JS: Change note

asgerf · asgerf · commit 6ed9a6797324 · 2025-11-26T13:34:16.000+01:00
diff --git a/javascript/ql/src/change-notes/2025-11-26-response-default-content-type.md b/javascript/ql/src/change-notes/2025-11-26-response-default-content-type.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* `new Response(x)` is not longer seen as a reflected XSS sink when no`content-type` header
+  is set, since the content type defaults to `text/plain`.
