Add HTML setters features

features/html-setters.yml

@@ -0,0 +1,50 @@
+name: HTML setter methods
+description: The `setHTML()`, `replaceWithHTML()`, `beforeHTML()`, `prependHTML()`, `appendHTML()` and `afterHTML()` DOM methods, and unsafe equivalents, insert HTML into an existing tree.
+spec: https://github.com/whatwg/html/pull/12753
+#TODO: replace with below and remove from specs.ts once about PR is merged
+#spec: https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-parsing-and-serialization
+group: dom
+compat_features:
+  - api.CharacterData.afterHTML
+  - api.CharacterData.afterHTMLUnsafe
+  - api.CharacterData.beforeHTML
+  - api.CharacterData.beforeHTMLUnsafe
+  - api.CharacterData.replaceWithHTML
+  - api.CharacterData.replaceWithHTMLUnsafe
+  - api.DocumentType.afterHTML
+  - api.DocumentType.afterHTMLUnsafe
+  - api.DocumentType.beforeHTML
+  - api.DocumentType.beforeHTMLUnsafe
+  - api.DocumentType.replaceWithHTML
+  - api.DocumentType.replaceWithHTMLUnsafe
+  - api.Element.afterHTML
+  - api.Element.afterHTMLUnsafe
+  - api.Element.appendHTML
+  - api.Element.appendHTMLUnsafe
+  - api.Element.beforeHTML
+  - api.Element.beforeHTMLUnsafe
+  - api.Element.prependHTML
+  - api.Element.prependHTMLUnsafe
+  - api.Element.replaceHTML
+  - api.Element.replaceHTMLUnsafe
+  - api.Element.replaceWithHTML
+  - api.Element.replaceWithHTMLUnsafe
+  - api.Element.setHTML
+  - api.Element.setHTMLUnsafe
+  - api.Element.setHTMLUnsafe.options_runscripts_parameter
+  - api.ShadowRoot.setHTML
+  - api.ShadowRoot.afterHTML
+  - api.ShadowRoot.afterHTMLUnsafe
+  - api.ShadowRoot.appendHTML
+  - api.ShadowRoot.appendHTMLUnsafe
+  - api.ShadowRoot.beforeHTML
+  - api.ShadowRoot.beforeHTMLUnsafe
+  - api.ShadowRoot.prependHTML
+  - api.ShadowRoot.prependHTMLUnsafe
+  - api.ShadowRoot.replaceWithHTML
+  - api.ShadowRoot.replaceWithHTMLUnsafe
+  - api.ShadowRoot.setHTMLUnsafe
+  - api.ShadowRoot.setHTMLUnsafe.options_runscripts_parameter
+  - api.TrustedHTMLParserOptions
+  - api.TrustedHTMLParserOptions.runScripts
+  - api.TrustedHTMLParserOptions.sanitizer

