You can throw away innerHTML and replace it with the new setHTML(), which has a built-in sanitizer. Here's how it works:
@wingmatt.dev
Depending on the day, I'm a professional tinkerer, active listener, and/or project manager. I've built web apps, virtualized domain controllers, and counseled memory care patients. Current code interests: PHP, Laravel, & Vue
You can throw away innerHTML and replace it with the new setHTML(), which has a built-in sanitizer. Here's how it works:
The Sanitizer API landed in Firefox 148, along with element.setHTML().
This lets you fully configure how HTML strings are cleaned as they're parsed.
hacks.mozilla.org/2026/02/good...
π¦₯ A fun update over on the blog: π¦₯
Standard HTML Video & Audio Lazy-loading is Coming!
scottjehl.com/posts/lazy-m...
That's not just me saying it's technical debt, it's also the guy who invented the term technical debt saying it.
daverupert.com/2020/11/tech...
Glad to stumble upon this post by Margaret-Anne Storey. It echos some of my recent experiences with Generative AI. It's very quick to spin up something that is quite large and complex and you don't know how it works. And a lack of understanding is technical debt.
margaretstorey.com/blog/2026/02...
~7 years ago I started curating a list of Design Tokens resources on GitHub⦠today I launch something better.
An updated, tagged collection of 292+ articles on design tokens.
www.alwaystwisted.com/projects/dtm...
more links/resources coming soon.
ππ€
#DesignTokens #DesignSystems #WebDev
Scott Riley tested free and open source design tools out when researching his course, Mindful Design. They actually worked out better than Figma ever could, as he explains in this article with loads of options for you.
piccalil.li/blog/the-ope...
Trust is interesting because itβs not quantifiable but it certainly is palpable. Teams with trust move lightning speeds faster than those without.
The new corner-shape CSS property unlocks exciting new UI patterns.
corner-shape: bevel round;
border-radius: 1em 0 / 3em 0;
My book, Accessibility For Everyone, is now free and online as a website.
accessibilityforeveryone.site
The book was first published by A Book Apart in 2017 but it holds up! It covers web accessibility for designers, developers, content folks, and really everyone who works in tech.
The new Web Almanac is out. π
If you don't know the Web Almanac, it's pretty much a summary and analysis of the state of the web based on real data from the HTTP Archive.
As a yearly tradition, I'll go over it and highlight/comment on the things that stand out. Let's go! π§΅
The 2025 Web Almanac by HTTP Archive has been officially released! π
We would like to thank all of our contributors from around the globe who made this extensive report possible!
Check out the full report here: almanac.httparchive.org
I recently added a rule to my reset style sheet UA+ that I wanted to share with you.
matuzo.at/blog/2026/be...
A really common user interface pattern is a big clickable area, such as a card. Sometimes you need controls within that card that are also clickable. There's lots of ways to do it wrong, but fret not, @ericwbailey.website is here to show you how to do it right.
piccalil.li/blog/accessi...
Introducing the Astro 6.0 Beta.
- Redesigned dev server: run against the same runtime you deploy to
- First-class Cloudflare Workers support with workerd
- Stable Content Security Policy and Live Collections
It's never been a beta time to try Astro π
Made a lil' library:
codepen.github.io/slideVars/
Automatically detects CSS custom properties on the :root/html and gives you controls for adjusting them. (But it's also as configurable as you want it to be.)
Temporal is the Date system we always wanted in JavaScript. It's extremely close to being available so Mat Marquis thought it would be a good idea to explain exactly what is better about this new JavaScript date system.
piccalil.li/blog/date-is...
i love the beginning of the year because everyone starts blogging. and if you (yes you) were thinking about starting, this is your sign
π Happy holidays!
You can now import CSS custom properties into Engramma and get a flat list of design tokens, making it easier to migrate existing projects to standard format.
Just gonna say this again for games sphere cus we get the same question:
Networking doesn't mean schmoozing up to famous people, it means making friends with your peers. Then in 10 years, 20, one of you might be famous? And sure you're still helping each other cus well yeah friends.
Make. Friends.
It's the Christmas issue of Famitsu, so that means many Japanese gaming industry folks gave their personal Game of the Year lists. I'll update this thread periodically since there's a lot of them once again.
Behold, the end of year developer. An unflinching look at the survival period of "working" during the holidays.
www.youtube.com/watch?v=ps06...
this is just being a SRE
A post by c.a.t.y.a.y that reads, "I wonder what my art could've been if I didn't quit". Iggy responds, "I wonder what it will be if you start again"
Going into 2026, a reminder for everyone who's fallen off the creative wagon, game dev, writing, art, music, whatever, no matter how long:
Samsung halting SATA SSD production says leaker, warns of 18 months of SSD price pressure
On day 13 @lloydi.com presents one of my favourite debugging tools. #htmHellAdventcalendar
htmhell.dev/adventcalend...
Researchers have found two new vulnerabilities in React Server Components while attempting to exploit the patches last week.
These are new issues, separate from the critical CVE last week. The patch for React2Shell remains effective for the Remote Code Execution exploit.
There are accessibility bugs in Popovers that hindered a client of mine from using them.
matuzo.at/blog/2025/de...
Developer attempts to replicate "Liquid Glass" in CSS, and once finished realizes what she'd actually created is an exploit for a fundamental, previously unknown, and rather serious browser vulnerability
lyra.horse/blog/2025/12...
"CSS hack accidentally becomes regular hack"