Releases

• #10728: Add per-document authentication overrides merged with global defaults and an optional security scheme allowlist for the authentication UI.

• #10729: Add a request body reset action that restores the original example, falling back to schema-generated values, without refreshing the page.

  Expose ObjectDoc.documentSource as the base URI for resolving relative references in object documents. Add translation keys for restoring a body and creating an example from its schema.

  Resolved request body baselines are included in workspace exports but are not persisted in IndexedDB. After an IndexedDB reload or loading an older export, the first reset reconstructs the baseline from the original document, which may refetch external references and does not reapply configured overrides.

• #10852: Show API responses for any HTTP status the server returns, including codes outside 200–599. Preserve network response statuses instead of passing them to the restricted Response constructor. Keep streaming completion snapshots bodyless and cloneable so history does not consume or buffer the live stream.
• #10732: Keep Paths extensions out of request-body snapshots, resets, default routing, and path parameter synchronization. Hide unselected Paths and Path Item extension sections in the classic layout.
• #10735: Reduce embedded hydration state, recover from damaged state, and preserve the client button during server rendering.

• #10728: Add per-document authentication overrides merged with global defaults and an optional security scheme allowlist for the authentication UI.
• #10732: Render Paths Object and Path Item extensions alongside operation extensions within each operation in both layouts. Preserve arbitrary Paths Object extension values during browser loading and server preprocessing, and exclude them from operation navigation and tag/auth edits.
• #10662: Supply the plugin-aware specification extension renderer by default in API reference components while preserving custom renderer overrides. Export scrollTargetId from the helpers entry point for custom layouts.
• #10733: Render configured and plugin extensions on AsyncAPI channels, operations, messages, servers, and replies.

• #10841: Fix the "Auth Required" badge panel briefly overflowing the viewport on hover by mounting the floating panel together with its content, so Floating UI positions it at its real width on first render.
• #10755: fix: add space below section dividers and between the last untagged operation and the next section in the classic layout
• #10733: Align AsyncAPI message and server extensions with their surrounding content and reduce excess spacing.
• #10734: Select an available server when a live API description update removes the previously selected server URL.
• #10805: fix: keep the page on the newest navigation target while an earlier target is still rendering
• #10771: Wrap operation titles without spaces, such as webhook names, on narrow screens instead of pushing the page wider than the viewport.
• #10732: Keep Paths extensions out of request-body snapshots, resets, default routing, and path parameter synchronization. Hide unselected Paths and Path Item extension sections in the classic layout.
• #10735: Preserve server-rendered API content during hydration by restoring the preloaded document state before the first browser render.
• #10869: Revert selected API description uploads in full mode until the backend supports them with agent-key authorization. Full mode uses the agent key's registered documents again.
• #10818: Open search much faster for API descriptions whose models reference each other by expanding each schema only once while building the search index. Preserve property descriptions through shared reference aliases and stop reading wide compositions at the traversal budget.
• #10820: Keep search responsive for API descriptions whose models reference each other by indexing schema fields up to 6 edges deep instead of 64. Fields nested more deeply no longer match their operations in search.
• #10819: Open search faster by reading each schema once per search index build, however many operations reference it.
• #10735: Reduce embedded hydration state, recover from damaged state, and preserve the client button during server rendering.
• #10771: Place request actions below the method and path in narrow fallback cards, keeping button labels readable without clipping.
• #10845: Prevent custom CSS and themes from closing style elements in generated HTML.

• #10862: Show post-response scripts, the agent and request history the response headers the API sent, instead of the values the Scalar proxy sets to protect its origin.

• #10865: Show empty response headers under their own name, instead of the internal X-Scalar-Original-* name the Scalar proxy uses.
• #10845: Prevent custom CSS and themes from closing style elements in generated HTML.

• #10619: Add bundleWithDiagnostics to report reference failures with authored source locations, retain incomplete output, and defer pruning until resolution succeeds. Add opt-in document-aware traversal for OpenAPI, AsyncAPI, and JSON Schema, including literal data boundaries and applicable reference siblings. Preserve cached sources across diagnostic bundle calls.

  Use consistent URI fragment decoding across bundling and the magic proxy, and index newly exposed document fragments without revisiting unrelated subtrees.

• #10786: Resolve $ref pointers with percent-encoded reserved characters, so #/paths/~1items%23list now points at the /items#list path instead of resolving to nothing. Preserve literal property names when resolving schema IDs and anchors, including keys containing /, ~, or percent sequences.

