Visualforce

Visualforce contains a release update in Spring ’26, a continuation of an earlier release update.

For more information on features affected by these changes, refer to the Visualforce Developer Guide.

• Escape the Label Attribute of <apex:inputField> Elements to Prevent Cross-Site Scripting in Visualforce Pages (Release Update)
  To prevent malicious code from executing in cross-site scripting (XSS) attacks on your Visualforce pages, this release update escapes the label attribute of your <apex:inputField> tags. This update was first available in Winter ’23.