features/html-setters.yml.dist

@@ -0,0 +1,72 @@
+# Generated from: html-setters.yml
+# Do not edit this file by hand. Edit the source file instead!
+
+status:
+  baseline: false
+  support: {}
+compat_features:
+  # baseline: low
+  # baseline_low_date: 2025-09-15
+  # support:
+  #   chrome: "124"
+  #   chrome_android: "124"
+  #   edge: "124"
+  #   firefox: "123"
+  #   firefox_android: "123"
+  #   safari: "26"
+  #   safari_ios: "26"
+  - api.Element.setHTMLUnsafe
+  - api.ShadowRoot.setHTMLUnsafe
+
+  # baseline: false
+  # support:
+  #   chrome: "146"
+  #   chrome_android: "146"
+  #   edge: "146"
+  #   firefox: "148"
+  #   firefox_android: "148"
+  - api.Element.setHTML
+  - api.ShadowRoot.setHTML
+
+  # ⬇️ Same status as overall feature ⬇️
+  # baseline: false
+  # support: {}
+  - api.CharacterData.afterHTML
+  - api.CharacterData.afterHTMLUnsafe
+  - api.CharacterData.beforeHTML
+  - api.CharacterData.beforeHTMLUnsafe
+  - api.CharacterData.replaceWithHTML
+  - api.CharacterData.replaceWithHTMLUnsafe
+  - api.DocumentType.afterHTML
+  - api.DocumentType.afterHTMLUnsafe
+  - api.DocumentType.beforeHTML
+  - api.DocumentType.beforeHTMLUnsafe
+  - api.DocumentType.replaceWithHTML
+  - api.DocumentType.replaceWithHTMLUnsafe
+  - api.Element.afterHTML
+  - api.Element.afterHTMLUnsafe
+  - api.Element.appendHTML
+  - api.Element.appendHTMLUnsafe
+  - api.Element.beforeHTML
+  - api.Element.beforeHTMLUnsafe
+  - api.Element.prependHTML
+  - api.Element.prependHTMLUnsafe
+  - api.Element.replaceHTML
+  - api.Element.replaceHTMLUnsafe
+  - api.Element.replaceWithHTML
+  - api.Element.replaceWithHTMLUnsafe
+  - api.Element.setHTMLUnsafe.options_runscripts_parameter
+  - api.ShadowRoot.afterHTML
+  - api.ShadowRoot.afterHTMLUnsafe
+  - api.ShadowRoot.appendHTML
+  - api.ShadowRoot.appendHTMLUnsafe
+  - api.ShadowRoot.beforeHTML
+  - api.ShadowRoot.beforeHTMLUnsafe
+  - api.ShadowRoot.prependHTML
+  - api.ShadowRoot.prependHTMLUnsafe
+  - api.ShadowRoot.replaceWithHTML
+  - api.ShadowRoot.replaceWithHTMLUnsafe
+  - api.ShadowRoot.setHTMLUnsafe.options_runscripts_parameter
+  - api.TrustedHTMLParserOptions
+  - api.TrustedHTMLParserOptions.runScripts
+  - api.TrustedHTMLParserOptions.sanitizer

features/html-streaming-setters.yml

@@ -0,0 +1,45 @@
+name: HTML streaming setters
+description: The `streamHTML()`, `streamReplaceWithHTML()`, `streamBeforeHTML()`, `streamPrependHTML()`, `streamAppendHTML()` and `streamAfterHTML()` DOM methods, and unsafe equivalents, return writeable streams that incrementally insert HTML into an existing tree.
+spec: https://github.com/whatwg/html/pull/12758
+#TODO: replace with below and remove from specs.ts once about PR is merged
+#spec: https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-parsing-and-serialization
+group: dom
+compat_features:
+  - api.CharacterData.streamAfterHTML
+  - api.CharacterData.streamAfterHTMLUnsafe
+  - api.CharacterData.streamBeforeHTML
+  - api.CharacterData.streamBeforeHTMLUnsafe
+  - api.CharacterData.streamReplaceWithHTML
+  - api.CharacterData.streamReplaceWithHTMLUnsafe
+  - api.DocumentType.streamAfterHTML
+  - api.DocumentType.streamAfterHTMLUnsafe
+  - api.DocumentType.streamBeforeHTML
+  - api.DocumentType.streamBeforeHTMLUnsafe
+  - api.DocumentType.streamReplaceWithHTML
+  - api.DocumentType.streamReplaceWithHTMLUnsafe
+  - api.Element.streamAfterHTML
+  - api.Element.streamAfterHTMLUnsafe
+  - api.Element.streamAppendHTML
+  - api.Element.streamAppendHTMLUnsafe
+  - api.Element.streamBeforeHTML
+  - api.Element.streamBeforeHTMLUnsafe
+  - api.Element.streamHTML
+  - api.Element.streamHTMLUnsafe
+  - api.Element.streamPrependHTML
+  - api.Element.streamPrependHTMLUnsafe
+  - api.Element.streamReplaceHTML
+  - api.Element.streamReplaceHTMLUnsafe
+  - api.Element.streamReplaceWithHTML
+  - api.Element.streamReplaceWithHTMLUnsafe
+  - api.ShadowRoot.streamAfterHTML
+  - api.ShadowRoot.streamAfterHTMLUnsafe
+  - api.ShadowRoot.streamAppendHTML
+  - api.ShadowRoot.streamAppendHTMLUnsafe
+  - api.ShadowRoot.streamBeforeHTML
+  - api.ShadowRoot.streamBeforeHTMLUnsafe
+  - api.ShadowRoot.streamHTML
+  - api.ShadowRoot.streamHTMLUnsafe
+  - api.ShadowRoot.streamPrependHTML
+  - api.ShadowRoot.streamPrependHTMLUnsafe
+  - api.ShadowRoot.streamReplaceWithHTML
+  - api.ShadowRoot.streamReplaceWithHTMLUnsafe

