Declarative Partial Updates

Renewed HTML insertion and streaming methods

Summary: One naming scheme for inserting HTML, with a safe method and an Unsafe method for each position, plus a streaming form of each. Safe methods sanitize. Unsafe methods take { sanitizer, runScripts }. Streaming uses a WritableStream from getWriter() or from Response.textStream().

Explainer: dynamic-markup-revamped-explainer.md

Docs: Declarative partial updates | Chrome for Developers

Ready for developer testing from Chrome 148 behind chrome://flags/#enable-experimental-web-platform-features. Planned for Chrome 155. Response.textStream() shipped in Chrome 151. setHTML / setHTMLUnsafe may already exist from the Sanitizer API; the positional and streaming methods are the new surface.

=== This is a demo of the renewed HTML insertion and streaming methods. ===

Method support

setHTML

Replaces the element's children. The default sanitizer drops the script and the onerror handler.

previous children


    


    

        
setHTML with a sanitizer

        
Allows p, em, strong. The div and script
            are not in the allow list.

        

            
previous children

        

        
        

    


    

        
setHTMLUnsafe

        
script has not run

        

            
previous children

        

        
Chrome 153 stable accepts runScripts: true and leaves the script inert. Chrome 156 Canary
            with the experimental flag runs it.

        
        
        

    


    

        
appendHTML / prependHTML

        

            
middle

        

        
        
        

    


    

        
beforeHTML / afterHTML / replaceWithHTML

        

            
sibling target

        

        
        
        
        
        

    


    

        
streamHTMLUnsafe / streamAppendHTMLUnsafe

        
streamHTMLUnsafe replaces children as chunks arrive. streamAppendHTMLUnsafe adds
            chunks after the existing children.

        

            
previous children, replaced by streamHTMLUnsafe

        

        
        

            
kept sibling

        

        
        

    


    

        
Response.textStream()

        

            
previous children

        

        
        

    


    

        
<template for> from these methods

        

            still the original text

        
sink for setHTMLUnsafe