From a58c5f1bd9aeda6b38df9d396e70b4cea049f268 Mon Sep 17 00:00:00 2001 From: FumingPower3925 Date: Wed, 1 Jul 2026 16:52:08 +0200 Subject: [PATCH 1/2] Bump the bundled Scalar UI to 1.62.1 (#111) Scalar @scalar/api-reference 1.61.0 -> 1.62.1 across the CDN pin, the embedded bundle, and the package.json tracker. The 1.62.x line adds UI localization (seven languages + RTL) and schema-rendering fixes (JSON Schema 2020-12 $dynamicRef, discriminator-only variants, an allOf self-reference crash); the data-configuration and CSP contracts stdocs relies on are unchanged. Supersedes #110. The bundle was verified byte-identical across the npm tarball and jsDelivr, its sha512 matches the published dist integrity, it carries SLSA build provenance from github.com/scalar/scalar, and the external-host set is unchanged bar two passive localization strings. --- CHANGELOG.md | 12 +- package.json | 2 +- ui/scalar/scalar.go | 6 +- ui/scalar/scalar_pinning_test.go | 4 +- ui/scalaremb/assets/standalone.js | 586 ++++++++++++------------- ui/scalaremb/scalaremb.go | 6 +- ui/scalaremb/scalaremb_pinning_test.go | 4 +- 7 files changed, 315 insertions(+), 305 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4aa5646..95fe698 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/). ## [Unreleased] -Nothing yet. +### Changed + +- Bumped the bundled Scalar UI (`@scalar/api-reference`) from 1.61.0 to + 1.62.1 — across the CDN pin, the embedded bundle, and the + `package.json` tracker. The 1.62.x line adds UI localization (seven + languages plus RTL) and schema-rendering fixes (JSON Schema 2020-12 + `$dynamicRef`, discriminator-only variants, and an `allOf` + self-reference crash), and preserves the configuration and CSP + contracts stdocs relies on. The CDN SRI hash and the vendored bytes + are re-pinned to the 1.62.1 bundle, verified byte-identical across the + npm tarball and jsDelivr. ## [0.8.0] - 2026-07-01 diff --git a/package.json b/package.json index b2039eb..d2d7125 100644 --- a/package.json +++ b/package.json @@ -4,7 +4,7 @@ "private": true, "description": "Dev-only manifest. Used by Dependabot to track upstream versions of the docs UI bundles and the typescript release CI type-checks tsgen output against; the Go source in ui/*/*.go is the source of truth for the bundle versions that ship. Do not 'npm install' — the runtime does not import any npm package.", "devDependencies": { - "@scalar/api-reference": "1.61.0", + "@scalar/api-reference": "1.62.1", "@stoplight/elements": "9.0.23", "redoc": "2.5.3", "swagger-ui-dist": "5.32.8", diff --git a/ui/scalar/scalar.go b/ui/scalar/scalar.go index 95b3c34..cafa78c 100644 --- a/ui/scalar/scalar.go +++ b/ui/scalar/scalar.go @@ -17,7 +17,7 @@ // Scalar JavaScript and CSS are loaded from cdn.jsdelivr.net at page // load time, so an internet connection is required. // -// The CDN URL is pinned to a specific version (1.61.0) and points at +// The CDN URL is pinned to a specific version (1.62.1) and points at // the verbatim dist/browser/standalone.js file from the npm package, // so its bytes are deterministic and the sha384 SRI hash below is // pinned in the