unstale

npm / xss

xss

What changed in xss 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-27.

1 breaking3 security1 new APIs and options1 behavior and defaults

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.8 on npm

xss 16 changes

Breaking changes 1

  • Form destinations in action and formaction now allow only HTTP(S) and relative URLs, even when a custom whitelist allows other schemes. The default whitelist is unaffected.

    1.0.16release notes

Security 3

  • Null, undefined, or non-function values for escapeHtml, onTag, onTagAttr, onIgnoreTag, onIgnoreTagAttr, or safeAttrValue now use the default callback. Own functions still override the default; inherited properties are ignored.

    1.0.17release notes

  • Copies only own option properties, preventing a polluted prototype from supplying callbacks.

    1.0.17release notes

  • Inherited properties are ignored when reading sanitizer options and whitelists, preventing prototype pollution from overriding filtering behavior.

    1.0.16release notes

New APIs and options 1

  • Adds an API that returns sanitized HTML and records of ignored tags and attributes, with TypeScript declarations.

    1.0.16release notes

Behavior and default changes 1

  • Null and undefined whiteList or allowList values are treated as unset; an explicit object, including {}, is still used. When whiteList is unset, allowList is used; otherwise the default whitelist is used.

    1.0.17release notes