Add HTML language support

Changelog.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.96] - 2026-08-01
+### Added
+- Added HTML analysis and suppression support for `.html` and `.htm` files, including VS Code integration.
+
 ## [1.0.95] - 2026-07-31
 ### Pipeline
 - Added `.github/dependabot.yml` so Dependabot consolidates npm, NuGet, and GitHub Actions version updates into a single weekly pull request via a multi-ecosystem group, groups security updates per ecosystem into one pull request each, and labels its pull requests `no changelog` so the changelog gate passes.

DevSkim-DotNet/Microsoft.DevSkim.Tests/DefaultRulesTests.cs

@@ -118,6 +118,44 @@ public void DenamespacedRule()
         Assert.AreEqual(1, analysis.Count());
     }
 
+    [TestMethod]
+    [DataRow("html")]
+    [DataRow("htm")]
+    public void HtmlRulesApplyToHtmlFiles(string extension)
+    {
+        const string content = "<a href=\"https://example.com\" target=\"_blank\">Unsafe Link</a>";
+        const string rule = """
+        [{
+          "name": "HTML target blank without noopener",
+          "id": "HTML000001",
+          "description": "Detects target blank links without noopener",
+          "applies_to": [
+            "html"
+          ],
+          "tags": [
+            "security"
+          ],
+          "severity": "bestpractice",
+          "confidence": "high",
+          "patterns": [
+            {
+              "pattern": "target\\s*=\\s*[\\\"']_blank[\\\"']",
+              "type": "regex"
+            }
+          ]
+        }]
+        """;
+        DevSkimRuleSet devSkimRuleSet = new DevSkimRuleSet();
+        devSkimRuleSet.AddString(rule, "testRules");
+        DevSkimRuleProcessor analyzer = new DevSkimRuleProcessor(devSkimRuleSet, new DevSkimRuleProcessorOptions());
+
+        IEnumerable<Issue> analysis = analyzer.Analyze(content, $"thing.{extension}");
+
+        Assert.HasCount(1, analysis);
+        string suppression = DevSkimRuleProcessor.GenerateSuppressionByFileName($"thing.{extension}", "HTML000001");
+        Assert.AreEqual("<!-- DevSkim: ignore HTML000001 -->", suppression);
+    }
+
     public static IEnumerable<object[]> DefaultRules
     {
         get

DevSkim-DotNet/Microsoft.DevSkim/resources/comments.json

@@ -74,5 +74,12 @@
     "inline": "::",
     "prefix": "Rem",
     "suffix": "\n"
+  },
+  {
+    "language": [
+      "html"
+    ],
+    "prefix": "<!--",
+    "suffix": "-->"
   }
 ]

DevSkim-DotNet/Microsoft.DevSkim/resources/languages.json

@@ -143,6 +143,10 @@
     "name": "json",
     "extensions": [ ".json" ]
   },
+  {
+    "name": "html",
+    "extensions": [ ".html", ".htm" ]
+  },
   {
     "name": "xml",
     "extensions": [ ".xml" ]

DevSkim-VSCode-Plugin/client/common/selectors.ts

@@ -7,6 +7,7 @@ export const selectors = [{ scheme: 'file', language: 'c' },
 { scheme: 'file', language: 'fsharp' },
 { scheme: 'file', language: 'go' },
 { scheme: 'file', language: 'groovy' },
+{ scheme: 'file', language: 'html' },
 { scheme: 'file', language: 'jade' },
 { scheme: 'file', language: 'java' },
 { scheme: 'file', language: 'javascript' },

DevSkim-VSCode-Plugin/package.json

@@ -50,6 +50,7 @@
 		"onLanguage:sql",
 		"onLanguage:rust",
 		"onLanguage:groovy",
+		"onLanguage:html",
 		"onLanguage:typescript",
 		"onLanguage:typescriptreact",
 		"onLanguage:jade",