npm / @scalar/api-reference
@scalar/api-reference
What changed in @scalar/api-reference 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
1 breaking1 security10 new APIs and options10 behavior and defaults19 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@scalar/api-reference 141 changes
Breaking changes 1
Removes the duplicate standalone OAuth scope list from operation details; required scopes remain available in the authentication badge popover.
Security 1
Update AI SDK dependencies to address GHSA-866g-f22w-33x8 in response body handling.
New APIs and options 10
Adds Copy as Markdown buttons for AsyncAPI channels and operations, with customizable action slots for channels, operations, tags, and introduction.
Exposes the generate-sdk-button CSS class on the client libraries button.
Setting urlRouting to false keeps API reference navigation in internal state without reading or changing the host page URL.
Display server, channel, operation, and message binding details, including versions, referenced bindings, and unfamiliar fields.
Render replies with expandable message schemas, channel links, static addresses, and dynamic reply address expressions.
Display application, server, operation, message, and trait tags, and filter navigation by tags while preserving channel grouping.
Add controls for parameter and schema expansion, model names, required properties, and schema property ordering; explicit toggle overrides of supplied configuration are preserved.
Add per-reference Markdown rendering hooks and apply configured hooks before mounting the embedded client modal so its initial render receives them.
Add an explicitly loaded Mermaid plugin with interactive diagrams, keyboard panning, and zoom controls.
Index operation response schema fields and webhook request/response fields; search nested structures and resolved references with bounded, cycle-safe traversal while ranking field names above descriptive prose.
Behavior and default changes 10
Moves navigation cards from tags to channel sections, where each channel's operations are listed beside its details.
Displays operation-level message payload examples in a dark code card with message and example selection, selectable reply payload examples, and message and reply schemas in the left column.
Hides SDK generation buttons and the local sidebar promotion when developer tools are disabled.
AsyncAPI operation layout is aligned with OpenAPI; messages collapse by default, redundant tags are removed, and supported binding schema fields use the shared schema renderer and configured schema options.
AsyncAPI summaries serve as heading and description fallbacks without repeating introductory text.
Display channel summaries and addresses separately, and label missing or null addresses as unknown in channel content and search results.
Display parameter locations alongside descriptions, examples, and constraints.
Display external documentation across AsyncAPI objects, including referenced objects and descriptions, using the existing OpenAPI link presentation.
Display message content types, inherit document defaults, and format examples for their effective media type.
Use customizable Scalar theme styles and an intentional light drawing surface.
Fixes and other changes 19
Matches channel badge placement and spacing to OpenAPI modern and classic layouts, using the shared badge component for Send/Receive while preserving arrows and colors.
Preserves declared AsyncAPI message order in the documentation and example picker.
Lists reply messages on the operation's own channel only under Replies, rather than repeating them under Messages or Other Channel Messages.
Displays authored server-variable examples, including examples from referenced variables, in the shared Example/Examples popup with copy support.
Keeps the response copy button in view when the code scrolls.
Supports OpenAPI and AsyncAPI context and search results, preserves the selected API description when switching sources, and keeps HTTP execution separate from unsupported messaging actions.
Authentication badge and Markdown copy button wrap on narrow screens instead of extending past the page edge.
Long operation paths wrap instead of being truncated, and the client picker moves below the path when it does not fit.
The button is named by its visible text and described with the tag title.
Endpoint links have an href, enabling keyboard access and modified clicks to open an operation in a new tab.
Endpoint links have a 24px minimum height to meet the WCAG 2.5.8 target size.
Preserve document-backed API key name edits for export, allow clearing configured names, and release configured overrides when restoring the default name.
Keep messages searchable when navigation renders them beneath operations.
Ignore sibling properties when rendering content, navigation, search, and schemas.
Render Avro, Protobuf, and other schema formats as labeled, copyable source instead of dropping them or treating them as JSON Schema.
Render string discriminators with inherited schema variants and effective discriminator values.
Isolate cleanup failures so other plugins still release resources when content changes or unmounts.
Preserve recursive schemas in request bodies, code samples, and response examples instead of replacing recursion points with null or empty arrays.
Prevent shared component styles from overriding host page body backgrounds and margins, including with CSS layers; standalone bundles retain full-page body styling.