Bumps [hono](https://github.com/honojs/hono) from 4.12.31 to 4.12.34. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.34</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3><code>memo()</code> retains SSR output across requests, leading to cross-user data disclosure</h3> <p>Affects: <code>hono/jsx</code> (server-side rendering). Fixes <code>memo()</code> reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — <code>useContext()</code>, <code>useRequestContext()</code>, or <code>getContext()</code> — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r</p> <h3>ReDoS in CORS middleware via <code>Access-Control-Request-Headers</code></h3> <p>Affects: <code>hono/cors</code>. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the <code>Access-Control-Request-Headers</code> preflight header when <code>allowHeaders</code> is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239</p> <h3>Algorithmic complexity DoS in Language Middleware</h3> <p>Affects: <code>hono/language</code>. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or <code>Accept-Language</code> header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4</p> <h3>Proxy Helper does not remove response headers listed in the <code>Connection</code> header</h3> <p>Affects: <code>hono/proxy</code>. Fixes <code>proxy()</code> forwarding response headers that the origin's <code>Connection</code> header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9</p> <hr /> <p>Users who use <code>hono/jsx</code> for server-side rendering, <code>hono/cors</code>, <code>hono/language</code>, or <code>hono/proxy</code> are strongly encouraged to upgrade to this version.</p> <h2>v4.12.33</h2> <h2>What's Changed</h2> <ul> <li>fix(cookie): relax name validation when parsing Cookie header in <a href="https://redirect.github.com/honojs/hono/pull/5164">honojs/hono#5164</a></li> <li>chore: bump <code>@hono/node-server</code> in <a href="https://redirect.github.com/honojs/hono/pull/5167">honojs/hono#5167</a></li> <li>fix(jsx): handle useSyncExternalStore subscription and snapshot changes in <a href="https://redirect.github.com/honojs/hono/pull/5166">honojs/hono#5166</a></li> <li>chore: remove undici in favor of global fetch in <a href="https://redirect.github.com/honojs/hono/pull/5168">honojs/hono#5168</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.32...v4.12.33">https://github.com/honojs/hono/compare/v4.12.32...v4.12.33</a></p> <h2>v4.12.32</h2> <h2>What's Changed</h2> <ul> <li>ci: enable reports for type & bundle size check in <a href="https://redirect.github.com/honojs/hono/pull/5148">honojs/hono#5148</a></li> <li>fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in <a href="https://redirect.github.com/honojs/hono/pull/5142">honojs/hono#5142</a></li> <li>fix(sse): emit empty id field to reset Last-Event-ID in <a href="https://redirect.github.com/honojs/hono/pull/5138">honojs/hono#5138</a></li> <li>test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in <a href="https://redirect.github.com/honojs/hono/pull/5145">honojs/hono#5145</a></li> <li>fix: use <code>Object.create(null)</code> when parsing query, headers, and params in <a href="https://redirect.github.com/honojs/hono/pull/5161">honojs/hono#5161</a></li> <li>fix(secure-headers): keep CSP callbacks scoped to their header in <a href="https://redirect.github.com/honojs/hono/pull/5147">honojs/hono#5147</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.32">https://github.com/honojs/hono/compare/v4.12.31...v4.12.32</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/734755ace341607628219ea1dd8ca17f01bf1a5c"><code>734755a</code></a> 4.12.34</li> <li><a href="https://github.com/honojs/hono/commit/9839ff32a349bf088b6ddfa604010879dd2d3a05"><code>9839ff3</code></a> chore: update <code>bun.lock</code> (<a href="https://redirect.github.com/honojs/hono/issues/5182">#5182</a>)</li> <li><a href="https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f"><code>0c45036</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f"><code>720b566</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7"><code>f70e2c3</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5"><code>93fc250</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/51db3131d5e97076327edaa0afdb60ebb77c264f"><code>51db313</code></a> 4.12.33</li> <li><a href="https://github.com/honojs/hono/commit/aed146364d5c48a8336b8c82fedfabebf8063d07"><code>aed1463</code></a> chore: remove undici in favor of global fetch (<a href="https://redirect.github.com/honojs/hono/issues/5168">#5168</a>)</li> <li><a href="https://github.com/honojs/hono/commit/224d2f5cbf2b4bc2ebb7482d0592149a8d9f0574"><code>224d2f5</code></a> fix(jsx): handle useSyncExternalStore subscription and snapshot changes (<a href="https://redirect.github.com/honojs/hono/issues/5166">#5166</a>)</li> <li><a href="https://github.com/honojs/hono/commit/df653cea0450657977887d56a5188368387456c8"><code>df653ce</code></a> chore: bump <code>@hono/node-server</code> (<a href="https://redirect.github.com/honojs/hono/issues/5167">#5167</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.34">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@langchain/react
React SDK for building AI-powered applications with Deep Agents, LangChain and LangGraph.
