v4.13.7
asheshgoplani/agent-deckv4.13.7Sep 4, 2026by yusukebe
Upgrading?
AI Summary
A critical security release addressing an XSS vulnerability in `hono/jsx` where plain strings were rendered unescaped in boundary components and server rendering functions.
Key Highlights
- Security fix for XSS in Suspense, ErrorBoundary, and Context.Provider
- Fix for unescaped string rendering in `renderToString()` and `renderToReadableStream()`
Full Release Notes
## Security fixes This release includes a fix for the following security issue: ### `hono/jsx` renders plain strings unescaped in boundary components, leading to XSS Affects: `Suspense`, `ErrorBoundary`, and `Context.Provider` in `hono/jsx`, and `renderToString()` / `renderToReadableStream()` in `hono/jsx/dom/server`. Fixes missing HTML escaping for a plain string placed directly as a child or `fallback` of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv --- Users who render untrusted strings inside `Suspense`, `ErrorBoundary`, or `Context.Provider`, or pass them directly to `hono/jsx/dom/server`, are strongly encouraged to upgrade to this version.
Related Repositories
ollama/ollama★ 184,217
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
fatedier/frp★ 110,055
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
infiniflow/ragflow★ 92,617
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
gohugoio/hugo★ 90,198
The world’s fastest framework for building websites.
junegunn/fzf★ 83,715
:cherry_blossom: A command-line fuzzy finder