Update the bundled Scalar UI to 1.60.0

Dependabot flagged @scalar/api-reference 1.60.0. It is an additive
minor — a content.start plugin slot and an opt-in sidebar for plugin
views, plus a handful of rendering fixes (composition nesting, deep
links into collapsed schemas, response descriptions, the loading
skeleton, a 1000px sidebar overlap). None of it touches the standalone
build or the #api-reference/data-url bootstrap both UIs rely on, so no
page or CSP change is needed.

The version is pinned in several places that have to move together or
the parity tests fail: the package.json tracker, the CDN version and
sha384 SRI in ui/scalar, and the vendored bundle, version, and
go:generate URL in ui/scalaremb, plus both pinning tests. The new
standalone.js is byte-identical between the npm tarball and the pinned
jsDelivr URL, and the SRI is recomputed from those bytes.

Author: FumingPower3925

package.json

@@ -4,7 +4,7 @@
   "private": true,
   "description": "Dev-only manifest. Used by Dependabot to track upstream versions of the docs UI bundles and the typescript release CI type-checks tsgen output against; the Go source in ui/*/*.go is the source of truth for the bundle versions that ship. Do not 'npm install' — the runtime does not import any npm package.",
   "devDependencies": {
-    "@scalar/api-reference": "1.59.3",
+    "@scalar/api-reference": "1.60.0",
     "@stoplight/elements": "9.0.22",
     "redoc": "2.5.3",
     "swagger-ui-dist": "5.32.6",

ui/scalar/scalar.go

@@ -17,7 +17,7 @@
 // Scalar JavaScript and CSS are loaded from cdn.jsdelivr.net at page
 // load time, so an internet connection is required.
 //
-// The CDN URL is pinned to a specific version (1.59.3) and points at
+// The CDN URL is pinned to a specific version (1.60.0) and points at
 // the verbatim dist/browser/standalone.js file from the npm package,
 // so its bytes are deterministic and the sha384 SRI hash below is
 // pinned in the <script> tag. Bumping the pinned version requires
@@ -34,14 +34,14 @@ import (
 // scalarVersion is the version of @scalar/api-reference this
 // package is pinned to. Bumping this requires updating the SRI
 // hash below and re-vendoring the bundle in ui/scalaremb.
-const scalarVersion = "1.59.3"
+const scalarVersion = "1.60.0"
 
 // scalarSRIHash is the sha384 SRI hash of dist/browser/standalone.js
 // at the pinned version. Re-compute with:
 //
 //	curl -fsSL "https://cdn.jsdelivr.net/npm/@scalar/api-reference@<ver>/dist/browser/standalone.js" \
 //	    | openssl dgst -sha384 -binary | openssl base64 -A
-const scalarSRIHash = "sha384-cIupCoQjF73k8Pd8cAp5J3dicczn0FqXBbC8Iyjd8UTSj8vqW+NUcD7jJWed81ko"
+const scalarSRIHash = "sha384-3sxnxyp7pbU2/o4+gs4EbvQ4YKyF60pWDL2LW8SoFZNQBTSiPah2xcHpxsndZEgF"
 
 // WithUI returns a stdocs.Option that replaces the default docs
 // page with the Scalar UI.

ui/scalar/scalar_pinning_test.go

@@ -14,8 +14,8 @@ import (
 // dist/browser/standalone.js file, so its sha384 SRI hash is
 // pinned too.
 func TestPinnedVersion(t *testing.T) {
-	if scalarVersion != "1.59.3" {
-		t.Errorf("scalarVersion = %q, want 1.59.3 (re-vendor the bundle in ui/scalaremb)", scalarVersion)
+	if scalarVersion != "1.60.0" {
+		t.Errorf("scalarVersion = %q, want 1.60.0 (re-vendor the bundle in ui/scalaremb)", scalarVersion)
 	}
 	wantURL := fmt.Sprintf("https://cdn.jsdelivr.net/npm/@scalar/api-reference@%s/dist/browser/standalone.js", scalarVersion)
 	if !strings.Contains(scalarHTML, `src="`+wantURL+`"`) {

ui/scalaremb/assets/standalone.js

@@ -6,7 +6,7 @@
 // bundle in your binary so the docs UI works without an internet
 // connection.
 //
-// The vendored bundle is pinned to @scalar/api-reference@1.59.3 and
+// The vendored bundle is pinned to @scalar/api-reference@1.60.0 and
 // ships in-repo, so importing this package is all you need; the
 // //go:generate directive below is a maintainer-only convenience for
 // re-vendoring the bundle on a version bump.
@@ -50,12 +50,12 @@ import (
 // `go generate` cannot run inside the module cache anyway). Bumping
 // the version requires updating scalarVersion, the URL below, the
 // SRI hash in ui/scalar, and the hash pin in the tests.
-//go:generate bash -c "curl -fsSL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.59.3/dist/browser/standalone.js -o assets/standalone.js"
+//go:generate bash -c "curl -fsSL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.60.0/dist/browser/standalone.js -o assets/standalone.js"
 
 // scalarVersion is the version of @scalar/api-reference vendored
 // under assets/. It must match the devDependencies entry in the
 // repo-root package.json.
-const scalarVersion = "1.59.3"
+const scalarVersion = "1.60.0"
 
 //go:embed assets/*
 var assetsFS embed.FS

ui/scalaremb/scalaremb.go

@@ -12,10 +12,10 @@ import (
 
 // standaloneJSHash is the sha384 hash of the vendored
 // assets/standalone.js, verified byte-identical to
-// dist/browser/standalone.js in the @scalar/api-reference@1.59.3
+// dist/browser/standalone.js in the @scalar/api-reference@1.60.0
 // npm tarball (and to the pinned jsDelivr URL). It matches
 // scalarSRIHash in ui/scalar.
-const standaloneJSHash = "sha384-cIupCoQjF73k8Pd8cAp5J3dicczn0FqXBbC8Iyjd8UTSj8vqW+NUcD7jJWed81ko"
+const standaloneJSHash = "sha384-3sxnxyp7pbU2/o4+gs4EbvQ4YKyF60pWDL2LW8SoFZNQBTSiPah2xcHpxsndZEgF"
 
 func sri384(data []byte) string {
 	sum := sha512.Sum384(data)