@langchain/react v1 ships a v2-native useStream hook together with a small family of companion selector hooks. The root hook gives you always-on access to thread state, messages, tool calls, and interrupts; the selector hooks open ref-counted subscriptions for the things that aren't needed on every view (per-subagent messages, media streams, submission queue, message metadata, raw channels, …).
Highlights
- v2-native streaming protocol. Session-based transport with automatic re-attach on remount; no more
reconnectOnMount/joinStreamdance. - Selector-based subscriptions. Namespaced data (subagents, subgraphs, media) streams only when a component actually mounts the matching selector hook, and releases on unmount.
- Always-on root projections.
values,messages,toolCalls, andinterruptsare live at the root with zero per-subscription cost. - Agent-brand type inference.
useStream<typeof agent>()unwraps state, tool calls, and subagent state maps from an agent brand. - Discriminated options. The hosted Agent Server path and the custom-adapter path are two arms of a single typed union — mixing them is a compile-time error.
- Multimodal media streams. Built-in assembly for audio, images, video, and files.
- Suspense integration.
useSuspenseStreamhands the initial hydration phase to<Suspense>and non-streaming errors to Error Boundaries.
Installation
npm install @langchain/react @langchain/core
Peer dependencies: react (^18 || ^19), @langchain/core (^1.1.27).
Quick Start
import { useStream } from "@langchain/react";
function Chat() {
const { messages, submit, isLoading } = useStream({
assistantId: "agent",
apiUrl: "http://localhost:2024",
});
return (
<div>
{messages.map((msg, i) => (
<div key={msg.id ?? i}>{String(msg.content)}</div>
))}
<button
disabled={isLoading}
onClick={() =>
void submit({
messages: [{ type: "human", content: "Hello!" }],
})
}
>
Send
</button>
</div>
);
}
Mental model
@langchain/react v1 splits the surface into two layers:
- Root hook (
useStream). Owns the thread lifecycle, the transport, and a handful of always-on projections (values,messages,toolCalls,interrupts,error,isLoading, discovery maps). Mount it once per thread. - Companion selector hooks. Each one opens a ref-counted subscription when the first component mounts it and releases it when the last consumer unmounts. Use them for anything scoped to a namespace, a subagent / subgraph, a specific message, a specific extension channel, or a media stream.
import {
useStream,
useMessages,
useToolCalls,
useSubmissionQueue,
} from "@langchain/react";
function Chat() {
const stream = useStream({ assistantId: "agent", apiUrl: "/api" });
// Root: free reads, no new subscription.
const messages = useMessages(stream); // same as stream.messages
// Scoped: opens a namespaced subscription on mount.
const queue = useSubmissionQueue(stream);
}
Documentation
Detailed guides live in ./docs. Start with the two files most apps need first:
useStream— options, return shape,submit(),stop(),respond(),hydrationPromise.- Companion selector hooks —
useValues,useMessages,useToolCalls,useMessageMetadata,useChannel,useExtension, and friends.
Feature-specific guides:
- Transports — SSE, WebSocket,
HttpAgentServerAdapter, customAgentServerAdapter. - Custom transports — implementing
AgentServerAdapteragainst your own backend, with a worked walkthrough ofexamples/ui-react-transport. - Interrupts & headless tools — pausing runs,
respond(),tools+onTool. - Fork / edit from a checkpoint —
useMessageMetadata+submit({ forkFrom }). - Submission queue —
multitaskStrategy: "enqueue"+useSubmissionQueue. - Subagents & subgraphs — discovery maps, scoped selector subscriptions.
- Multimodal media —
useAudio/useImages/useVideo/useFiles,useMediaURL, players. useSuspenseStream— Suspense + Error Boundary integration.StreamProvider/useStreamContext— share one stream across a subtree.- Type safety — agent-brand inference, prop-drilling, type helpers.
Migrating from v0 to v1
The useStream import name is unchanged, but the return shape, option bag, and protocol semantics all shifted. Most chat apps migrate in well under an hour — the full migration guide with line-by-line diffs lives in ./docs/v1-migration.md.
Legacy type aliases (UseStream, UseSuspenseStream, UseStreamOptions, UseStreamTransport, QueueEntry, GetToolCallsType, SubagentStream, …) and the legacy FetchStreamTransport class are no longer re-exported from @langchain/react. Apps still on the legacy surface can import directly from @langchain/langgraph-sdk/ui during their migration.
Playground
For complete end-to-end examples with full agentic UIs, visit the LangChain UI Playground.
License
MIT