NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Types to work with Scalar packages
Last release 2 days ago
12 Oct 2026
Ships on a steady schedule
a new release about every 2 weeks
Nearly every release is documented
notes for 54 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
2 years old
142 releases · first in 2024
One column per month.
### Patch Changes - #10554: Render AsyncAPI boolean schemas with explanations in message payloads, headers, and reusable models. - #10565: Inherit Asy
mcp.disabled keep their current footer. Adds exploreScalar translations to ApiReferenceTranslations and a startViewTransition helper to @scalar/helpers/dom.zh-TW, including case and underscore variants, across API Reference, API Client, and schema blocks.### Patch Changes - #10483: Add a request body schema view to the API Client so users can inspect all writable fields alongside custom examples withou
### Minor Changes - #10473: Add featuredClients to choose which clients are shown as tabs in the "Client Libraries" block, and in which order. - #1044
featuredClients to choose which clients are shown as tabs in the "Client Libraries" block, and in which order.hideModelNames to show structural types instead of model names in schema type labels and operation headings.maxVisibleRequestBodyProperties to control the initial request body property limit (default 12, or 0 for unlimited) independently of nested schema expansion. Show the number of hidden properties in the overflow control.The code block scroller is exposed as a named group ("Code sample: Shell cURL" in the API Reference, localizable via operation.codeSample) so screen r
operation.codeSample) so screen readers announce it when it receives focus### Patch Changes - #10402: Keep failed requests visible in the response panel and explain possible CORS or network causes for browser fetch failures.
Corrects programmatic semantics only, with no change to how anything renders: the current sidebar item now reports aria-current, the single content ty
#10369: fix: address a batch of screen reader and keyboard accessibility findings
Corrects programmatic semantics only, with no change to how anything renders:
the current sidebar item now reports aria-current, the single content type
readout leaves the tab order, collapsible sections no longer announce their
title twice, the password toggle reports its state through aria-pressed, the
two document download buttons get distinct accessible names, response status
tabs announce what each code means, and the client picker and its search field
get accessible names.
Generate XML examples from schema metadata, preserving attributes, namespaces, array wrappers, repeated elements, and OpenAPI 3.2 text and CDATA nodes
#10192: Mock-server XML response bytes now use the shared schema-aware serializer instead of json2xml, including attributes, namespaces, and root naming. Existing XML response snapshots may need updating. Supplied serialized XML remains unchanged.
Generate XML examples from schema metadata, preserving attributes, namespaces, array wrappers, repeated elements, and OpenAPI 3.2 text and CDATA nodes. Use the same XML serialization for request bodies, code snippets, response examples, mock responses, and Markdown documentation. Preserve serialized media examples and escape schema string examples as element text.
Explain XML generation failures in response example panels, including the serialized-example escape hatch for large payloads. Expose XML generation failures in mock response headers with X-Scalar-XML-Error, containing the first error diagnostic code. Report diagnostics to other consumers through a callback or the developer console, and format element-only descendants within mixed content without changing text values.
#10335: Clarify operation authentication tooltips with separate headings, readable scheme types, API key locations and names, and formatted descriptions.
### Minor Changes - #10310: Connect SDK code samples to named request body examples using optional example and contentType fields. Keep the example sw
Use consistent form-encoded Basic credentials and environment substitution across OAuth token and refresh flows. Allow HTTP metadata and verification
#10191: Support OpenAPI 3.2 OAuth device authorization with verification codes, cancellable token polling, stored credentials, and OAuth metadata discovery. Add mock device authorization and approval endpoints with pending, denial, expiry, and polling backoff responses.
Use consistent form-encoded Basic credentials and environment substitution across OAuth token and refresh flows. Allow HTTP metadata and verification links on local development hosts and reserved test domains, coerce discovery fields consistently, and report device-code expiry clearly.
#10283: Add expandAllParameters, defaulting to true. Set it to false to start operation parameters collapsed and expand each parameter on click.
#10178: Support OpenAPI 3.2 streaming item schemas in the workspace store, request body examples, and API reference schema views. Frame generated and structured examples as JSON Lines, JSON Sequence, or server-sent events while preserving explicit wire-format strings.
Preserve generated falsy request examples (0, false, and empty strings) for non-streaming bodies as well.
