Update the bundled Scalar UI to 1.60.0 (v0.6.8)

CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+Nothing yet.
+
+## [0.6.8] - 2026-06-17
+
+### Changed
+
+- Updated the bundled Scalar UI (`ui/scalar` and `ui/scalaremb`) to
+  `@scalar/api-reference` 1.60.0 — an additive minor (a `content.start`
+  plugin slot and an opt-in sidebar for plugin views) plus a handful of
+  rendering fixes. The standalone build and the `data-url` bootstrap the
+  UIs rely on are unchanged, so the docs page and its CSP are untouched;
+  the CDN sha384 SRI and the vendored air-gapped bundle are re-pinned to
+  the new bytes, verified byte-identical between the npm tarball and the
+  pinned jsDelivr URL.
+
 ### Fixed
 
 - The README described the built-in docs page as ~1.6 KB — accurate at
@@ -630,7 +645,8 @@ Initial release.
   Dependabot for gomod/actions/npm with per-package version-parity
   tests, and a runnable demo (`cmd/demo`).
 
-[Unreleased]: https://github.com/FumingPower3925/stdocs/compare/v0.6.7...HEAD
+[Unreleased]: https://github.com/FumingPower3925/stdocs/compare/v0.6.8...HEAD
+[0.6.8]: https://github.com/FumingPower3925/stdocs/compare/v0.6.7...v0.6.8
 [0.6.7]: https://github.com/FumingPower3925/stdocs/compare/v0.6.6...v0.6.7
 [0.6.6]: https://github.com/FumingPower3925/stdocs/compare/v0.6.5...v0.6.6
 [0.6.5]: https://github.com/FumingPower3925/stdocs/compare/v0.6.4...v0.6.5

package.json

@@ -4,7 +4,7 @@
   "private": true,
   "description": "Dev-only manifest. Used by Dependabot to track upstream versions of the docs UI bundles and the typescript release CI type-checks tsgen output against; the Go source in ui/*/*.go is the source of truth for the bundle versions that ship. Do not 'npm install' — the runtime does not import any npm package.",
   "devDependencies": {
-    "@scalar/api-reference": "1.59.3",
+    "@scalar/api-reference": "1.60.0",
     "@stoplight/elements": "9.0.22",
     "redoc": "2.5.3",
     "swagger-ui-dist": "5.32.6",

ui/scalar/scalar.go

@@ -17,7 +17,7 @@
 // Scalar JavaScript and CSS are loaded from cdn.jsdelivr.net at page
 // load time, so an internet connection is required.
 //
-// The CDN URL is pinned to a specific version (1.59.3) and points at
+// The CDN URL is pinned to a specific version (1.60.0) and points at
 // the verbatim dist/browser/standalone.js file from the npm package,
 // so its bytes are deterministic and the sha384 SRI hash below is
 // pinned in the <script> tag. Bumping the pinned version requires
@@ -34,14 +34,14 @@ import (
 // scalarVersion is the version of @scalar/api-reference this
 // package is pinned to. Bumping this requires updating the SRI
 // hash below and re-vendoring the bundle in ui/scalaremb.
-const scalarVersion = "1.59.3"
+const scalarVersion = "1.60.0"
 
 // scalarSRIHash is the sha384 SRI hash of dist/browser/standalone.js
 // at the pinned version. Re-compute with:
 //
 //	curl -fsSL "https://cdn.jsdelivr.net/npm/@scalar/api-reference@<ver>/dist/browser/standalone.js" \
 //	    | openssl dgst -sha384 -binary | openssl base64 -A
-const scalarSRIHash = "sha384-cIupCoQjF73k8Pd8cAp5J3dicczn0FqXBbC8Iyjd8UTSj8vqW+NUcD7jJWed81ko"
+const scalarSRIHash = "sha384-3sxnxyp7pbU2/o4+gs4EbvQ4YKyF60pWDL2LW8SoFZNQBTSiPah2xcHpxsndZEgF"
 
 // WithUI returns a stdocs.Option that replaces the default docs
 // page with the Scalar UI.

ui/scalar/scalar_pinning_test.go

@@ -14,8 +14,8 @@ import (
 // dist/browser/standalone.js file, so its sha384 SRI hash is
 // pinned too.
 func TestPinnedVersion(t *testing.T) {
-	if scalarVersion != "1.59.3" {
-		t.Errorf("scalarVersion = %q, want 1.59.3 (re-vendor the bundle in ui/scalaremb)", scalarVersion)
+	if scalarVersion != "1.60.0" {
+		t.Errorf("scalarVersion = %q, want 1.60.0 (re-vendor the bundle in ui/scalaremb)", scalarVersion)
 	}
 	wantURL := fmt.Sprintf("https://cdn.jsdelivr.net/npm/@scalar/api-reference@%s/dist/browser/standalone.js", scalarVersion)
 	if !strings.Contains(scalarHTML, `src="`+wantURL+`"`) {

ui/scalaremb/scalaremb.go

@@ -6,7 +6,7 @@
 // bundle in your binary so the docs UI works without an internet
 // connection.
 //
-// The vendored bundle is pinned to @scalar/api-reference@1.59.3 and
+// The vendored bundle is pinned to @scalar/api-reference@1.60.0 and
 // ships in-repo, so importing this package is all you need; the
 // //go:generate directive below is a maintainer-only convenience for
 // re-vendoring the bundle on a version bump.
@@ -50,12 +50,12 @@ import (
 // `go generate` cannot run inside the module cache anyway). Bumping
 // the version requires updating scalarVersion, the URL below, the
 // SRI hash in ui/scalar, and the hash pin in the tests.
-//go:generate bash -c "curl -fsSL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.59.3/dist/browser/standalone.js -o assets/standalone.js"
+//go:generate bash -c "curl -fsSL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.60.0/dist/browser/standalone.js -o assets/standalone.js"
 
 // scalarVersion is the version of @scalar/api-reference vendored
 // under assets/. It must match the devDependencies entry in the
 // repo-root package.json.
-const scalarVersion = "1.59.3"
+const scalarVersion = "1.60.0"
 
 //go:embed assets/*
 var assetsFS embed.FS

ui/scalaremb/scalaremb_pinning_test.go

@@ -12,10 +12,10 @@ import (
 
 // standaloneJSHash is the sha384 hash of the vendored
 // assets/standalone.js, verified byte-identical to
-// dist/browser/standalone.js in the @scalar/api-reference@1.59.3
+// dist/browser/standalone.js in the @scalar/api-reference@1.60.0
 // npm tarball (and to the pinned jsDelivr URL). It matches
 // scalarSRIHash in ui/scalar.
-const standaloneJSHash = "sha384-cIupCoQjF73k8Pd8cAp5J3dicczn0FqXBbC8Iyjd8UTSj8vqW+NUcD7jJWed81ko"
+const standaloneJSHash = "sha384-3sxnxyp7pbU2/o4+gs4EbvQ4YKyF60pWDL2LW8SoFZNQBTSiPah2xcHpxsndZEgF"
 
 func sri384(data []byte) string {
 	sum := sha512.Sum384(data)