Since TestOps version 26.3.1.1 I see that html attachments are displayed as html-unsafe, why is that?

Not from your side, and there is nothing wrong with your project. On the cloud the attachment rendering policy is part of the platform configuration, and it is applied to every instance.

What the marker means. TestOps does not render an HTML attachment in the browser. Instead, the content type is reported with an -unsafe suffix, the viewer offers a download rather than a preview, and the file is served as a download. Your attachment is stored exactly as it was uploaded and can be downloaded at any time. Nothing is removed, modified, or lost.

Why the policy exists. An HTML attachment rendered inside the application runs with the session of whoever opens the test result. Anything able to upload results could therefore attach a file that acts on behalf of a signed-in user of your workspace. On a shared platform that risk is not acceptable, so attachments of this kind are always delivered as downloads.

The same applies to [CONFIRM: перечислить, что реально в списке, например image/svg+xml]. Other formats are unaffected.

What you can do instead. If you want the report visible without an extra download step, attach it in a format that TestOps renders inline:

• plain text or Markdown for textual reports, which are shown directly in the result;
• images for screenshots and charts;

If your pipeline currently produces a single HTML report, publishing it to your own storage and attaching the link is usually the smallest change and gives you the full report with no download at all.

If you noticed this only recently. The policy itself is not new, but until version 26.3.1 it was applied inconsistently: attachments placed inside scenario steps were not checked, so some of them still rendered. From 26.3.1 onwards the same rule applies to every attachment, which is why files that used to open in place are now offered as downloads.