Hello, {user_name}!
") assert ( safe_output == "Hello, <script>alert('owned')</script>!
" ) ``` The escaping library that does the work is also the package's only runtime dependency, pinned to a minimum version. What makes this example more than documentation is covered in its own section below: the readme is collected by the test runner, so if the escaping ever regressed, that assertion would fail the suite rather than quietly mislead someone. ## Bare attribute values, booleans that disappear, and attributes that merge Attributes are where this library does more than string formatting, and there are four rules to learn. Values do not have to be quoted, so a variable can sit directly in an attribute position, and several substitutions can share one attribute. Boolean values are attributes: a true boolean renders the attribute and a false one removes it entirely, which is why an example ending in hidden with a false value produces markup with no hidden attribute at all. The class attribute accepts a list of names and joins them, or a dictionary that toggles individual classes, and it can be written more than once, with the values merged from left to right, which is the mechanism for extending a base set of classes with an override. The style attribute takes a dictionary of property names and values and merges the same way. ## Data and aria dictionaries become attributes, and booleans become strings The last two special cases are the ones that would otherwise be tedious. A dictionary assigned to a data attribute has its keys converted into attribute names by inserting a prefix and a hyphen, so a key like a hyphenated identifier becomes the attribute you would write by hand. The same applies to aria. The one subtlety is boolean handling: inside an aria attribute, a boolean is not dropped when false and not reduced to a bare attribute name when true, because the accessibility specification expects the literal strings, so a true value becomes the string true and a false one the string false. That is a deliberate divergence from the rule that governs ordinary boolean attributes, and the readme flags it with a link to the specification rather than leaving it implicit. ## The readme is a test target, which is why every example is an assertion The test configuration is the detail that makes the rest of the file trustworthy. The test paths are not just the package: they are the package, the documentation directory, and the readme itself, with a file pattern of a name ending in an underscore and the word test. So every example in the readme you have just read is executed as part of the suite, and a documented output that stops matching the real one breaks the build. The documentation directory is collected for the same reason, using a plugin that runs assertions embedded in prose, which is how a static site can be tested without a separate test file. The default task in the repository's task file is a chain of lint, two format checks, two type checkers and the tests, so the readme is formatted and verified in the same pass as the code. ## One runtime dependency, and a node toolchain that only formats markdown The dependency picture is small and the tooling picture is not. The package declares a single runtime dependency, the escaping library, and builds with a tool from the same ecosystem as the installer, at a version range bounded on both sides. The development group carries a type checker, a second type checker, a linter, a formatter, the test runner with coverage, an HTML report plugin and a watcher, a documentation generator with a theme and a markdown parser, and a badge generator for the coverage and test badges in the readme. Alongside all that sits a node manifest whose only content is a formatter for markdown with a line width of 80. That manifest also carries a version of 1.0.0 while the Python package is at 0.1.20, which is a good reminder that the two version numbers are unrelated. ## Conclusion Use tdom if you are already on Python 3.14 and want templates whose interpolated values are escaped by default and whose class lists and style dictionaries can be composed from several sources without string concatenation. Do not adopt it for production work yet, since the project calls itself pre-alpha and says the API may change without warning, and do not expect the documentation to answer your questions, because the site is labelled incomplete. Before you depend on it, read the attribute examples closely, especially the boolean and repeated-attribute rules, pin the exact version, and remember that the runtime dependency count is one. ## FAQ ### What is a t-string in Python? It is the template string feature added in Python 3.14: it behaves like an f-string but uses a different prefix, and instead of producing a string it produces a template object. tdom is built on that feature, and its render function turns a template into HTML with interpolated values escaped automatically. ### How do I install and try tdom? You need Python 3.14, which the readme notes was released in October 2025, and then a single pip install command. If you use the uv tool there is a one-line alternative that runs the package in an isolated 3.14 environment without changing anything you already have. The manifest sets 3.14 as a hard floor and also claims support for 3.15. ### How does tdom handle class, style, data and aria attributes? All four get special handling. Classes accept a list of names or a dictionary that toggles them, and can be repeated and merged from left to right. Styles take a dictionary of property names and values and merge the same way. Data and aria dictionaries have their keys converted into the right attribute names, and booleans inside aria become the strings true and false as the accessibility specification requires. ### Does tdom escape interpolated values, and how is that tested? The render function escapes interpolated values automatically, and the readme demonstrates it by interpolating a script tag and asserting that the output carries escaped angle brackets and an escaped quote. The test configuration collects the readme as a test target alongside the package and the documentation, so a change in that escaping would fail the suite. ## Sources - [Official documentation](https://t-strings.github.io/tdom/) - [Official README](https://github.com/t-strings/tdom#readme) - [Project repository](https://github.com/t-strings/tdom) - [Release notes](https://github.com/t-strings/tdom/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/t-strings-tdom