This release includes a fix for the following security issue:

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

• fix(client): keep a param value of "index" in $url() and $path() in https://github.com/honojs/hono/pull/5297
• fix(client): normalize root WebSocket URLs in https://github.com/honojs/hono/pull/5291
• fix(types): allow symbol keys in Context get and set fallbacks in https://github.com/honojs/hono/pull/5300
• chore: bump editorconfig-checker in https://github.com/honojs/hono/pull/5336
• refactor(on-handler): use forEach for consistent handler iteration in https://github.com/honojs/hono/pull/5326

Full Changelog: https://github.com/honojs/hono/compare/v4.13.5...v4.13.6

• #5117 by @zbeyens – Parse HTML strings in inert documents during deserialization

• Updated @platejs/core.

• Updated @platejs/core, @platejs/utils.

Thanks to everyone who contributed to this release:

@zbeyens

Full changelog: v53.3.10...v53.3.11

Release 2026-09-04 17:28

• solid-router: remove router-owned Loading boundaries, ack startTransition at settlement (#8236) (cc25e82278) by @ryansolid

• @tanstack/solid-router@2.0.0-rc.6
• @tanstack/solid-start@2.0.0-rc.6
• @tanstack/solid-start-client@2.0.0-rc.6
• @tanstack/solid-start-server@2.0.0-rc.6

• Updated dependencies [cc25e82, cc25e82, cc25e82]:
  • @tanstack/solid-router@2.0.0-rc.6
  • @tanstack/solid-start-client@2.0.0-rc.6
  • @tanstack/solid-start-server@2.0.0-rc.6

• #8236 cc25e82 - Remove all router-owned Loading boundaries from Matches, Match, and Outlet, and only install one in Await when a fallback is provided. Async reads in route components are no longer caught by an invisible router boundary, so Solid's implicit transitions hold the previous view — live and interactive — until the new route settles, then swap atomically. pendingComponent is presented through router pending state (pendingMs/pendingMinMs) as before; loading boundaries are now exclusively user-provided.

• #8236 cc25e82 - Resolve the router.startTransition render acknowledgement when the commit's transition actually settles instead of immediately after flush. View transitions, onRendered (scroll restoration), pending minimum-display timing, and status: 'idle' now observe the committed swap instead of firing against held DOM; superseded or rolled-back commits acknowledge false instead of leaking. Synchronous navigations still acknowledge within the same flush.

• #8236 cc25e82 - Stop force-flushing Solid's scheduler on every router-core batch. Store writes now coalesce through the scheduler (one settle per navigation instead of 3-5 full synchronous flushes) while reads stay synchronously fresh via a shadow value in the store bridge.

• Updated dependencies [cc25e82, cc25e82, cc25e82]:
  • @tanstack/solid-router@2.0.0-rc.6

• Updated dependencies [cc25e82, cc25e82, cc25e82]:
  • @tanstack/solid-router@2.0.0-rc.6