AIKIDO-2026-10836

TL;DR

Host bindings could still declare dangerous event-attribute shapes such as names beginning with on or attr.on when the compiler only relied on older checks. The compiler now walks parsed host properties and records parse errors for those patterns, steering authors toward real event bindings instead of DOM event-handler attributes. That closes a class of injection where hostile host metadata could reach the DOM as executable handler attributes in production builds.