Bump the bundled UI versions (Scalar 1.62.6, Stoplight 9.0.24) - #115
Merged
Conversation
Scalar @scalar/api-reference 1.62.5 -> 1.62.6 across the CDN pin, the embedded bundle, and the package.json tracker; the patch adds AsyncAPI document-wide auth rendering and a plugin auth-accessor fix, and the data-configuration and CSP contracts are unchanged. Stoplight @stoplight/elements 9.0.23 -> 9.0.24: both vendored assets are byte-identical to 9.0.23, so only the pinned version moved and the SRI hashes stay as they were. The CI type-check pin moves typescript 6.0.3 -> 7.0.2 (a major). It is dev-only tooling — CI npx-installs just tsc to type-check the tsgen golden — and the generated TypeScript still passes tsc 7.0.2 --strict, with a deliberate type error confirmed to still fail the gate. Supersedes #114. Both bundles were verified byte-identical across the npm tarball and jsDelivr, their sha512s match the published dist integrity, Scalar carries SLSA build provenance from github.com/scalar/scalar, and the external-host sets are unchanged. Note: @stoplight/elements 9.0.24 adds an @scarf/scarf dependency (npm install-time analytics). It cannot reach stdocs: the vendored bytes do not contain it, there is no lockfile, and nothing here ever runs npm install — CI only npx-installs typescript by name.
FumingPower3925
added a commit
that referenced
this pull request
Jul 15, 2026
Scalar @scalar/api-reference 1.62.5 -> 1.62.6 across the CDN pin, the embedded bundle, and the package.json tracker; the patch adds AsyncAPI document-wide auth rendering and a plugin auth-accessor fix, and the data-configuration and CSP contracts are unchanged. Stoplight @stoplight/elements 9.0.23 -> 9.0.24: both vendored assets are byte-identical to 9.0.23, so only the pinned version moved and the SRI hashes stay as they were. The CI type-check pin moves typescript 6.0.3 -> 7.0.2 (a major). It is dev-only tooling — CI npx-installs just tsc to type-check the tsgen golden — and the generated TypeScript still passes tsc 7.0.2 --strict, with a deliberate type error confirmed to still fail the gate. Supersedes #114. Both bundles were verified byte-identical across the npm tarball and jsDelivr, their sha512s match the published dist integrity, Scalar carries SLSA build provenance from github.com/scalar/scalar, and the external-host sets are unchanged. Note: @stoplight/elements 9.0.24 adds an @scarf/scarf dependency (npm install-time analytics). It cannot reach stdocs: the vendored bytes do not contain it, there is no lockfile, and nothing here ever runs npm install — CI only npx-installs typescript by name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #114 (the Dependabot
all-ui-bundlesgroup PR, which only editspackage.json).Three updates, each verified independently:
@scalar/api-reference@stoplight/elementstypescriptSupply-chain verification
slsa.dev/provenance/v1) attesting a build fromgithub.com/scalar/scalarvia.github/workflows/main.yml. Tarball sha512 matches the publisheddist.integrity; jsDelivr is byte-identical to the tarball; SRI recomputed from those bytes (sha384-N7JUv0+…). External-host set identical to 1.62.5 (49 hosts); active-network surface unchanged (fetch("http/sendBeacon/analytics = 0;.track(/telemetrycounts identical — pre-existing Vue reactivity + a config toggle, fenced byconnect-src 'self').data-url/data-configurationauto-mount intact.7.0.2being the first stable 7.0 is TypeScript's normal convention (betas/RCs at.0-beta/.1-rc; stable starts at.2), confirmed by dist-tags (rc: 7.0.1-rc,latest: 7.0.2).One finding worth recording
@stoplight/elements@9.0.24adds a@scarf/scarfdependency — npm install-time analytics (postinstall: node ./report.js). It cannot reach stdocs: the vendored bytes contain zero references to it (they're byte-identical to pre-scarf 9.0.23), there is no lockfile, and nothing in this repo ever runsnpm install— CI onlynpx-installstypescriptby name. stdocs consumers get Go code plus vendored assets and never touch npm.Verification
gofmt/vet/build/go test -race ./.../golangci-lintclean; all four Scalar/Stoplight pinning, embedded-integrity, andpackage.jsonparity tests pass.tsc 7.0.2 --strict --noEmit(exit 0), and a deliberately injected type error still fails it (exit 1,TS2322) — so the gate is real, not vacuous.uismokerenders all nine UIs under the enforced CSP (plus all eight config variants): both bumped bundles mount, CSP-safe defaults still hide the phone-home chrome,WithConfigurationstill works. Scalar 1.62.6 screenshotted for visual fidelity.