features/html-streaming-setters.yml.dist

@@ -0,0 +1,45 @@
+# Generated from: html-streaming-setters.yml
+# Do not edit this file by hand. Edit the source file instead!
+
+status:
+  baseline: false
+  support: {}
+compat_features:
+  - api.CharacterData.streamAfterHTML
+  - api.CharacterData.streamAfterHTMLUnsafe
+  - api.CharacterData.streamBeforeHTML
+  - api.CharacterData.streamBeforeHTMLUnsafe
+  - api.CharacterData.streamReplaceWithHTML
+  - api.CharacterData.streamReplaceWithHTMLUnsafe
+  - api.DocumentType.streamAfterHTML
+  - api.DocumentType.streamAfterHTMLUnsafe
+  - api.DocumentType.streamBeforeHTML
+  - api.DocumentType.streamBeforeHTMLUnsafe
+  - api.DocumentType.streamReplaceWithHTML
+  - api.DocumentType.streamReplaceWithHTMLUnsafe
+  - api.Element.streamAfterHTML
+  - api.Element.streamAfterHTMLUnsafe
+  - api.Element.streamAppendHTML
+  - api.Element.streamAppendHTMLUnsafe
+  - api.Element.streamBeforeHTML
+  - api.Element.streamBeforeHTMLUnsafe
+  - api.Element.streamHTML
+  - api.Element.streamHTMLUnsafe
+  - api.Element.streamPrependHTML
+  - api.Element.streamPrependHTMLUnsafe
+  - api.Element.streamReplaceHTML
+  - api.Element.streamReplaceHTMLUnsafe
+  - api.Element.streamReplaceWithHTML
+  - api.Element.streamReplaceWithHTMLUnsafe
+  - api.ShadowRoot.streamAfterHTML
+  - api.ShadowRoot.streamAfterHTMLUnsafe
+  - api.ShadowRoot.streamAppendHTML
+  - api.ShadowRoot.streamAppendHTMLUnsafe
+  - api.ShadowRoot.streamBeforeHTML
+  - api.ShadowRoot.streamBeforeHTMLUnsafe
+  - api.ShadowRoot.streamHTML
+  - api.ShadowRoot.streamHTMLUnsafe
+  - api.ShadowRoot.streamPrependHTML
+  - api.ShadowRoot.streamPrependHTMLUnsafe
+  - api.ShadowRoot.streamReplaceWithHTML
+  - api.ShadowRoot.streamReplaceWithHTMLUnsafe

features/parse-html-unsafe.yml

@@ -1,8 +1,5 @@
-name: Unsanitized HTML parsing methods
-description: The `Document.parseHTMLUnsafe()` static method parses HTML into a DOM tree, while the `setHTMLUnsafe()` method of `Element` and `ShadowRoot` parses and inserts HTML into an existing tree. No sanitization applies to these methods, so never call them with user-provided HTML strings.
-spec: https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#unsafe-html-parsing-methods
-# TODO: https://github.com/web-platform-dx/web-features/issues/1971
-# Status changed: https://github.com/web-platform-dx/web-features/pull/3200
-# 2025-08-06 - low → false - In Safari, if there are custom elements in a declarative shadow root in the parsed HTML, then the elements' constructors and `connectedCallback()` methods are not called.
-# References:
-# - https://bugs.webkit.org/show_bug.cgi?id=296420
+name: Unsanitized HTML parsing
+description: The `Document.parseHTMLUnsafe()` static method parses HTML into a DOM tree, much like the `setHTMLUnsafe()` DOM method inserts HTML into an existing tree. No sanitization applies, so never call it with user-provided strings.
+spec: https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-parsing-and-serialization
+compat_features:
+  - api.Document.parseHTMLUnsafe_static

