npm / swagger-ui-react
swagger-ui-react
What changed in swagger-ui-react 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
3 security2 new APIs and options3 performance9 behavior and defaults19 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initswagger-ui-react 536 changes
Security 3
Addresses the nghttp2-libs vulnerability CVE-2026-27135 in Docker-related artifacts.
Upgraded Alpine packages in Docker to address high-severity CVEs.
The Docker image now uses updated libpng and zlib versions to fix CVE-2026-33416, CVE-2026-33636, and CVE-2026-22184.
New APIs and options 2
Adds basic support for OpenAPI 3.2.0.
Swagger UI adds dark mode.
Performance 3
Adds virtualization for schemas and operations.
Limit the number of operation rerenders.
Reduced conversion from immutablejs to plain JavaScript objects.
Behavior and default changes 9
The default supportedSubmitMethods for OAS 3.2 now includes query.
Native browser controls now indicate the dark color scheme.
The Authorization popup can now be closed with the Escape key or by clicking the backdrop.
Copy-to-clipboard buttons now have aria-labels, improving their accessibility to assistive technology users.
The dark-mode toggle button now exposes its name and state for accessibility.
Reduces padding on inline code blocks in markdown, changing their rendered appearance.
Adds a skip-to-operations link and banner and main landmarks to improve navigation for assistive technology users.
Model titles use strong semantics to convey emphasis to assistive technology.
Reverts the change that made Authorization easier to access.
Fixes and other changes 19
Fixes handling virtualization with path item references.
Fixes visibility of the operation copy-to-clipboard icon.
A scoped DOMPurify instance is used to avoid mutating the global instance.
Buttons now have accessible names, improving accessibility for users of assistive technologies.
Restores icon visibility in Windows High Contrast Mode.
The topbar logo and dark-mode toggle are now visible in Windows High Contrast Mode.
Avoids a crash when an OpenAPI requestBody has no content field.
Parameter inputs no longer fill with invalid array initial values.
Fixes the default text color for Markdown list items in Dark Mode.
Increased the authorization backdrop z-index to fix its layering.
Move the button margin from right to left.
Cache invalidation now accounts for location, preventing stale models components from being reused.
Responsive styling now uses container queries.
A mistakenly added condition was removed from core.
Validated support for OpenAPI 3.1.2.
Sanitizing now handles multi-level relative paths.
Prevents webhooks from crashing when used with OpenAPI 3.0.
Handles complex value stringification in the Property component.
Corrects spec paths for parameters, responses and request bodies.