• #10207: Display JSON Lines, JSON Sequences, and multipart response parts as they arrive instead of waiting for the complete response. Preserve cancellation and show malformed records, incomplete multipart responses, and bounded display limits.

  JSON Lines responses (including application/jsonl and application/x-ndjson), JSON Sequences (application/json-seq and +json-seq) and multipart/mixed or multipart/x-mixed-replace responses now use the streaming text viewer, including finite responses. Other multipart subtypes, such as multipart/form-data, retain the buffered viewer. Nested parts use hierarchical labels, such as Part 1.1.

  The streaming viewer shows received bytes and offers Copy text and Download text for the displayed transcript, including after completion, cancellation, or a framing error. These exports contain formatted records and multipart labels/base64 rather than the original wire body. Streams retain at most 16 MiB of displayed text and reject records/parts above 8 MiB; preview plugins and virtualized raw-body rendering remain available only in the buffered viewer. HTTP status, headers, and declared Content-Length remain visible.

• #10175: Support API Client UI translations through localization.translations.apiClient, including the client embedded in API Reference. Ship client translations for English, Russian, Spanish, French, German, Simplified Chinese, Arabic, and Portuguese to match API Reference. Preserve English fallbacks across package providers and react to locale, direction, and translation updates.

• #10191: Support OpenAPI 3.2 OAuth device authorization with verification codes, cancellable token polling, stored credentials, and OAuth metadata discovery. Add mock device authorization and approval endpoints with pending, denial, expiry, and polling backoff responses.

  Use consistent form-encoded Basic credentials and environment substitution across OAuth token and refresh flows. Allow HTTP metadata and verification links on local development hosts and reserved test domains, coerce discovery fields consistently, and report device-code expiry clearly.

• #10178: Support OpenAPI 3.2 streaming item schemas in the workspace store, request body examples, and API reference schema views. Frame generated and structured examples as JSON Lines, JSON Sequence, or server-sent events while preserving explicit wire-format strings.

  Preserve generated falsy request examples (0, false, and empty strings) for non-streaming bodies as well.

  Use cURL --data-binary for supported streaming media types, making framed body handling explicit. Authored arrays and objects are framed as stream records; authored wire-format strings remain unchanged. SSE records with no valid fields are safely omitted with one console warning per serialization call reporting the omitted count, including when all records are omitted.

• #10177: Use OpenAPI 3.2 schemas throughout workspace-store consumers, stories, tests, and type generation. Update the app editor to offer OpenAPI 3.2 validation and completion while continuing to accept existing 3.1 documents.

  Preserve OpenAPI 3.2 fields in the loose workspace schema, including tag hierarchy, streaming media types, nested encoding, additional operations, and OAuth device authorization.

  The editor intentionally offers the 3.2 field set to documents declaring 3.1 as well; it does not flag 3.2-only fields solely because the declared version is 3.1. This does not certify conformance to the declared version or automatically update it. Before using 3.2-only fields, migrate and explicitly declare OpenAPI 3.2, and verify support in other validators and generators. Remove the unused 3.1 loose-schema generator to prevent schema drift.

  Migration: the OpenAPI 3.1 loose-schema generator (@scalar/workspace-store/schemas/v3.1/openapi, published through the wildcard as @scalar/workspace-store/schemas/v3.1/openapi/index) and its @scalar/workspace-store/schemas/v3.1/openapi/reference helpers have been removed. Import the generator from @scalar/workspace-store/schemas/v3.2/openapi/index and the reference helpers from @scalar/workspace-store/schemas/v3.2/openapi/reference instead. The ./schemas/* wildcard and the 3.1 strict-schema exports remain available; the explicit 3.2 strict-schema exports are additive. Locally generated types now use the OpenAPIV3_2 namespace instead of OpenAPIV3_1.

  Inline the editor path-extension reference so Monaco retains the leading-slash path pattern and does not report valid paths as unknown properties.

  Document ingestion continues to upgrade only to OpenAPI 3.1, so existing inline XML bodies without xml.name remain loadable. This schema migration does not opt consumers into the stricter OpenAPI 3.2 XML upgrade.

• #10284: Load the API client modal on its first open request instead of downloading it when the API reference or agent chat mounts. Preserve the requested operation, example, and request-body variant while loading. Show loading feedback and retry guidance if the request editor cannot be downloaded.

• #10281: Fix duplicate rows and lost focus when entering request headers, cookies, and query parameters, and remove unchecked parameters cleanly.

• #10208: Share OpenAPI 3.2 example-value selection across request bodies, response examples, and code snippets. Preserve serialized payloads verbatim, serialize structured JSON strings correctly, retain falsy values, and replace original example sources after body edits. Keep dataValue and serializedValue during document ingestion.

