#3616·htmx

Implement `hx-swap` for `Element.setHTML()` and change `htmx.config.defaultSwapStyle` to use it.

Author: mozfreddybCreated Jan 7, 2026Updated Sep 9, 2026
Labelshtmx 4

Hi,

The web platform is soon going to universally offer an XSS-safe variant of innerHTML= assigments called Element.setHTML(), with Firefox and Chrome shipping in February 2026.

I think it could provide a great security improvment to htmx too:

  • Implement an hx-swap using setHTML()
  • Change the default value for htmx.config.defaultSwapStyle to setHTML() instead of innerHTML.

I'm aware the second point would be a breaking change and needs additional considerations, but overall this would provide strong security by default, while still allowing developers to use a different method with hx-swap.