Bumps [hono](https://github.com/honojs/hono) from 4.12.31 to 4.12.34. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.34</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3><code>memo()</code> retains SSR output across requests, leading to cross-user data disclosure</h3> <p>Affects: <code>hono/jsx</code> (server-side rendering). Fixes <code>memo()</code> reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — <code>useContext()</code>, <code>useRequestContext()</code>, or <code>getContext()</code> — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r</p> <h3>ReDoS in CORS middleware via <code>Access-Control-Request-Headers</code></h3> <p>Affects: <code>hono/cors</code>. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the <code>Access-Control-Request-Headers</code> preflight header when <code>allowHeaders</code> is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239</p> <h3>Algorithmic complexity DoS in Language Middleware</h3> <p>Affects: <code>hono/language</code>. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or <code>Accept-Language</code> header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4</p> <h3>Proxy Helper does not remove response headers listed in the <code>Connection</code> header</h3> <p>Affects: <code>hono/proxy</code>. Fixes <code>proxy()</code> forwarding response headers that the origin's <code>Connection</code> header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9</p> <hr /> <p>Users who use <code>hono/jsx</code> for server-side rendering, <code>hono/cors</code>, <code>hono/language</code>, or <code>hono/proxy</code> are strongly encouraged to upgrade to this version.</p> <h2>v4.12.33</h2> <h2>What's Changed</h2> <ul> <li>fix(cookie): relax name validation when parsing Cookie header in <a href="https://redirect.github.com/honojs/hono/pull/5164">honojs/hono#5164</a></li> <li>chore: bump <code>@hono/node-server</code> in <a href="https://redirect.github.com/honojs/hono/pull/5167">honojs/hono#5167</a></li> <li>fix(jsx): handle useSyncExternalStore subscription and snapshot changes in <a href="https://redirect.github.com/honojs/hono/pull/5166">honojs/hono#5166</a></li> <li>chore: remove undici in favor of global fetch in <a href="https://redirect.github.com/honojs/hono/pull/5168">honojs/hono#5168</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.32...v4.12.33">https://github.com/honojs/hono/compare/v4.12.32...v4.12.33</a></p> <h2>v4.12.32</h2> <h2>What's Changed</h2> <ul> <li>ci: enable reports for type & bundle size check in <a href="https://redirect.github.com/honojs/hono/pull/5148">honojs/hono#5148</a></li> <li>fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in <a href="https://redirect.github.com/honojs/hono/pull/5142">honojs/hono#5142</a></li> <li>fix(sse): emit empty id field to reset Last-Event-ID in <a href="https://redirect.github.com/honojs/hono/pull/5138">honojs/hono#5138</a></li> <li>test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in <a href="https://redirect.github.com/honojs/hono/pull/5145">honojs/hono#5145</a></li> <li>fix: use <code>Object.create(null)</code> when parsing query, headers, and params in <a href="https://redirect.github.com/honojs/hono/pull/5161">honojs/hono#5161</a></li> <li>fix(secure-headers): keep CSP callbacks scoped to their header in <a href="https://redirect.github.com/honojs/hono/pull/5147">honojs/hono#5147</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.32">https://github.com/honojs/hono/compare/v4.12.31...v4.12.32</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/734755ace341607628219ea1dd8ca17f01bf1a5c"><code>734755a</code></a> 4.12.34</li> <li><a href="https://github.com/honojs/hono/commit/9839ff32a349bf088b6ddfa604010879dd2d3a05"><code>9839ff3</code></a> chore: update <code>bun.lock</code> (<a href="https://redirect.github.com/honojs/hono/issues/5182">#5182</a>)</li> <li><a href="https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f"><code>0c45036</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f"><code>720b566</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7"><code>f70e2c3</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5"><code>93fc250</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/51db3131d5e97076327edaa0afdb60ebb77c264f"><code>51db313</code></a> 4.12.33</li> <li><a href="https://github.com/honojs/hono/commit/aed146364d5c48a8336b8c82fedfabebf8063d07"><code>aed1463</code></a> chore: remove undici in favor of global fetch (<a href="https://redirect.github.com/honojs/hono/issues/5168">#5168</a>)</li> <li><a href="https://github.com/honojs/hono/commit/224d2f5cbf2b4bc2ebb7482d0592149a8d9f0574"><code>224d2f5</code></a> fix(jsx): handle useSyncExternalStore subscription and snapshot changes (<a href="https://redirect.github.com/honojs/hono/issues/5166">#5166</a>)</li> <li><a href="https://github.com/honojs/hono/commit/df653cea0450657977887d56a5188368387456c8"><code>df653ce</code></a> chore: bump <code>@hono/node-server</code> (<a href="https://redirect.github.com/honojs/hono/issues/5167">#5167</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.34">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@langchain/vue
Vue SDK for building AI-powered applications with Deep Agents, LangChain and LangGraph.
