WPT details: https://wpt.fyi/results/sanitizer-api/sanitizer-javascript-url.html
https://github.com/whatwg/html/pull/12898 Sanitizer API also sanitizes javascript:-URLs, when they are used for navigation. This was originally done as a side effect of any "safe" method that uses Sanitizer, and omittted for any "unsafe" method. The HTML standard recently regularized this and made this a developer-selectable option, instead of a side-effect of a particular method. Behaviour when the option is not used remains the same.
Previously, Sanitizer API already supported sanitizing javascript:-URLs, but only for "safe" methods. This was awkward if users wanted to use the "unsafe" methods for some reason, but still wanted javascript:-URLs removed. Further discussion on: https://github.com/whatwg/html/issues/12686 https://github.com/whatwg/html/pull/12898
Docs: https://html.spec.whatwg.org/#dom-sanitizer-setjavascripturls