{"repo":"w3c/trusted-types","summary":{"retrieved":"2026-05-16T07:46:40Z","triageViolations":9,"urgentViolations":0,"soonViolations":0,"agendaViolations":0,"needsEditsViolations":0,"needTriage":0,"urgent":0,"soon":0,"agenda":0,"needsEdits":0,"other":46},"triage":[{"number":358,"url":"https://github.com/w3c/trusted-types/issues/358","title":"Maybe enforce Trusted Types in document.createProcessingInstruction?","author":"shhnjk","createdAt":"2022-02-15T19:53:26Z","labels":["future"],"sloTimeUsed":"P1550DT11H53M14S","whichSlo":"triage","stats":{"numTimelineItems":1,"numComments":0,"numLabels":1},"outOfSlo":true},{"number":444,"url":"https://github.com/w3c/trusted-types/issues/444","title":"Should the polyfill be moved?","author":"lukewarlow","createdAt":"2024-02-20T16:43:46Z","labels":["polyfill"],"sloTimeUsed":"P815DT15H2M54S","whichSlo":"triage","stats":{"numTimelineItems":1,"numComments":0,"numLabels":1},"outOfSlo":true},{"number":472,"url":"https://github.com/w3c/trusted-types/issues/472","title":"Adopt Infra syntax throughout","author":"annevk","createdAt":"2024-03-07T08:43:56Z","labels":[],"sloTimeUsed":"P799DT23H2M44S","whichSlo":"triage","stats":{"numTimelineItems":0,"numComments":0,"numLabels":0},"outOfSlo":true},{"number":476,"url":"https://github.com/w3c/trusted-types/issues/476","title":"[Meta] Upstream changes","author":"lukewarlow","createdAt":"2024-03-13T14:52:49Z","labels":[],"sloTimeUsed":"P793DT16H53M51S","whichSlo":"triage","stats":{"numTimelineItems":0,"numComments":2,"numLabels":0},"outOfSlo":true},{"number":586,"url":"https://github.com/w3c/trusted-types/issues/586","title":"Do non JS scripts really need TT enforcement?","author":"lukewarlow","createdAt":"2025-05-28T13:15:38Z","labels":[],"sloTimeUsed":"P352DT18H31M2S","whichSlo":"triage","stats":{"numTimelineItems":0,"numComments":1,"numLabels":0},"outOfSlo":true},{"number":592,"url":"https://github.com/w3c/trusted-types/issues/592","title":"Deprecate \"allow-duplicates\" - it's insecure and makes trusted types useless","author":"kkmuffme","createdAt":"2025-07-20T17:37:19Z","labels":[],"sloTimeUsed":"P299DT14H9M21S","whichSlo":"triage","stats":{"numTimelineItems":0,"numComments":0,"numLabels":0},"outOfSlo":true},{"number":593,"url":"https://github.com/w3c/trusted-types/issues/593","title":"Duplicate trusted-type policy should invalidate the existing policy too","author":"kkmuffme","createdAt":"2025-07-20T18:31:30Z","labels":[],"sloTimeUsed":"P299DT13H15M10S","whichSlo":"triage","stats":{"numTimelineItems":0,"numComments":0,"numLabels":0},"outOfSlo":true},{"number":599,"url":"https://github.com/w3c/trusted-types/issues/599","title":"Specification Enhancement: Add blob navigation enforcement to Trusted Types","author":"reconsumeralization","createdAt":"2025-09-12T00:52:29Z","labels":[],"sloTimeUsed":"P246DT6H54M11S","whichSlo":"triage","stats":{"numTimelineItems":0,"numComments":0,"numLabels":0},"outOfSlo":true},{"number":607,"url":"https://github.com/w3c/trusted-types/pull/607","title":"Add new update script trustedness algorithm for the HTML spec to call","author":"lukewarlow","createdAt":"2026-02-24T14:35:41Z","pull_request":{"draft":false},"labels":[],"sloTimeUsed":"P80DT17H1M9S","whichSlo":"triage","stats":{"numTimelineItems":4,"numComments":4,"numLabels":0},"outOfSlo":true}],"urgent":[],"soon":[],"agenda":[],"needsEdits":[],"other":[{"number":232,"url":"https://github.com/w3c/trusted-types/issues/232","title":"Handle non-DOM APIs of loading scripts comprehensively.","author":"koto","createdAt":"2019-10-31T14:14:42Z","labels":["spec","future"],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/2","title":"v2"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":2,"numLabels":2}},{"number":247,"url":"https://github.com/w3c/trusted-types/issues/247","title":"How to bless asset references","author":"mikesamuel","createdAt":"2019-12-06T17:45:09Z","labels":["spec","tc39","future"],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/2","title":"v2"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":3,"numLabels":3}},{"number":270,"url":"https://github.com/w3c/trusted-types/issues/270","title":"JavaScript event for tracking (and blocking) policy