HonoProduct update

Hono · v4.13.7

Hono v4.13.7 fixes an XSS issue in which a plain string placed directly as a child or fallback of Suspense, ErrorBoundary or Context.Provider in hono/jsx was not HTML-escaped (GHSA-hxh3-vqpv-xpqv). The renderToString() and renderToReadableStream() functions in hono/jsx/dom/server had the same gap when a plain string was the root value, so untrusted strings could be emitted as markup.

GitHub ReleasesSep 5, 20261 min read