See https://github.com/jquery/jquery/issues/2432#issuecomment-199098662 This XSS update is a behavior change. We reverted in 2.2-stable, but not in 1.12-stable. It should stay in 3.0.