creation","author":"koto","createdAt":"2020-03-11T10:19:38Z","labels":["spec","future","proposed-removal"],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/2","title":"v2"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":3,"numLabels":3}},{"number":278,"url":"https://github.com/w3c/trusted-types/issues/278","title":"Make input argument to createHTML, createScript, and createScriptURL optional","author":"shhnjk","createdAt":"2020-05-05T04:54:19Z","labels":["future"],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numComments":5,"numLabels":1}},{"number":343,"url":"https://github.com/w3c/trusted-types/issues/343","title":"Consider allowing `innerHTML = ''`","author":"koto","createdAt":"2021-07-07T11:41:58Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":2,"numComments":18,"numLabels":0}},{"number":359,"url":"https://github.com/w3c/trusted-types/issues/359","title":"Maybe enforce Trusted Types in XSL's xsl:text","author":"shhnjk","createdAt":"2022-02-15T20:03:32Z","labels":["future"],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numComments":5,"numLabels":1}},{"number":360,"url":"https://github.com/w3c/trusted-types/issues/360","title":"Can we conditionally enforce Trusted Types based on document response type in XHR?","author":"shhnjk","createdAt":"2022-02-15T20:34:46Z","labels":["spec","security"],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":2,"numComments":5,"numLabels":2}},{"number":379,"url":"https://github.com/w3c/trusted-types/issues/379","title":"should `null` & `undefined` for sinks requiring TT be a passthrough ?","author":"dejang","createdAt":"2023-05-04T17:08:12Z","labels":[],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numLabels":0}},{"number":381,"url":"https://github.com/w3c/trusted-types/issues/381","title":"getAttributeType and getPropertyType should default to HTML namespace, not \"\"","author":"smaug----","createdAt":"2023-12-04T21:58:40Z","labels":[],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":2,"numLabels":0}},{"number":411,"url":"https://github.com/w3c/trusted-types/issues/411","title":"Add `fromLiteral`","createdAt":"2024-01-23T10:05:41Z","labels":[],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/2","title":"v2"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numLabels":0}},{"number":415,"url":"https://github.com/w3c/trusted-types/issues/415","title":"Create pull request template","createdAt":"2024-01-23T11:37:12Z","labels":[],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numLabels":0}},{"number":421,"url":"https://github.com/w3c/trusted-types/issues/421","title":"Can we add no-op/report?","author":"bkardell","createdAt":"2024-01-24T17:28:15Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":7,"numLabels":0}},{"number":422,"url":"https://github.com/w3c/trusted-types/issues/422","title":"Adressing cross-document vectors comprehensively relies on \"origin-policy\" which is a proposal which is on hold ","createdAt":"2024-01-25T10:56:50Z","labels":[],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numLabels":0}},{"number":424,"url":"https://github.com/w3c/trusted-types/issues/424","title":"Can lowercasing be removed from getAttributeType()?","author":"annevk","createdAt":"2024-01-25T13:02:55Z","labels":[],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":4,"numLabels":0}},{"number":442,"url":"https://github.com/w3c/trusted-types/issues/442","title":"Integration with Shadow Realms?","author":"lukewarlow","createdAt":"2024-02-20T15:07:09Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":9,"numLabels":0}},{"number":462,"url":"https://github.com/w3c/trusted-types/issues/462","title":"Trusted Types closure to replace fallback policy","author":"lukewarlow","createdAt":"2024-02-29T14:52:11Z","labels":["enhancement","future"],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/2","title":"v2"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":2,"numLabels":2}},{"number":466,"url":"https://github.com/w3c/trusted-types/issues/466","title":"Creating a policy with policyName=\"\" is possible, but can't be referred to by the \"trusted-types\" CSP directive","createdAt":"2024-03-05T15:02:23Z","labels":[],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/2","title":"v2"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numLabels":0}},{"number":469,"url":"https://github.com/w3c/trusted-types/issues/469","title":"Stringification