v4.13.7
browser-use/video-usev4.13.7Sep 4, 2026by yusukebe
Upgrading?
AI Summary
A critical security release addressing XSS vulnerabilities in the Hono JSX library. It fixes missing HTML escaping for untrusted strings within Suspense, ErrorBoundary, and Context.Provider components.
Key Highlights
- Security fix for XSS vulnerability in JSX components (Suspense, ErrorBoundary, Provider)
- Fix for unescaped plain strings in server rendering functions
- Fix for `renderToString()` and `renderToReadableStream()` security issues
- Recommended upgrade for users rendering untrusted strings
Full Release Notes
## Security fixes This release includes a fix for the following security issue: ### `hono/jsx` renders plain strings unescaped in boundary components, leading to XSS Affects: `Suspense`, `ErrorBoundary`, and `Context.Provider` in `hono/jsx`, and `renderToString()` / `renderToReadableStream()` in `hono/jsx/dom/server`. Fixes missing HTML escaping for a plain string placed directly as a child or `fallback` of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv --- Users who render untrusted strings inside `Suspense`, `ErrorBoundary`, or `Context.Provider`, or pass them directly to `hono/jsx/dom/server`, are strongly encouraged to upgrade to this version.
Related Repositories
public-apis/public-apis★ 491,127
A collective list of free APIs
NousResearch/hermes-agent★ 255,899
The agent that grows with you
yt-dlp/yt-dlp★ 200,001
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,480
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,700
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.