v4.13.7
This release includes a fix for the following security issue:
Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv
Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.
v4.13.6
- fix(client): keep a param value of "index" in $url() and $path() in https://github.com/honojs/hono/pull/5297
- fix(client): normalize root WebSocket URLs in https://github.com/honojs/hono/pull/5291
- fix(types): allow symbol keys in Context get and set fallbacks in https://github.com/honojs/hono/pull/5300
- chore: bump
editorconfig-checkerin https://github.com/honojs/hono/pull/5336 - refactor(on-handler): use forEach for consistent handler iteration in https://github.com/honojs/hono/pull/5326
Full Changelog: https://github.com/honojs/hono/compare/v4.13.5...v4.13.6
v53.3.11
- Updated
@platejs/core.
- Updated
@platejs/core,@platejs/utils.
Thanks to everyone who contributed to this release:
@zbeyens
Full changelog: v53.3.10...v53.3.11
Release 2026-09-04 17:28
Release 2026-09-04 17:28
- solid-router: remove router-owned Loading boundaries, ack startTransition at settlement (#8236) (cc25e82278) by @ryansolid
- @tanstack/solid-router@2.0.0-rc.6
- @tanstack/solid-start@2.0.0-rc.6
- @tanstack/solid-start-client@2.0.0-rc.6
- @tanstack/solid-start-server@2.0.0-rc.6
@tanstack/solid-router@2.0.0-rc.6
-
#8236
cc25e82- Remove all router-ownedLoadingboundaries fromMatches,Match, andOutlet, and only install one inAwaitwhen afallbackis provided. Async reads in route components are no longer caught by an invisible router boundary, so Solid's implicit transitions hold the previous view — live and interactive — until the new route settles, then swap atomically.pendingComponentis presented through router pending state (pendingMs/pendingMinMs) as before; loading boundaries are now exclusively user-provided. -
#8236
cc25e82- Resolve therouter.startTransitionrender acknowledgement when the commit's transition actually settles instead of immediately after flush. View transitions,onRendered(scroll restoration), pending minimum-display timing, andstatus: 'idle'now observe the committed swap instead of firing against held DOM; superseded or rolled-back commits acknowledgefalseinstead of leaking. Synchronous navigations still acknowledge within the same flush. -
#8236
cc25e82- Stop force-flushing Solid's scheduler on every router-core batch. Store writes now coalesce through the scheduler (one settle per navigation instead of 3-5 full synchronous flushes) while reads stay synchronously fresh via a shadow value in the store bridge.