of TrustedHTML with `null`-data needs to be specified","createdAt":"2024-03-06T10:33:51Z","labels":[],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":2,"numLabels":0}},{"number":471,"url":"https://github.com/w3c/trusted-types/issues/471","title":"Developer-centric research results about Trusted Types","author":"rothsn","createdAt":"2024-03-06T16:28:25Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":2,"numLabels":0}},{"number":496,"url":"https://github.com/w3c/trusted-types/issues/496","title":"Check variable naming inside of getAttributeType and getPropertyType methods","author":"lukewarlow","createdAt":"2024-03-28T13:59:22Z","labels":["spec"],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numComments":2,"numLabels":1}},{"number":504,"url":"https://github.com/w3c/trusted-types/issues/504","title":"`createPolicy`'s permitted policy names are inconsistent with CSP's permitted policy names","createdAt":"2024-04-17T07:55:30Z","labels":["spec"],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numLabels":1}},{"number":507,"url":"https://github.com/w3c/trusted-types/issues/507","title":"Script element protection model","author":"lukewarlow","createdAt":"2024-04-22T16:09:55Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":2,"numLabels":0}},{"number":512,"url":"https://github.com/w3c/trusted-types/issues/512","title":"Should SVGScriptElement have an IDL way to set a trusted script value?","author":"lukewarlow","createdAt":"2024-05-02T13:25:50Z","labels":["spec"],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/2","title":"v2"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numLabels":1}},{"number":517,"url":"https://github.com/w3c/trusted-types/issues/517","title":"Should all 3 script IDL setters change the associated script text value identically","author":"lukewarlow","createdAt":"2024-05-20T18:23:35Z","labels":["spec"],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numComments":11,"numLabels":1}},{"number":519,"url":"https://github.com/w3c/trusted-types/issues/519","title":"Seeking Trusted Types feedback on Array.isTemplateObject","author":"littledan","createdAt":"2024-05-28T20:33:53Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":5,"numLabels":0}},{"number":520,"url":"https://github.com/w3c/trusted-types/issues/520","title":"Finalise spec mechanism for event handlers","author":"lukewarlow","createdAt":"2024-06-12T12:26:22Z","labels":["spec"],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numLabels":1}},{"number":521,"url":"https://github.com/w3c/trusted-types/issues/521","title":"getPropertyType and SVGScriptElement href baseVal property","author":"lukewarlow","createdAt":"2024-06-12T12:32:37Z","labels":["spec"],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numComments":3,"numLabels":1}},{"number":525,"url":"https://github.com/w3c/trusted-types/issues/525","title":"Script element mid-parse protection mechanism","author":"lukewarlow","createdAt":"2024-06-12T14:30:34Z","labels":["spec"],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numLabels":1}},{"number":535,"url":"https://github.com/w3c/trusted-types/issues/535","title":"Should the APIs for creating a TrustedScript etc return a frozen object?","author":"lukewarlow","createdAt":"2024-07-11T13:58:11Z","labels":["spec"],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numLabels":1}},{"number":540,"url":"https://github.com/w3c/trusted-types/issues/540","title":"How can policyValue be 'undefined'?","author":"smaug----","createdAt":"2024-08-02T09:30:46Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":2,"numLabels":0}},{"number":541,"url":"https://github.com/w3c/trusted-types/issues/541","title":"\"stringifying\" in \"Process value with a default policy\" needs to be defined","createdAt":"2024-08-15T09:20:55Z","labels":["spec"],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":1,"numComments":3,"numLabels":1}},{"number":548,"url":"https://github.com/w3c/trusted-types/issues/548","title":"\"pre-navigation check\" uses \"request’s clients's global object\" which is