• #10809: feat: add an onResponse hook to observe or replace the response for each request

• #10808: fix: match concrete paths before templated ones, so /pets/mine is answered by its own operation even when the document declares /pets/{petId} first
• #10810: fix: leave an object document passed to createMockServer unchanged instead of bundling it in place
• #10812: fix(mock-server): include deprecated schemas in XML responses, so a response whose schema is deprecated no longer comes back with an empty XML body

• #10728: Add per-document authentication overrides merged with global defaults and an optional security scheme allowlist for the authentication UI.

• #10732: Render Paths Object and Path Item extensions alongside operation extensions within each operation in both layouts. Preserve arbitrary Paths Object extension values during browser loading and server preprocessing, and exclude them from operation navigation and tag/auth edits.

• #10777: fix: allow x-order and x-scalar-ignore on OAuth2 flows in the authentication.securitySchemes configuration, so reordering or hiding flow tabs no longer causes a TypeScript error

• #10729: Add a request body reset action that restores the original example, falling back to schema-generated values, without refreshing the page.

  Expose ObjectDoc.documentSource as the base URI for resolving relative references in object documents. Add translation keys for restoring a body and creating an example from its schema.

  Resolved request body baselines are included in workspace exports but are not persisted in IndexedDB. After an IndexedDB reload or loading an older export, the first reset reconstructs the baseline from the original document, which may refetch external references and does not reapply configured overrides.

• #10729: Add a request body reset action that restores the original example, falling back to schema-generated values, without refreshing the page.

  Expose ObjectDoc.documentSource as the base URI for resolving relative references in object documents. Add translation keys for restoring a body and creating an example from its schema.

  Resolved request body baselines are included in workspace exports but are not persisted in IndexedDB. After an IndexedDB reload or loading an older export, the first reset reconstructs the baseline from the original document, which may refetch external references and does not reapply configured overrides.

• #10730: Generate valid examples for known string formats in request bodies, including dates, times, durations, addresses, URIs, pointers, regular expressions, and version-specific UUIDs. Preserve existing password, binary, and unknown-format fallbacks.

  Also generate formatted query and header values in code samples and querystring parameters. Versioned UUID formats (uuid1–uuid8) now use matching version bits instead of the generic UUID, including in mock-server and response examples. Generate date/time values at request time so reused schemas stay current in long-lived tabs.

• #10732: Render Paths Object and Path Item extensions alongside operation extensions within each operation in both layouts. Preserve arbitrary Paths Object extension values during browser loading and server preprocessing, and exclude them from operation navigation and tag/auth edits.

• #10862: Show post-response scripts, the agent and request history the response headers the API sent, instead of the values the Scalar proxy sets to protect its origin.

• #10732: Keep Paths extensions out of request-body snapshots, resets, default routing, and path parameter synchronization. Hide unselected Paths and Path Item extension sections in the classic layout.

• #10787: Resolve a relative document URL against the page before bundling, so external references in that document are fetched instead of being resolved to a root path that no loader handles.

• #10804: perf: build with the TypeScript 7 native compiler

• #10812: Keep deprecated schemas and properties in generated JSON and XML examples by default. Remove the includeDeprecated option; deprecation no longer filters example values. Read/write and optional-property filtering still apply.

• #10837: Set the text/html content type before sending the API reference, so the page renders with @nestjs/platform-node, whose send() treats strings as plain text.

• #10846: Explicitly type the Nuxt module export so dependency checks can trace its schema dependency before building.

• #10862: Show post-response scripts, the agent and request history the response headers the API sent, instead of the values the Scalar proxy sets to protect its origin.
• #10869: Revert selected API description uploads in full mode until the backend supports them with agent-key authorization. Full mode uses the agent key's registered documents again.

• #10733: Align AsyncAPI message and server extensions with their surrounding content and reduce excess spacing.
• #10814: fix(blocks): keep explicit badge colors above themed utility defaults
• #10771: Place request actions below the method and path in narrow fallback cards, keeping button labels readable without clipping.
• #10812: Keep deprecated schemas and properties in generated JSON and XML examples by default. Remove the includeDeprecated option; deprecation no longer filters example values. Read/write and optional-property filtering still apply.

• #10845: Prevent custom CSS and themes from closing style elements in generated HTML.

• #10742: Restore the 1.4 default for highlighted code block containers after the highlighter migration, including plain text and blank lines, while allowing Markdown to retain its own spacing.
• #10849: Make code block containers own line spacing so highlighted text, plain text, blank lines, and line numbers use the same height. ScalarCodeBlock defaults to 1.4 and Markdown fenced code defaults to 1.5; override either with --scalar-code-line-height on the component or an ancestor. The shared highlighting stylesheet preserves the 1.4 default for direct consumers with a zero-specificity container rule, so existing container overrides still take precedence.