Use cURL --data-binary for supported streaming media types, making framed body handling explicit. Authored arrays and objects are framed as stream records; authored wire-format strings remain unchanged. SSE records with no valid fields are safely omitted with one console warning per serialization call reporting the omitted count, including when all records are omitted.
localization.translations.apiClient, including the client embedded in API Reference. Ship client translations for English, Russian, Spanish, French, German, Simplified Chinese, Arabic, and Portuguese to match API Reference. Preserve English fallbacks across package providers and react to locale, direction, and translation updates.Preserve sibling keywords when merging nested allOf properties. Display an explanation when enum constraints allow no values, and omit empty enum anno
#10232: Intersect enum values when merging allOf schemas so inherited properties show only allowed values.
Preserve sibling keywords when merging nested allOf properties. Display an explanation when enum constraints allow no values, and omit empty enum annotations.
ScreenReader moves off the deprecated clip property to clip-path and adds white-space: nowrap, so multi-word announcements are no longer split at wrap…
#9675: feat: move schema-vocabulary translation keys from common.* into schema.* and drive localization through the new shared @scalar/localization engine.
If you customize localization.translations, schema-related keys have moved namespace — for example common.nullable is now schema.nullable and common.required is now schema.required. Only description, httpMethod, and path remain under common.
#10126: refactor(api-reference): remove the legacy schema layout and the schemaLayout option
The legacy schema layout — a bordered card per nesting level behind a "Show Child Attributes" pill — is deleted, together with the schemaLayout configuration option that selected it. The tree layout is the only schema renderer.
The schemaLayout option never shipped in a release, so there is no schemaLayout value to remove from your configuration. Five translation keys the deleted markup owned are removed from ApiReferenceTranslations, and therefore from the ApiReferenceTranslationKey union: schema.childAttributes, schema.hideChildAttributes, schema.showChildAttributes, operation.hideHeaders and operation.showHeaders. They labelled the "Show Child Attributes" pill and the headers disclosure toggle, neither of which renders any more. If you override any of them in localization.translations, delete those entries — TypeScript will otherwise report an unknown-property error on the object literal.
The class names the tree already carried (.schema-card, .property, .property--level-N and their family) are unchanged, so customCss keeps working.
#10074: feat(api-reference)!: the tree layout is the schema renderer
The tree layout is the schema renderer, so every visual baseline that renders a schema changes with this release and is regenerated per suite.
#10074: feat(api-reference): the tree schema layout
The tree layout replaces the bordered card per nesting level and the "Show Child Attributes" pill with the visual grammar of a tree: a continuous rail per depth that hangs from the parent property's text column, and a discrete disclosure control in each expandable property's own gutter. The control is a real button whose accessible name is the property name alone and whose child count rides aria-describedby; property descriptions stay visible instead of being swallowed into a button label. Types render as token runs — array of Planet instead of array Planet[], with a $ref link as the type itself — collapsed objects show a preview of what they hold, short enums render inline in the type position or wrap as chips instead of a row per value, and a $ref cycle says recursive in its own signature line instead of offering a toggle that descends forever. Rails fade with depth, capped so the deepest ones never wash out into the page. In a narrow container — the same max-width: 900px query the sections already use — the indent tightens and the controls shrink, so a deep tree still fits and the outermost control clears the page edge instead of being clipped by it. Collapsed subtrees that were opened once stay reachable with find-in-page via hidden="until-found" where the engine supports it, against a budget shared by every tree in the reference, with Safari falling back to unmounting exactly as before.
Printing temporarily expands the whole tree and restores the reader's expansion state afterwards.
#10074: feat(api-reference): one disclosure grammar across every surface in the tree layout
The tree layout now reaches the surfaces the schema renderer never covered. Response headers fold into the tree as a child group named Headers, keyed into the expansion store so expand-all and deep links finally reach them — and the headers card's long-standing CSS syntax error is fixed along the way. Callbacks trade their native details/summary for the gutter control, and gain breadcrumbs, so a property inside a callback body is addressable for the first time. AsyncAPI message headers and payloads gain breadcrumbs the same way. Parameter rows keep rendering their type, required marker and description inline: a disclosure may hide child elements, never child information, and the classic layout starts passing collapsableItems — previously omitted, which silently made expandAllResponses a no-op there. Model properties in the classic layout gain anchors.