null","createdAt":"2024-09-18T15:11:07Z","labels":[],"milestone":{"url":"https://github.com/w3c/trusted-types/milestone/1","title":"v1"},"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numLabels":0}},{"number":566,"url":"https://github.com/w3c/trusted-types/issues/566","title":"Rely on WedIDL's \"implements\" definition for isHTML/isScript/isScriptURL?","author":"fred-wang","createdAt":"2024-12-04T11:16:13Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":5,"numLabels":0}},{"number":569,"url":"https://github.com/w3c/trusted-types/issues/569","title":"mXSS: should `createHTML` get information about the context?","author":"mozfreddyb","createdAt":"2024-12-20T08:57:14Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":6,"numLabels":0}},{"number":577,"url":"https://github.com/w3c/trusted-types/issues/577","title":"Clipping of violation’s sample to the 40 first characters","author":"fred-wang","createdAt":"2025-01-23T11:56:32Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":2,"numLabels":0}},{"number":580,"url":"https://github.com/w3c/trusted-types/issues/580","title":"CSP syntax for `require-trusted-types-for` should be forgiving","author":"lukewarlow","createdAt":"2025-02-24T14:12:51Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":4,"numLabels":0}},{"number":584,"url":"https://github.com/w3c/trusted-types/issues/584","title":"navigation requests blocked by require-trusted-types-for don't set a violation sample","author":"fred-wang","createdAt":"2025-04-01T10:23:52Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":3,"numLabels":0}},{"number":588,"url":"https://github.com/w3c/trusted-types/issues/588","title":"Asynchronous createHTML/createScript/createScriptURL","author":"fred-wang","createdAt":"2025-06-26T09:59:06Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":2,"numLabels":0}},{"number":594,"url":"https://github.com/w3c/trusted-types/issues/594","title":"Streaming support","author":"noamr","createdAt":"2025-08-07T11:16:47Z","labels":["enhancement","spec","future"],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":3,"numComments":53,"numLabels":3}},{"number":595,"url":"https://github.com/w3c/trusted-types/issues/595","title":"3.5. Process value with a default policy doesn't take into account `default_policy` could be null","author":"tete17","createdAt":"2025-08-13T15:30:12Z","labels":["bug","spec"],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":2,"numComments":5,"numLabels":2}},{"number":604,"url":"https://github.com/w3c/trusted-types/issues/604","title":"Spec text should define how to match against tt-keyword.","author":"otherdaniel","createdAt":"2026-01-09T10:02:32Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":1,"numLabels":0}},{"number":605,"url":"https://github.com/w3c/trusted-types/issues/605","title":"HTMLScriptElement doesn't show trusted types API in `@webref/idl`","author":"hybrist","createdAt":"2026-02-07T01:13:55Z","labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":0,"numComments":3,"numLabels":0}},{"number":560,"url":"https://github.com/w3c/trusted-types/pull/560","title":"Disallow empty policy names on creation.","author":"koto","createdAt":"2024-10-31T12:10:33Z","pull_request":{"draft":false},"labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":4,"numComments":4,"numLabels":0}},{"number":579,"url":"https://github.com/w3c/trusted-types/pull/579","title":"Change Script Enforcement Mechanism to use flags","author":"lukewarlow","createdAt":"2025-02-03T15:27:33Z","pull_request":{"draft":true},"labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":39,"numComments":39,"numLabels":0}},{"number":591,"url":"https://github.com/w3c/trusted-types/pull/591","title":"Cleanup calling of some algorithms","author":"lukewarlow","createdAt":"2025-07-03T10:06:40Z","pull_request":{"draft":false},"labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":6,"numComments":6,"numLabels":0}},{"number":606,"url":"https://github.com/w3c/trusted-types/pull/606","title":"Enable createParserOptions, passing a sanitizer to trusted types","author":"noamr","createdAt":"2026-02-17T11:13:22Z","pull_request":{"draft":false},"labels":[],"sloTimeUsed":"PT0S","whichSlo":"none","stats":{"numTimelineItems":10,"numComments":10,"numLabels":0}}]}