# What changed in @scalar/openapi-parser > 33 changes in @scalar/openapi-parser 0.24 to 0.29 from its official release notes, upgrade guides and advisories: 7 breaking, 2 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-25. HTML: https://unstale.sh/npm/@scalar/openapi-parser/ To see which of these apply to a repository, run `npx @unstale/cli init` in it. ## @scalar/openapi-parser 0.29 ### Breaking changes - Malformed reference escapes now return parser errors. (0.29.2) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0292) - No longer re-exported from @scalar/openapi-parser; import it from @scalar/types/utils instead. (0.29.1) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0291) - No longer re-exported from @scalar/openapi-parser; import it from @scalar/types/utils instead. (0.29.1) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0291) - The internal alias is no longer exported. (0.29.0) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0290) - The previously exported type is no longer exported. (0.29.0) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0290) ### Security - Unsafe component keys are ignored, and API-description joining checks own properties. (0.29.2) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0292) - Guards merges used by join against prototype pollution from __proto__, constructor, or prototype keys in input documents. (0.29.1) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0291) ### New APIs and options - A new package validates OpenAPI documents on its own. (0.29.0) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0290) ### Behavior and default changes - The `path` type is now `string | string[]`, reflecting that schema errors carry a JSON Pointer string while semantic errors carry path segments. (0.29.0) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0290) ### Fixes and other changes - Resolves custom operations while preserving OAuth scope names, discriminator mappings, Link payloads, and specification extension data. (0.29.15) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02915) - Examples and default, enum, and const values remain unchanged during reference processing. (0.29.15) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02915) - Reference context is retained across external files and fragments. (0.29.15) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02915) - Preserves $ref properties when schemas are objects or booleans, while retaining errors for malformed references. (0.29.15) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02915) - Validation, dereferencing, and external-reference collection distinguish reference locations from schema name maps and literal data. (0.29.15) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02915) - Rejected debounced callbacks are handled. (0.29.13) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02913) - Streaming writes are awaited. (0.29.13) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02913) - Reports invalid non-exploded structured cookies in OpenAPI 3.2 documents and prevents invalid request and code sample generation; recommends style: cookie with explode: true. (0.29.12) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02912) - Preserves broker credentials separately from HTTP authentication schemes. (0.29.2) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0292) - Reports the actual document version after upgrading, preserves OpenAPI 3.2 versions, and returns no version for empty or unsupported input. (0.29.2) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0292) - Header lookup includes missing values and handles them during PowerShell snippet generation. (0.29.2) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0292) - Makes @scalar/types a regular dependency so consumers resolving the published declarations do not hit TS2307. (0.29.1) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0291) ## @scalar/openapi-parser 0.28 ### Fixes and other changes - The validator now reports a clearer error when a response is missing its description, instead of a confusing $ref or oneOf error. (0.28.13) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02813) ## @scalar/openapi-parser 0.26 ### Behavior and default changes - The onDereference callback now receives the resolved object. (0.26.0) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0260) ## @scalar/openapi-parser 0.25 ### Breaking changes - The required Node.js version is now >=22 (LTS), so developers need to run the package on Node.js 22 or later. (0.25.0) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0250) ### Fixes and other changes - Improves format validation error messages for $ref values with non-ASCII characters. (0.25.8) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0258) - Trailing + is normalized in path template parameter names, so {name+} matches a declared name path parameter. (0.25.6) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0256) - Fixes parser validation for unused path parameters. (0.25.4) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0254) - The v3.2 schema replaces $dynamicRef with $ref for AJV compatibility. (0.25.2) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#0252) ## @scalar/openapi-parser 0.24 ### Breaking changes - The $ref property in the ReferenceObject type is now required. (0.24.17) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02417) ### Behavior and default changes - Swagger 2.0 response examples are migrated. (0.24.16) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02416) ### Fixes and other changes - Named request examples are kept when upgrading from Swagger 2.0. (0.24.17) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02417) - JSON pointers are now parsed properly. (0.24.16) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02416) - Swagger 2.0 parameter defaults are migrated. (0.24.15) — [release notes](https://github.com/scalar/scalar/blob/efb009aff3e0dd32bce9399bf71fa99bb8818ac9/packages/openapi-parser/CHANGELOG.md#02415)