# What changed in xss

> 6 changes in xss 1 from its official release notes, upgrade guides and advisories: 1 breaking, 3 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/xss/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## xss 1

### Breaking changes

- Form destinations in action and formaction now allow only HTTP(S) and relative URLs, even when a custom whitelist allows other schemes. The default whitelist is unaffected. (1.0.16) — [release notes](https://github.com/leizongmin/js-xss/blob/9c79c9a2b8db323b791504281bee319731216f7e/CHANGELOG.md#v1016-2026-10-20)

### Security

- Null, undefined, or non-function values for escapeHtml, onTag, onTagAttr, onIgnoreTag, onIgnoreTagAttr, or safeAttrValue now use the default callback. Own functions still override the default; inherited properties are ignored. (1.0.17) — [release notes](https://github.com/leizongmin/js-xss/blob/a76f7f06d30ce83a8a064b0b3b41feddc8d8899b/CHANGELOG.md#v1017-2026-10-24)
- Copies only own option properties, preventing a polluted prototype from supplying callbacks. (1.0.17) — [release notes](https://github.com/leizongmin/js-xss/blob/a76f7f06d30ce83a8a064b0b3b41feddc8d8899b/CHANGELOG.md#v1017-2026-10-24)
- Inherited properties are ignored when reading sanitizer options and whitelists, preventing prototype pollution from overriding filtering behavior. (1.0.16) — [release notes](https://github.com/leizongmin/js-xss/blob/9c79c9a2b8db323b791504281bee319731216f7e/CHANGELOG.md#v1016-2026-10-20)

### New APIs and options

- Adds an API that returns sanitized HTML and records of ignored tags and attributes, with TypeScript declarations. (1.0.16) — [release notes](https://github.com/leizongmin/js-xss/blob/9c79c9a2b8db323b791504281bee319731216f7e/CHANGELOG.md#v1016-2026-10-20)

### Behavior and default changes

- Null and undefined whiteList or allowList values are treated as unset; an explicit object, including {}, is still used. When whiteList is unset, allowList is used; otherwise the default whitelist is used. (1.0.17) — [release notes](https://github.com/leizongmin/js-xss/blob/a76f7f06d30ce83a8a064b0b3b41feddc8d8899b/CHANGELOG.md#v1017-2026-10-24)