Repository navigation
feat: support trusted types for jit compilation #6630
Description
For instance DOMPurify supports trusted types, you can either supply your own policy, or it will create a default called 'dompurify'.
Trusted types is available for all major browsers now, so this is the way to run dynamic code in a secure way...
ref: #5789 (comment)
Activity
dokson commentedon Oct 14, 2026
@colinhacks fix for this is up on my fork: dokson#2. It routes the JIT's
new Functionarguments through a"zod"Trusted Types policy, so a CSP with'trusted-types-eval'keeps the fastpass; nothing changes for pages without Trusted Types. +92 B gzip on classic, mini unchanged.