bigskysoftware / bigskysoftware/htmx
Implement `hx-swap` for `Element.setHTML()` and change `htmx.config.defaultSwapStyle` to use it.
- Dominant language
- JavaScript
- Stars
- 49.4k
- Forks
- 1.7k
- Avg merge
- 3d 22h
- Merged PRs (30d)
- 30
Description
Hi,
The web platform is soon going to universally offer an XSS-safe variant of `innerHTML=` assigments called [`Element.setHTML()`](https://developer.mozilla.org/en-US/docs/Web/API/Element/setHTML), with Firefox and Chrome shipping in February 2026.
I think it could provide a great security improvment to htmx too:
* Implement an `hx-swap` using `setHTML()`
* Change the default value for `htmx.config.defaultSwapStyle` to `setHTML()` instead of `innerHTML`.
I'm aware the second point would be a breaking change and needs additional considerations, but overall this would provide strong security by default, while still allowing developers to use a different method with `hx-swap`.
Contributor guide
Assessment
This issue has not been assessed yet.