• #10735: Cancel the pending selected-option scroll when a combobox is unmounted.
• #10843: Prevent opening or navigating combobox options from scrolling the surrounding page before the picker is positioned.
• #10849: Make code block containers own line spacing so highlighted text, plain text, blank lines, and line numbers use the same height. ScalarCodeBlock defaults to 1.4 and Markdown fenced code defaults to 1.5; override either with --scalar-code-line-height on the component or an ancestor. The shared highlighting stylesheet preserves the 1.4 default for direct consumers with a zero-specificity container rule, so existing container overrides still take precedence.

• #10792: Reuse the JSON/YAML normalizer from @scalar/json-magic so JSON documents with a leading UTF-8 BOM parse correctly. Malformed JSON arrays no longer fall back to YAML parsing.

  The exported normalize function now uses the shared signature (content: unknown) => unknown; callers must narrow the parsed result before accessing its properties.

• #10862: Show post-response scripts, the agent and request history the response headers the API sent, instead of the values the Scalar proxy sets to protect its origin.

• #10845: Prevent custom CSS and themes from closing style elements in generated HTML.

• #10823: Send cookies with the Cookie request header in Node fetch, ofetch, and undici snippets, merge existing cookie headers in Node and axios snippets, and use the browser cookie store in JavaScript fetch, ofetch, and axios snippets.

  Preserve both explicit Cookie headers and structured cookies across the other HTTP header-based generators, including curl, wget, Ruby, Go, Swift, Objective-C, Rust, Dart, Clojure, R, Kotlin, C#, PHP cURL, Python http.client, and C libcurl. Include structured cookies in raw HTTP examples.

  Explain cookie header entries without = in browser snippets instead of silently dropping them.

• #10838: Generate valid Python literals for boolean JSON request bodies in Requests, HTTPX, and aiohttp snippets.

• #10838: Preserve root JSON scalars in browser Fetch, Node Fetch, Undici, clj-http, and Objective-C NSURLSession code examples instead of converting booleans to objects, omitting false bodies, or rejecting JSON fragments.

• #10824: Maintain the CSS color picker locally and declare its Lezer dependency so imports work with strict package-manager layouts.
• #10734: Refresh color swatches when background parsing updates the syntax tree.

• @scalar/api-reference@1.77.0

• #10728: Add per-document authentication overrides merged with global defaults and an optional security scheme allowlist for the authentication UI.

• @scalar/api-reference@1.77.0

• #10728: Add per-document authentication overrides merged with global defaults and an optional security scheme allowlist for the authentication UI.

• @scalar/api-reference@1.77.0

• #10728: Add per-document authentication overrides merged with global defaults and an optional security scheme allowlist for the authentication UI.

• @scalar/api-reference@1.77.0

• #10728: Add per-document authentication overrides merged with global defaults and an optional security scheme allowlist for the authentication UI.

• #10728: Add per-document authentication overrides merged with global defaults and an optional security scheme allowlist for the authentication UI.

• @scalar/api-reference@1.77.0

• #10825: Expose additional UI, code sample, OAuth redirect, and service URL configuration in the Java integrations.

• #10825: Support inline API descriptions, document titles and slugs, and grouped authentication preferences in the Java integrations.

  Escape HTML page titles and preserve configured source URLs while applying inline-content precedence during rendering.

• #10821: Add Spring Boot localization options for locale, text direction, and custom UI translations in WebMVC and WebFlux.

• #10827: Support path-based API Reference navigation and deep-link reloads in Spring WebMVC and WebFlux.

• #10811: feat(mock-server): allow disabling request validation in the Docker image with the --no-validate-request flag or the VALIDATE_REQUEST=false environment variable, so requests that violate the API description get a mock response instead of a 422

• @scalar/api-reference@1.77.0

• @scalar/api-reference@1.77.0

• Clearing formatting on a nested list now turns every level into paragraphs, and clearNodes() works in a chain with other node commands.
• Stop removed resizable node views from responding to later editor updates.

• Bubble menus now update correctly after IME input, including Korean text

• Fixed a performance issue where code highlighting updates were unnecessarily triggered by selection-only changes

• Floating menus now update correctly after IME input, including Korean text

• Pasting a link without a protocol now uses the defaultProtocol option instead of always falling back to http.

• The Placeholder extension no longer leaves placeholders behind on empty nodes after the cursor moves away when includeChildren is enabled.