Group titles — Body, Responses, Query Parameters, Callbacks — become real headings through the document outline (operationSection, level 4), never hardcoded tags.
One flagged feature ships with this: schemaKeyboardNav (default off) adds APG-tree arrow-key navigation over the gutter toggles.
#10102: Allow response hooks to return a replacement Response before the client processes its body, status, and headers. Add the onResponseReceived configuration callback for API References. Existing hooks can still read responses and return nothing.
#10081: Keep the mutualTLS security scheme type instead of turning it into an apiKey form, and show read-only authentication guidance for mutual TLS and unsupported browser broker credentials.
#10074: fix(api-reference): accessibility pass over the schema tree and parameter rows
Restores list semantics on the four lists the theme reset strips, which Safari and VoiceOver otherwise drop entirely. Gives the parameter row trigger a real focus indicator instead of drawing one on its 12px caret. Makes the Default and Examples popovers dismissible with Escape and openable by click or tap, with aria-expanded on their triggers — previously they revealed on hover and focus through CSS alone, so Enter did nothing and touch could not reach them at all. Names the copy buttons that previously announced as their bare value, adding common.copyDefault and common.copyExample across all eight locales. Gives the single content type readout a role, and honours prefers-reduced-motion.
The collapsible section trigger no longer nests the copy-link button inside the toggle button. Nested buttons are invalid, and the parser hoisted the inner one out, so the copy-link sat outside the control it appeared to belong to. The toggle moved inside the anchor instead, where it has to stay inline so the copy-link keeps aligning to the last line of a wrapped heading; it stretches its own hit area back across the full row, so the click target is the whole section row exactly as before.
ScreenReader moves off the deprecated clip property to clip-path and adds white-space: nowrap, so multi-word announcements are no longer split at wrapped word boundaries. Its visually-hidden style is now a shared .screenreader-only class rather than a scoped one, so other components can hide text without wrapping it in the component.
No visual change: every fix above is either invisible, or applies only to focus, hover, or an explicit reduced-motion preference.
The generated HTML now loads the code-split ESM build (.../@scalar/api-reference/esm.js, added in #9871) as a by default, instead of the monolithic UM
#9981: Load the modern ESM build of the API Reference by default
The generated HTML now loads the code-split ESM build (.../@scalar/api-reference/esm.js, added in #9871) as a <script type="module"> by default, instead of the monolithic UMD bundle. Because it is code-split, less JavaScript blocks the first render.
To keep the classic UMD bundle (loaded via <script src> and the window.Scalar global), set cdn to a UMD URL — for example to pin a version — or pass bundle: false. You can also pass bundle: 'https://.../esm.js' to load a specific ESM build.
When a nonce is set (a strict, nonce-based CSP) the UMD bundle is used automatically, because the ESM build's import-loaded chunks cannot be nonced. Pass bundle: true to force the ESM build if your CSP uses 'strict-dynamic'.
#9937: Add a way to open the request body editor in the Form view by default. Set the defaultRequestBodyView: 'form' config option, or the x-scalar-default-request-body-view extension in your OpenAPI document (which also works per source). Defaults to raw, and falls back to raw when a body cannot be shown as a form.
#9990: Fix @scalar/types leaking into the published type declarations. @scalar/openapi-parser referenced @scalar/types from its .d.ts files while only depending on it as a devDependency, so consumers hit TS2307 (cannot find module). @scalar/types is now a regular dependency, and the package uses the shared UnknownObject and AnyObject utility types from @scalar/types/utils directly instead of defining its own local copies (AnyObject was added to @scalar/types/utils alongside the existing UnknownObject).
The generic AnyObject and UnknownObject types are no longer re-exported from @scalar/openapi-parser. Import them from @scalar/types/utils instead.
Two type-level changes in @scalar/openapi-parser are worth noting:
#9983: Bump the zod catalog to ^4.4.3 so the standalone bundle ships a single zod instead of two (4.3.5 from @scalar/types plus 4.4.3 from the ai / @ai-sdk peer). This makes standalone.js ~68KB raw / ~18KB gzip smaller.
#9967: Add a new @scalar/openapi-validator package that validates OpenAPI documents on its own. @scalar/openapi-parser now uses it under the hood.
