Post

It’d be great to finally be free from Dompurify and its monthly CVE alerts

danholloran.meThe Sanitizer API: Safe HTML Injection Without DOMPurifyThe browser can now strip XSS from an HTML string during parsing. Here's how setHTML works, why its config can only narrow the allowlist, and how to ship it before Safari catches up.

….aaaaaaand of course Safari is late to the party

3/8/26, 7:40 am0 reposts0 likes

No replies yet.