v4.13.6 v4.13.7
high risk
smicallef/spiderfootSep 4, 2026 → Sep 4, 20260 days between releases
What's New
Fixes critical XSS vulnerability in JSX boundary components and server rendering functions.
Breaking Changes
- Escaping untrusted strings in boundary components or server functions may alter output for code relying on HTML injection.
Bug Fixes
- Fixes XSS vulnerability in hono/jsx where plain strings were not escaped in Suspense, ErrorBoundary, and Context.Provider.
Upgrade Notes
Upgrade immediately to mitigate the XSS vulnerability. Existing code rendering untrusted strings may display escaped characters instead of HTML.
The Two Releases
v4.13.6
v4.13.6
Sep 4, 2026· 2 months ago
A maintenance release focused on client-side utilities, fixing URL parameter handling, WebSocket URL normalization, and type safety for symbol keys in Context.
Full release notesv4.13.7
v4.13.7
Sep 4, 2026· 2 months ago
This release addresses a critical XSS vulnerability in Hono's JSX rendering components where untrusted strings were not properly escaped when used in Suspense, ErrorBoundary, or Context.Provider components.
Full release notes