The package ships a Composition-API–first binding built on top of
the v2 streaming protocol. useStream returns a small, always-on
root handle (values, messages, isLoading, error, …) and
pushes anything namespaced (subagents, subgraphs, media, submission
queue, per-message metadata) behind ref-counted use* selectors
so components only pay for the data they actually consume.
Upgrading from
0.x? Seedocs/v1-migration.mdfor the complete matrix of option, return-shape, and transport changes.
Highlights
- v2-native streaming protocol. Session-based transport with
automatic re-attach on remount — no
reconnectOnMount/joinStreamdance. - Composition-API first. Everything is a
ShallowRef/ComputedRef, auto-disposed viaonScopeDisposewhen the scope unmounts. - Selector-based subscriptions. Namespaced data (subagents, subgraphs, media) streams only when a component actually mounts the matching selector composable, and releases on unmount.
- Discriminated transports. Hosted Agent Server and custom adapters are two arms of a single typed union — mixing them is a compile-time error.
- Agent-brand type inference.
useStream<typeof agent>()unwraps state, tool calls, and subagent state maps from an agent brand. - Multimodal media streams. Built-in assembly for audio,
images, video, and files, with ready-to-use
<img>/<audio>/<video>players. <Suspense>friendly.hydrationPromiselets you gateasync setup()on initial hydration.
Installation
npm install @langchain/vue @langchain/core
Peer dependencies: vue (^3.4.0), @langchain/core (^1.0.1).
Quick start
<script setup lang="ts">
import { useStream } from "@langchain/vue";
const stream = useStream({
assistantId: "agent",
apiUrl: "http://localhost:2024",
});
function onSubmit() {
void stream.submit({ messages: [{ type: "human", content: "Hello!" }] });
}
</script>
<template>
<div>
<div v-for="(msg, i) in stream.messages" :key="msg.id ?? i">
{{ typeof msg.content === "string" ? msg.content : JSON.stringify(msg.content) }}
</div>
<button :disabled="stream.isLoading" @click="onSubmit">
Send
</button>
</div>
</template>
Reactive fields on the handle are Vue refs (ShallowRef /
ComputedRef). In <script setup>, read them with .value:
stream.messages.value, stream.isLoading.value. In <template>,
Vue auto-unwraps refs, so prefer the shorter
stream.messages / stream.isLoading form.
Documentation
In-depth guides live in docs/:
- API reference —
useStreamoptions and return shape. - Selectors — ref-counted readers for namespaced / scoped data.
- Transports — SSE, WebSocket, and custom
AgentServerAdapterimplementations. - Custom transports — implementing
AgentServerAdapteragainst your own backend, with a worked walkthrough ofexamples/ui-react-transport. - Interrupts & headless tools — pausing a run, responding to interrupts, registering browser-side tools.
- Forking from a message — edit / retry flows
with
useMessageMetadata+submit({ forkFrom }). - Submission queue — inspecting and cancelling enqueued submits.
- Subagents & subgraphs — rendering per-subagent messages, tool calls, and state via scoped selectors.
- Multimodal media — audio / image / video / file streams with built-in players.
- Sharing a stream —
provideStream,useStreamContext, and theLangChainPluginapp-level defaults. - Suspense-style hydration — gating
async setup()onhydrationPromise. - Type safety — brand inference, generics, and the exported helper types.
- Testing — mounting components with mock streams or real dev servers.
- Migrating from 0.x — full diff of options, return shape, and transport classes.
Playground
For complete end-to-end examples with full agentic UIs, visit the LangChain UI Playground.
License
MIT