It’d be great to finally be free from Dompurify and its monthly CVE alerts
The Sanitizer API: Safe HTML Injection Without DOMPurify
The browser can now strip XSS from an HTML string during parsing. Here's how setHTML works, why its config can only narrow the allowlist, and how to ship it before Safari catches up.
danholloran.me