, and `renderToString()` / `renderToReadableStream()` in `hono/jsx/dom/server`. Fixes missing HTML escaping for a plain string placed directly as a child or `fallback` of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv --- Users who render untrusted strings inside `Suspense`, `ErrorBoundary`, or `Context.Provider`, or pass them directly to `hono/jsx/dom/server`, are strongly encouraged to upgrade to this version.
Related Repositories
affaan-m/ECC★ 285,690
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
react/react★ 251,621
The library for web and native user interfaces.
nodejs/node★ 122,511
Node.js JavaScript runtime ✨🐢🚀✨
Leonxlnx/taste-skill★ 100,549
Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages
louislam/uptime-kuma★ 92,730
A fancy self-hosted monitoring tool