roots/roots — pull request #1066 by kalenjohnson (2014-06-26 20:55:29+00:00)
Title: Escaping home_url

Apparently this is important, according to WP VIP. It's also how underscores does it: https://github.com/Automattic/_s/blob/master/header.php#L27

Most WP functions escape user input, but I guess not this one.