v4.13.7
bytedance/deer-flowv4.13.7Sep 4, 2026by yusukebe
Upgrading?
AI Summary
A critical security release addressing an XSS vulnerability in the `hono/jsx` library where plain strings were rendered unescaped in boundary components.
Key Highlights
- Fixes missing HTML escaping for plain strings in `Suspense`, `ErrorBoundary`, `Context.Provider`, and server rendering functions.
- Addresses GHSA-hxh3-vqpv-xpqv to prevent untrusted string injection.
Full Release Notes
## Security fixes This release includes a fix for the following security issue: ### `hono/jsx` renders plain strings unescaped in boundary components, leading to XSS Affects: `Suspense`, `ErrorBoundary`, and `Context.Provider` in `hono/jsx`, and `renderToString()` / `renderToReadableStream()` in `hono/jsx/dom/server`. Fixes missing HTML escaping for a plain string placed directly as a child or `fallback` of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv --- Users who render untrusted strings inside `Suspense`, `ErrorBoundary`, or `Context.Provider`, or pass them directly to `hono/jsx/dom/server`, are strongly encouraged to upgrade to this version.
Related Repositories
public-apis/public-apis★ 491,139
A collective list of free APIs
NousResearch/hermes-agent★ 255,979
The agent that grows with you
yt-dlp/yt-dlp★ 200,075
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,496
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,705
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.