bigskysoftware / bigskysoftware/htmx

Implement `hx-swap` for `Element.setHTML()` and change `htmx.config.defaultSwapStyle` to use it.

Open
#3,616 7 comments 2 reactions 0 assignees View on GitHub
htmx 4
Dominant language
JavaScript
Stars
49.4k
Forks
1.7k
Avg merge
3d 22h
Merged PRs (30d)
30

Description

Hi,

The web platform is soon going to universally offer an XSS-safe variant of `innerHTML=` assigments called [`Element.setHTML()`](https://developer.mozilla.org/en-US/docs/Web/API/Element/setHTML), with Firefox and Chrome shipping in February 2026.

I think it could provide a great security improvment to htmx too:
* Implement an `hx-swap` using `setHTML()`
* Change the default value for `htmx.config.defaultSwapStyle` to `setHTML()` instead of `innerHTML`.

I'm aware the second point would be a breaking change and needs additional considerations, but overall this would provide strong security by default, while still allowing developers to use a different method with `hx-swap`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.