Converting a value when you put it into a page, so the browser reads it as text. The right conversion depends on where it lands: inside a tag, in an attribute, or in a link are three different problems.
Escaping HTML does nothing for a link. javascript:alert(1) has no angle brackets to escape, and clicking it runs the code. This is exactly the kind of gap the code passes tests with.
Say it to your agent
“This value goes in an href, so escaping HTML isn't enough. Parse it with new URL, allow only https: and mailto:, and add a test with a control character before javascript: to prove a hand-written scheme check isn't what's protecting us.”