Two type-level changes in @scalar/openapi-parser are worth noting:
ErrorObject.path is now string | string[] instead of string[]. Schema errors carry a JSON Pointer string, semantic errors carry path segments — both shapes were already produced at runtime, the type just says so now. Narrow with Array.isArray before treating it as a list.ValidationOutcome type and the internal OpenApiDocument alias are no longer exported.### Patch Changes - #9941: Republish every package through npm trusted publishing. No functional changes.
### Minor Changes - #9868: Control OAuth2 flow tabs from your OpenAPI document. Add x-order to a flow to set the order of the tabs in the auth section
x-order to a flow to set the order of the tabs in the auth section (the first tab is selected by default, so the lowest x-order also becomes the default flow), and add x-scalar-ignore to a flow to hide its tab — useful for flows that cannot run in the browser, like Client Credentials, which usually fails on CORS. x-scalar-ignore on a whole security scheme now hides it from the auth selector too.### Patch Changes - #9684: Type the defaultHttpClient config against the real client ids. targetKey and clientKey were plain string, so there was no a
defaultHttpClient config against the real client ids. targetKey and clientKey were plain string, so there was no autocomplete and no error when the value was wrong — for example passing the display title 'Fetch' instead of the client id 'fetch', which silently did nothing. They are now typed to the actual targets and clients, in both the @scalar/types and @scalar/schemas definitions.Each entry must point to an ESM module that exports a plugin (the same shape as the plugins entries) as its default export. The standalone build (Scal
#9711: feat: add pluginUrls configuration option to load API Reference plugins from URLs
Each entry must point to an ESM module that exports a plugin (the same shape as the plugins entries) as its default export. The standalone build (Scalar.createApiReference) imports the modules before the API reference mounts and registers their default exports alongside the plugins passed directly. Unlike plugins, the new option is JSON-serializable, so integrations that pass their configuration as JSON (for example the Docker container or Scalar for Aspire) can load plugins without replacing the whole bundle.
client to its target at the type level. Before, a plugin could pair any target with any client (for example node + curl) without a type error. Now target: 'node' only allows node clients, and TypeScript catches mistakes like using the display title 'Fetch' where the lowercase client id 'fetch' is expected.hiddenClients config against the real target and client ids. It was Record<string, boolean | string[]> | string[] | true, so there was no autocomplete and no error on a typo. An array entry is now typed as a target ('node'), a client name ('fetch'), or a full id ('node/fetch'), and the record form is keyed by target. Runtime stays permissive, so unknown names are still ignored gracefully as before.### Patch Changes - #9719: docs: update the Scalar platform overview block in the README
### Patch Changes - #9710: Republish so the updated README (with the Scalar platform overview) reaches npm. Also renames the README generator metadata
readme to scalarReadme: npm treats a readme field as the readme text itself, so affected packages were published with a literal [object Object] readme on the registry instead of README.md.### Patch Changes - #9639: Add a read-only accessor for the global authentication state to the plugin API. Plugin lifecycle hooks (onInit, onConfigCha
onInit, onConfigChange) now receive an auth accessor alongside config, and the plugin manager exposes getAuthState() for view components. Plugins can read stored secrets and the selected security schemes via auth.export(), auth.getAuthSecrets(documentName, schemeName), and auth.getAuthSelectedSchemas(payload) without being able to mutate auth.### Patch Changes - #9630: Render AsyncAPI tags without the extra horizontal indentation on nested channels, and replace the empty "Operations" card i
Update the shared theme reset so text inputs align to the logical start by default for RTL documents.
#9597: Add API Reference UI localization configuration with built-in English, Russian, Spanish, French, German, Simplified Chinese and Arabic translations, including automatic RTL direction for Arabic locales.
Update the shared theme reset so text inputs align to the logical start by default for RTL documents.
Add a mergeObjects deep-merge helper to @scalar/helpers, used by the localization layer to merge translation overrides onto the built-in locale.
title and slug as deprecated. They are the supported way to name a document and its URL when using multiple sources, so the deprecation note (and editor strike-through) was misleading.The hook runs after the request has been built, right before it is sent. Header mutations apply to the outgoing request and the body bytes match what
#9515: feat: add requestBuilt client plugin hook and onRequestBuilt configuration callback that receive the exact fetch Request that is sent over the wire
The hook runs after the request has been built, right before it is sent. Header mutations apply to the outgoing request and the body bytes match what the server receives, which makes request signing possible: hashing the body of a rebuilt multipart/form-data request would produce a different multipart boundary than the request that is actually sent.
