v4.13.7
Security 1
- Fix missing HTML escaping for plain strings in Suspense, ErrorBoundary, and Context.Provider components in hono/jsx, and in renderToString() and renderToReadableStream() functions in hono/jsx/dom/server to prevent XSS attacks (GHSA-hxh3-vqpv-xpqv)
From Hono
Security fixes
This release includes a fix for the following security issue:
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv
Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.