• Fix a React warning when a command like setContent creates React node views from inside an effect.
• Fixed the cursor no longer following clicks after an editor inside a shadow root was unmounted and remounted.

• Fixed the cursor no longer following clicks after an editor inside a shadow root was unmounted and remounted.

• Fixed the cursor no longer following clicks after an editor inside a shadow root was unmounted and remounted.

• Remove persistent position migrations to stop structural edits and undo or redo from adding migration history to collaborative documents. Saved relative positions no longer follow content that structural edits replace or move.

  Existing migration entries are deleted when an editor opens and when later Yjs updates arrive. Yjs can reclaim their stored data when garbage collection is enabled. Document content and other shared data are unchanged. Upgrade all collaborating clients to stop older clients from writing new entries.

  Documents that the server refuses to load need cleanup on the server before a client can repair them. With Yjs garbage collection disabled, deleting entries does not reclaim their stored data.

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Release 2026-11-05 08:08

• {query,react-query,preact-query}-devtools: always render the devtools left-to-right regardless of the page direction or browser language (#12528) (c4ed956bb) by @sukvvon
• solid-query-devtools: replace 'clientOnly' with a 'process.env.NODE_ENV' gate to fix hydration mismatch (#12524) (f078a2b2c) by @sukvvon

• @tanstack/angular-query-experimental@5.106.1
• @tanstack/eslint-plugin-query@5.106.1
• @tanstack/lit-query@0.2.36
• @tanstack/preact-query@5.106.1
• @tanstack/preact-query-devtools@5.106.1
• @tanstack/preact-query-persist-client@5.106.1
• @tanstack/query-async-storage-persister@5.106.1
• @tanstack/query-broadcast-client-experimental@5.106.1
• @tanstack/query-core@5.106.1
• @tanstack/query-devtools@5.106.1
• @tanstack/query-persist-client-core@5.106.1
• @tanstack/query-sync-storage-persister@5.106.1
• @tanstack/react-query@5.106.1
• @tanstack/react-query-devtools@5.106.1
• @tanstack/react-query-next-experimental@5.106.1
• @tanstack/react-query-persist-client@5.106.1
• @tanstack/solid-query@5.106.1
• @tanstack/solid-query-devtools@5.106.1
• @tanstack/solid-query-persist-client@5.106.1
• @tanstack/svelte-query@6.3.11
• @tanstack/svelte-query-devtools@6.3.11
• @tanstack/svelte-query-persist-client@6.3.11
• @tanstack/vue-query@5.106.1
• @tanstack/vue-query-devtools@6.3.11

Release 2026-11-05 08:08

• {query,react-query,preact-query}-devtools: always render the devtools left-to-right regardless of the page direction or browser language (#12528) (c4ed956bb) by @sukvvon
• solid-query-devtools: replace 'clientOnly' with a 'process.env.NODE_ENV' gate to fix hydration mismatch (#12524) (f078a2b2c) by @sukvvon

• @tanstack/angular-query-experimental@5.106.1
• @tanstack/eslint-plugin-query@5.106.1
• @tanstack/lit-query@0.2.36
• @tanstack/preact-query@5.106.1
• @tanstack/preact-query-devtools@5.106.1
• @tanstack/preact-query-persist-client@5.106.1
• @tanstack/query-async-storage-persister@5.106.1
• @tanstack/query-broadcast-client-experimental@5.106.1
• @tanstack/query-core@5.106.1
• @tanstack/query-devtools@5.106.1
• @tanstack/query-persist-client-core@5.106.1
• @tanstack/query-sync-storage-persister@5.106.1
• @tanstack/react-query@5.106.1
• @tanstack/react-query-devtools@5.106.1
• @tanstack/react-query-next-experimental@5.106.1
• @tanstack/react-query-persist-client@5.106.1
• @tanstack/solid-query@5.106.1
• @tanstack/solid-query-devtools@5.106.1
• @tanstack/solid-query-persist-client@5.106.1
• @tanstack/svelte-query@6.3.11
• @tanstack/svelte-query-devtools@6.3.11
• @tanstack/svelte-query-persist-client@6.3.11
• @tanstack/vue-query@5.106.1
• @tanstack/vue-query-devtools@6.3.11

• WebGPU: find cached texture views without building a key string - by enriqxxx (#19091)

• Add Inspector Lite physics inspection - by ryantrem (#19079)

• Updated dependencies [c4ed956]:
  • @tanstack/query-devtools@5.106.1
  • @tanstack/vue-query@5.106.1