`content.start`: A new view slot that renders custom plugin components before the Introduction/Info section (at the top of the content area).
content.start plugin view slot and sidebar visibility option for plugin view components.
content.start: A new view slot that renders custom plugin components before the Introduction/Info section (at the top of the content area).sidebar option on ViewComponent: Plugins can now opt-in to display a sidebar entry for their custom views by providing sidebar: { show: true, label: 'My Page' }. Omitting sidebar or setting show: false hides the entry from the sidebar. The entry hooks into the existing navigation, so clicking it scrolls to the plugin view and it highlights as it scrolls into view.Path entries and webhooks can reference components.pathItems instead of inlining operations. Navigation, mutators, search, and markdown export now res
#9342: fix: resolve operations when OpenAPI path items use $ref
Path entries and webhooks can reference components.pathItems instead of inlining operations. Navigation, mutators, search, and markdown export now resolve path-item references before reading HTTP methods and path-level parameters.
### Patch Changes - #9471: Restore support for the deprecated source install command on x-scalar-sdk-installation. When set, it is appended to descrip
source install command on x-scalar-sdk-installation. When set, it is appended to description as a fenced code block (or used on its own when there is no description). description remains the promoted field.Nothing published for this version
In addition to x-codeSamples, the code sample picker now reads custom samples from x-scalar-examples, x-stainless-snippets, x-stainless-examples, and
#9398: feat: read code samples from x-readme, x-stainless and x-scalar extensions
In addition to x-codeSamples, the code sample picker now reads custom samples from x-scalar-examples, x-stainless-snippets, x-stainless-examples, and x-readme.code-samples. When more than one is present on an operation, the highest-priority source is used (x-scalar-examples > x-stainless-snippets > x-stainless-examples > x-readme > x-codeSamples).
#9422: Add a nonce option for Content Security Policy support.
When you pass a nonce, the rendered HTML stamps it onto the inline <script> and the CDN <script> tag (and Scalar's own <style> tags, plus a matching <meta property="csp-nonce">). This lets the API Reference run under a strict script-src with no unsafe-inline and no unsafe-eval.
ApiReference({
url: '/openapi.json',
// Match this value in your `script-src` CSP directive.
nonce: 'r4nd0m',
})
Note: style-src still needs 'unsafe-inline'. The reference renders inline style="…" attributes, which a CSP nonce can never authorize (nonces only apply to <script>, <style> and <link> elements), so a nonce-only style-src is not possible. The win is a fully strict script-src.
#9400: feat(api-reference): add expandAllSchemaProperties config option.
When enabled, nested schema properties are expanded by default while keeping the "Show/Hide Child Attributes" button available for manual collapsing. Expansion is cycle-safe: every finite branch is expanded fully, and self-referential ($ref or inline) schemas stop at the point they would otherwise recurse forever.
#9438: feat(api-reference): add an AsyncAPI server selector
Adds a server selector for AsyncAPI documents in the API reference introduction. It mirrors the OpenAPI server selector but works with the AsyncAPI server shape (a named map of host/protocol/pathname), labelling each server with its constructed connection URL.
Server selection and variable changes are now persisted to the workspace store via new asyncapi-server:update:selected and asyncapi-server:update:variables events and their mutators, mirroring the OpenAPI wiring.
Add channel connection context helpers that resolve channel, messages, parameters, servers, security, and connection URL for WebSocket client UI.
#9340: feat: add getChannelConnectionContext for AsyncAPI WebSocket channels
Add channel connection context helpers that resolve channel, messages, parameters, servers, security, and connection URL for WebSocket client UI.
#9309: feat: add modelsSectionLabel configuration ('Models' | 'Schemas' | string) to use OpenAPI-style Schemas terminology in the sidebar, content, and search.
