Post

rip bozo innerHTML

whoa setHTMLUnsafe(..) is already baseline

Yeah, you kinda want people to use that first rather than using setHTML and removing the sanitisation. Don't know if that was their reasoning, but makes sense to me.

You can't remove the safety from setHTML fwiw. It will always enforce a baseline that prevents XSS. The default sanitizer just also removes a lot of other things. You can do setHTML("", {sanitizer: {}}) to get the absolute minimum safety. There's lots of flexibility in the API though.