features/parse-html-unsafe.yml.dist

@@ -13,28 +13,4 @@ status:
     safari: "26"
     safari_ios: "26"
 compat_features:
-  # baseline: low
-  # baseline_low_date: 2025-09-15
-  # support:
-  #   chrome: "124"
-  #   chrome_android: "124"
-  #   edge: "124"
-  #   firefox: "123"
-  #   firefox_android: "123"
-  #   safari: "26"
-  #   safari_ios: "26"
-  - api.Element.setHTMLUnsafe
-  - api.ShadowRoot.setHTMLUnsafe
-
-  # ⬇️ Same status as overall feature ⬇️
-  # baseline: low
-  # baseline_low_date: 2025-09-15
-  # support:
-  #   chrome: "124"
-  #   chrome_android: "124"
-  #   edge: "124"
-  #   firefox: "128"
-  #   firefox_android: "128"
-  #   safari: "26"
-  #   safari_ios: "26"
   - api.Document.parseHTMLUnsafe_static

features/sanitizer.yml

@@ -1,14 +1,8 @@
 name: Sanitizer API
-description: The `Document.parseHTML()` static method and the `setHTML()` method of `Element` and `ShadowRoot` objects parse and insert HTML into the DOM in a way that can prevent cross-site scripting attacks. The `Sanitizer` API can customize the sanitization process.
+description: The `Sanitizer` API customizes the sanitization of HTML parsed and inserted into the DOM in a way that can prevent cross-site scripting attacks. You can use it with DOM APIs that accept a sanitizer option, such as `Document.parseHTML()` or HTML setters such as `setHTML()`.
 spec: https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#html-sanitization
 compat_features:
-  # The main entry points.
-  # There are unsafe variants to these methods in `parse-html-unsafe.yml`.
-  - api.Element.setHTML
-  - api.ShadowRoot.setHTML
   - api.Document.parseHTML_static
-  # The Sanitizer interface can optionally be used for custom HTML
-  # sanitization.
   - api.Sanitizer
   - api.Sanitizer.Sanitizer
   - api.Sanitizer.allowAttribute

features/sanitizer.yml.dist

@@ -11,7 +11,6 @@ status:
     firefox_android: "148"
 compat_features:
   - api.Document.parseHTML_static
-  - api.Element.setHTML
   - api.Sanitizer
   - api.Sanitizer.Sanitizer
   - api.Sanitizer.allowAttribute
@@ -23,4 +22,3 @@ compat_features:
   - api.Sanitizer.replaceElementWithChildren
   - api.Sanitizer.setComments
   - api.Sanitizer.setDataAttributes
-  - api.ShadowRoot.setHTML

scripts/specs.ts

@@ -235,6 +235,14 @@ const defaultAllowlist: allowlistItem[] = [
     [
         "https://github.com/whatwg/html/pull/9546",
         "Allowed because the <input type=\"checkbox\" switch> feature is not yet in a formal spec. Remove this exception when a formal spec is available."
+    ],
+    [
+        "https://github.com/whatwg/html/pull/12753",
+        "Allowed because it's shipping in Chrome. Replace with https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-parsing-and-serialization when above PR is merged."
+    ],
+    [
+        "https://github.com/whatwg/html/pull/12758",
+        "Allowed because it's shipping in Chrome. Replace with https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-parsing-and-serialization when above PR is merged."
     ]
 ];