#7618: feat(api-reference): add setPageTitle to customize the browser tab title
Pass a setPageTitle function to control the browser tab title. It is called whenever the section in view changes — on sidebar clicks, on scroll, and when switching documents — and receives the section title and the active OpenAPI document:
setPageTitle: ({ title, document }) => `${document.title} – ${title}`
### Patch Changes - #9313: feat: add AsyncAPI connection URL builder and server list helpers
Add asyncApiWsBindingObject for bindings.ws with method, query, headers, and bindingVersion
asyncApiWsBindingObject for bindings.ws with method, query, headers, and bindingVersionasyncApiSchemaObjectOrReference (Schema Object | Reference Object) for WebSocket binding fields that exclude Multi Format Schema Object@scalar/types/asyncapi/3.1 types### Minor Changes - #9264: feat: add AsyncAPI 3.1 types and @scalar/types/asyncapi/3.1 export - #9297: feat: add asyncapi extensions ### Patch Changes
@scalar/types/asyncapi/3.1 exportcustomFetch to the api-reference configuration and forward it to the API client so requests (including "Test Request" calls) use the custom fetch — enabling things like credentials: 'include'. The previous fetch option is deprecated and migrated automatically with a console warning.### Minor Changes - #9211: feat: write pure types without using the zod schemas
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
### Patch Changes - #8862: add python/aiohttp as a supported code snippet client and expose it through shared snippet client types and config schemas
Added a new php/laravel client generator in @scalar/snippetz, including comprehensive request coverage for headers, cookies, auth, query params, JSON,
#8817: feat(snippetz): add a Laravel HTTP client plugin for PHP snippets
Added a new php/laravel client generator in @scalar/snippetz, including comprehensive request coverage for headers, cookies, auth, query params, JSON, multipart, form-encoded, binary, and fallback bodies.
Updated generated client registries and schema wiring so the new client is available across Scalar:
@scalar/types GROUPED_CLIENTS / AVAILABLE_CLIENTS@scalar/workspace-store reference-config schemaUpdated api-client expectations for the increased total built-in client count.
### Minor Changes - #8695: feat: suport pre/post request scripts
### Patch Changes - #8661: fix(api-client): support OAuth redirect callback override for Electron-friendly flows - #8664: refactor: replace wildcard e
### Patch Changes - #8574: feat: make external urls configurable
### Patch Changes - #8466: chore: new build pipeline
### Patch Changes #### Updated Dependencies - @scalar/helpers@0.4.1 - #8420: fix TypeScript access to navigator.userAgentData in isMacOS without ts-ex
### Patch Changes #### Updated Dependencies - @scalar/helpers@0.4.0 - #8336: feat: support flushing any pending operations
### Patch Changes - #8381: feat: add mcp config support
### Minor Changes - #8322: chore: bump required node version to >=22 (LTS) ### Patch Changes #### Updated Dependencies - @scalar/helpers@0.3.0 - #8322
### Patch Changes #### Updated Dependencies - @scalar/helpers@0.2.18 - #8314: chore: limit concurrent operations while migrating workspaces
### Patch Changes #### Updated Dependencies - @scalar/helpers@0.2.17 - #8310: refactor: move helpers to the helpers package to share primitive helpers
### Patch Changes - #8274: feat(agent): add config to hide search api
### Patch Changes #### Updated Dependencies - @scalar/helpers@0.2.16 - #8248: fix: local storage migration script
### Patch Changes - #8212: chore: version bump #### Updated Dependencies - @scalar/helpers@0.2.15 - #8212: chore: version bump
### Patch Changes #### Updated Dependencies - @scalar/helpers@0.2.12 - #8178: chore: package bump due to ci failure
### Patch Changes #### Updated Dependencies - @scalar/helpers@0.2.11 - #8016: feat: move history and auth into their own store
### Patch Changes - #8000: fix(agent): change enabled flag to disabled - #7995: feat: enable/disable agent scalar #### Updated Dependencies - @scalar/
### Minor Changes - #7959: feat(agent): add agent scalar to localhost
### Patch Changes #### Updated Dependencies - @scalar/helpers@0.2.9 - #7894: fix: the import and export of redirect to proxy
### Patch Changes - #7866: chore: expose har types
### Patch Changes #### Updated Dependencies - @scalar/helpers@0.2.8 - #7751: fix: auth persistence
Your coding agent can read these notes before it upgrades. Set up the MCP server →