From 4bded76754066028c539858410924ad1e7b4d716 Mon Sep 17 00:00:00 2001 From: FumingPower3925 Date: Wed, 8 Jul 2026 16:27:43 +0200 Subject: [PATCH 1/2] Bump the bundled Scalar UI to 1.62.5 (#113) Scalar @scalar/api-reference 1.62.1 -> 1.62.5 across the CDN pin, the embedded bundle, and the package.json tracker. The 1.62.2-1.62.5 patches are rendering/behavior fixes (response-property deep links, an allOf + oneOf/anyOf property-merge fix, AsyncAPI layout tweaks); the data-configuration and CSP contracts stdocs relies on are unchanged. Supersedes #112. The bundle was verified byte-identical across the npm tarball and jsDelivr, its sha512 matches the published dist integrity, it carries SLSA build provenance from github.com/scalar/scalar, and the external-host set is unchanged from 1.62.1. --- CHANGELOG.md | 11 +- package.json | 2 +- ui/scalar/scalar.go | 6 +- ui/scalar/scalar_pinning_test.go | 4 +- ui/scalaremb/assets/standalone.js | 388 ++++++++++++------------- ui/scalaremb/scalaremb.go | 6 +- ui/scalaremb/scalaremb_pinning_test.go | 4 +- 7 files changed, 215 insertions(+), 206 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f7c195d..7c69cf8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/). ## [Unreleased] -Nothing yet. +### Changed + +- Bumped the bundled Scalar UI (`@scalar/api-reference`) from 1.62.1 to + 1.62.5 — across the CDN pin, the embedded bundle, and the + `package.json` tracker. The 1.62.2–1.62.5 patches are rendering and + behavior fixes (deep links to response properties, an `allOf` + + `oneOf`/`anyOf` property-merge fix, AsyncAPI layout tweaks) and + preserve the configuration and CSP contracts stdocs relies on. The + CDN SRI hash and the vendored bytes are re-pinned to the 1.62.5 + bundle, verified byte-identical across the npm tarball and jsDelivr. ## [0.8.1] - 2026-07-01 diff --git a/package.json b/package.json index d2d7125..37fb805 100644 --- a/package.json +++ b/package.json @@ -4,7 +4,7 @@ "private": true, "description": "Dev-only manifest. Used by Dependabot to track upstream versions of the docs UI bundles and the typescript release CI type-checks tsgen output against; the Go source in ui/*/*.go is the source of truth for the bundle versions that ship. Do not 'npm install' — the runtime does not import any npm package.", "devDependencies": { - "@scalar/api-reference": "1.62.1", + "@scalar/api-reference": "1.62.5", "@stoplight/elements": "9.0.23", "redoc": "2.5.3", "swagger-ui-dist": "5.32.8", diff --git a/ui/scalar/scalar.go b/ui/scalar/scalar.go index cafa78c..2614287 100644 --- a/ui/scalar/scalar.go +++ b/ui/scalar/scalar.go @@ -17,7 +17,7 @@ // Scalar JavaScript and CSS are loaded from cdn.jsdelivr.net at page // load time, so an internet connection is required. // -// The CDN URL is pinned to a specific version (1.62.1) and points at +// The CDN URL is pinned to a specific version (1.62.5) and points at // the verbatim dist/browser/standalone.js file from the npm package, // so its bytes are deterministic and the sha384 SRI hash below is // pinned in the