Prevent setting HTML directly from the JS

app/assets/javascripts/protected_branch_dropdown.js.es6

@@ -66,8 +66,8 @@ class ProtectedBranchDropdown {
 
     if (branchName) {
       this.$dropdownContainer
-        .find('.create-new-protected-branch')
-        .html(`Create wildcard <code>${branchName}</code>`);
+        .find('.create-new-protected-branch code')
+        .text(branchName);
     }
 
     this.$dropdownFooter.toggleClass('hidden', !branchName);

app/views/projects/protected_branches/_dropdown.html.haml

@@ -11,4 +11,5 @@
   %ul.dropdown-footer-list
     %li
       = link_to '#', title: "New Protected Branch", class: "create-new-protected-branch" do
-        Create new
+        Create wildcard
+        %code