\n some text\n \n \n deltaecho\n \n
\n)\n```\n\n`example-svg.jsx`:\n\n```js\n/** @jsxImportSource hastscript/svg */\nconsole.log(\n \n)\n```\n\n## Compatibility\n\nProjects maintained by the unified collective are compatible with maintained\nversions of Node.js.\n\nWhen we cut a new major release,\nwe drop support for unmaintained versions of Node.\nThis means we try to keep the current release line,\n`hastscript@9`,\ncompatible with Node.js 16.\n\n## Security\n\nUse of `hastscript` can open you up to a\n[cross-site scripting (XSS)][wikipedia-xss]\nwhen you pass user-provided input to it because values are injected into the\nsyntax tree.\n\nThe following example shows how an image is injected that fails loading and\ntherefore runs code in a browser.\n\n```js\nconst tree = h()\n\n// Somehow someone injected these properties instead of an expected `src` and\n// `alt`:\nconst otherProps = {onError: 'alert(1)', src: 'x'}\n\ntree.children.push(h('img', {src: 'default.png', ...otherProps}))\n```\n\nYields:\n\n```html\n