change(xml-sitemaps): XSL stylesheets are out — the HTML Standard says avoid client-side XSLT - #198
Draft
jdevalk wants to merge 1 commit into
Draft
change(xml-sitemaps): XSL stylesheets are out — the HTML Standard says avoid client-side XSLT#198jdevalk wants to merge 1 commit into
jdevalk wants to merge 1 commit into
Conversation
… avoid XSLT The HTML Standard gained an explicit warning against client-side XSLT on 2026-08-25 (whatwg/html@208004f): browser XSLT implementations are highly susceptible to memory-safety vulnerabilities and the feature is being removed from the web platform. Chrome stops running it in 158 (17 Nov 2026); Firefox and WebKit intend to follow. The page recommended exactly this, and claimed XSLT 1.0 was supported by current Chrome, Firefox and Safari. Rewrites the section to advise an ordinary HTML index instead, and drops the <?xml-stylesheet?> processing instruction from this site's own sitemaps so we no longer ship what we advise against. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Deploying specification-website with
|
| Latest commit: |
fc32e59
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://d4ec21dd.specification-website.pages.dev |
| Branch Preview URL: | https://change-xslt-deprecated-2026.specification-website.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
/spec/seo/xml-sitemaps/recommended attaching an XSLT stylesheet to a sitemap via<?xml-stylesheet?>so browsers render it as a readable table, and asserted that "XSLT 1.0 is supported by current Chrome, Firefox, and Safari with no client-side dependencies." That is no longer true, and the advice is now advice to build something that breaks in ten weeks.W3C XSLT 1.0and the Yoast article out; the WHATWG section and Chrome's removal doc in.updated.src/lib/sitemap.ts), plus the now-dead/sitemap.xslentries inpublic/_headersandpublic/_routes.json. Leaving the site doing the thing the page now advises against would be exactly the divergence CLAUDE.md calls a bug.changed).Why now
WHATWG HTML commit
208004f— "Mark XSLT deprecated", landed 2026-08-25, adds aclass="critical"note in three places:Primary sources
api.XSLTProcessoris markeddeprecated: true, with removal notes on Chrome, Chrome Android, Samsung Internet and Quest BrowserStatus
Page status stays
recommended— this is about sitemaps, and sitemaps are unaffected. Only the stylesheet advice changed, from "do this" to "do not".One thing left for a human
public/sitemap.xslis now orphaned — nothing references it — but I could not delete it (git rmis blocked in this environment). It needs removing before merge, or in a follow-up.Opened by the daily standards scan (
ops/routines/daily-standards-scan.md). Draft — not for auto-merge.