npm / @scalar/openapi-parser
@scalar/openapi-parser
What changed in @scalar/openapi-parser 0.29, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-25.
5 breaking2 security1 new APIs and options1 behavior and defaults12 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@scalar/openapi-parser 0.2921 changes
Breaking changes 5
Malformed reference escapes now return parser errors.
No longer re-exported from @scalar/openapi-parser; import it from @scalar/types/utils instead.
No longer re-exported from @scalar/openapi-parser; import it from @scalar/types/utils instead.
The internal alias is no longer exported.
The previously exported type is no longer exported.
Security 2
Unsafe component keys are ignored, and API-description joining checks own properties.
Guards merges used by join against prototype pollution from __proto__, constructor, or prototype keys in input documents.
New APIs and options 1
A new package validates OpenAPI documents on its own.
Behavior and default changes 1
The
pathtype is nowstring | string[], reflecting that schema errors carry a JSON Pointer string while semantic errors carry path segments.
Fixes and other changes 12
Resolves custom operations while preserving OAuth scope names, discriminator mappings, Link payloads, and specification extension data.
Examples and default, enum, and const values remain unchanged during reference processing.
Reference context is retained across external files and fragments.
Preserves $ref properties when schemas are objects or booleans, while retaining errors for malformed references.
Validation, dereferencing, and external-reference collection distinguish reference locations from schema name maps and literal data.
Rejected debounced callbacks are handled.
Streaming writes are awaited.
Reports invalid non-exploded structured cookies in OpenAPI 3.2 documents and prevents invalid request and code sample generation; recommends style: cookie with explode: true.
Preserves broker credentials separately from HTTP authentication schemes.
Reports the actual document version after upgrading, preserves OpenAPI 3.2 versions, and returns no version for empty or unsupported input.
Header lookup includes missing values and handles them during PowerShell snippet generation.
Makes @scalar/types a regular dependency so consumers resolving the published declarations do not hit TS2307.