Skip to content

[pull] main from mdn:main #636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pull merged 2 commits into from
Mar 4, 2026
Merged

[pull] main from mdn:main #636

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a287c9e
:recycle: Refactor: Fix grammatical error (#43333)
derekrgreene Mar 4, 2026
f529ead
Updates to `modulepreload` and `preload` to incorporate WHATWG change…
KurtCattiSchmidt Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion files/en-us/web/api/range/createcontextualfragment/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ In the HTML case, if the context node would be `html`, for historical reasons th
### Security considerations

The method does not perform any sanitization of the input to remove XSS-unsafe elements such as {{htmlelement("script")}}, or event handler content attributes.
If the input is provided by a user, and the returned {{domxref("DocumentFragment")}} is subsequently injected into the DOM, this method can be therefore become a vector for [cross-site scripting (XSS)](/en-US/docs/Web/Security/Attacks/XSS) attacks.
If the input is provided by a user, and the returned {{domxref("DocumentFragment")}} is subsequently injected into the DOM, this method can become a vector for [cross-site scripting (XSS)](/en-US/docs/Web/Security/Attacks/XSS) attacks.

For example, the following code would inject the potentially dangerous user-provided string into the DOM.

Expand Down
2 changes: 1 addition & 1 deletion files/en-us/web/html/reference/attributes/rel/modulepreload/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ If `crossorigin` is set to [`anonymous`](/en-US/docs/Web/HTML/Reference/Attribut
If `crossorigin` is set to [`use-credentials`](/en-US/docs/Web/HTML/Reference/Attributes/crossorigin#use-credentials) then the credentials mode is [`include`](/en-US/docs/Web/API/Request/credentials#include), and user credentials for both single- and cross-origin requests.

The [`as`](/en-US/docs/Web/HTML/Reference/Elements/link#as) attribute is optional for links with `rel="modulepreload"`, and defaults to `"script"`.
It can be set to `"script"` or any script-like destination, such as `"audioworklet"`, `"paintworklet"`, `"serviceworker"`, `"sharedworker"`, or `"worker"`.
It can be set to `"script"`, `"style"`, `"json"`, or any script-like destination, such as `"audioworklet"`, `"paintworklet"`, `"serviceworker"`, `"sharedworker"`, or `"worker"`.
An [`Event`](/en-US/docs/Web/API/Event/Event) named "error" is fired on the element if any other destination is used.

A browser _may_ additionally also choose to automatically fetch any dependencies of the module resource.
Expand Down
10 changes: 8 additions & 2 deletions files/en-us/web/html/reference/elements/link/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,21 +142,27 @@ This element includes the [global attributes](/en-US/docs/Web/HTML/Reference/Glo
CSS <code>*-image</code> rules
</td>
</tr>
<tr>
<td>json</td>
<td>
<code>modulepreload</code> destinations.
</td>
</tr>
<tr>
<td>object</td>
<td><code>&#x3C;object></code> elements</td>
</tr>
<tr>
<td>script</td>
<td>
<code>&#x3C;script></code> elements, Worker <code>importScripts</code>
<code>&#x3C;script></code> elements, Worker <code>importScripts</code>, and <code>modulepreload</code> destinations.
</td>
</tr>
<tr>
<td>style</td>
<td>
<code>&#x3C;link rel=stylesheet></code> elements, CSS
<code>@import</code>
<code>@import</code> and <code>modulepreload</code> destinations.
</td>
</tr>
<tr>
Expand Down