  Editing a request body, including form fields, discards its authored externalValue URL and replaces it with the edited inline value in the workspace and exported API description. Rendering or focusing a form field preserves the external source.

  Form editors prefer structured dataValue when both example fields exist, while raw editors, requests, and code snippets preserve serializedValue as wire text. Structured examples now affect generated request payloads and snippets; XML remains raw-only in the request editor.

• #10303: Preserve parameter edits when another parameter changes, including parameters displaying downloaded examples. Keep downloaded values out of the document until explicitly edited, and use examples and defaults from resolved schema references when building requests.

• #10222: Add a Copy as Markdown button to operations and webhooks in both API Reference layouts. Add a browser entry point for converting resolved OpenAPI documents to Markdown.

• #10283: Add expandAllParameters, defaulting to true. Set it to false to start operation parameters collapsed and expand each parameter on click.

• #10178: Support OpenAPI 3.2 streaming item schemas in the workspace store, request body examples, and API reference schema views. Frame generated and structured examples as JSON Lines, JSON Sequence, or server-sent events while preserving explicit wire-format strings.

  Preserve generated falsy request examples (0, false, and empty strings) for non-streaming bodies as well.

  Use cURL --data-binary for supported streaming media types, making framed body handling explicit. Authored arrays and objects are framed as stream records; authored wire-format strings remain unchanged. SSE records with no valid fields are safely omitted with one console warning per serialization call reporting the omitted count, including when all records are omitted.

• #10300: fix(api-reference): pick badge text color from the background's lightness

  A colored x-badges entry used a darker shade of its own background as text, which is muddy on mid-tone colors and only mid-gray on pale ones. The text is now black on light backgrounds and white on dark ones, derived in CSS from the background's lightness, so every color format works. Browsers without relative color syntax keep the previous shading.

• #10177: Use OpenAPI 3.2 schemas throughout workspace-store consumers, stories, tests, and type generation. Update the app editor to offer OpenAPI 3.2 validation and completion while continuing to accept existing 3.1 documents.

  Preserve OpenAPI 3.2 fields in the loose workspace schema, including tag hierarchy, streaming media types, nested encoding, additional operations, and OAuth device authorization.

  The editor intentionally offers the 3.2 field set to documents declaring 3.1 as well; it does not flag 3.2-only fields solely because the declared version is 3.1. This does not certify conformance to the declared version or automatically update it. Before using 3.2-only fields, migrate and explicitly declare OpenAPI 3.2, and verify support in other validators and generators. Remove the unused 3.1 loose-schema generator to prevent schema drift.

  Migration: the OpenAPI 3.1 loose-schema generator (@scalar/workspace-store/schemas/v3.1/openapi, published through the wildcard as @scalar/workspace-store/schemas/v3.1/openapi/index) and its @scalar/workspace-store/schemas/v3.1/openapi/reference helpers have been removed. Import the generator from @scalar/workspace-store/schemas/v3.2/openapi/index and the reference helpers from @scalar/workspace-store/schemas/v3.2/openapi/reference instead. The ./schemas/* wildcard and the 3.1 strict-schema exports remain available; the explicit 3.2 strict-schema exports are additive. Locally generated types now use the OpenAPIV3_2 namespace instead of OpenAPIV3_1.

  Inline the editor path-extension reference so Monaco retains the leading-slash path pattern and does not report valid paths as unknown properties.

  Document ingestion continues to upgrade only to OpenAPI 3.1, so existing inline XML bodies without xml.name remain loadable. This schema migration does not opt consumers into the stricter OpenAPI 3.2 XML upgrade.

• #10203: Add a picker for generated response examples with anyOf or oneOf schema variants.

  Apply union selections to primitive and array examples in the shared generator without reusing the selection for nested unions.

  The shared generator change also affects request examples, snippets, mock responses, and AsyncAPI payloads: root primitive/array unions now generate their chosen branch before type inference from sibling properties or items. For example, a string schema with oneOf: [{ const: "first" }, { const: "second" }] now generates "first" by default, and selecting the second branch generates "second". Keywords for unrelated types do not force object/array generation. Root selections are consumed once; nested unions retain their own default or path-specific choice.

  Do not show a response variant picker for an empty enum, which permits no valid alternatives.

  Preserve the generated branch shape in mock HTTP responses instead of re-wrapping selected primitive values as arrays based on root sibling items. Explicit authored examples retain the existing array normalization.

• #10287: Load the agent drawer and chat when first opened instead of when the agent is enabled. Keep the conversation mounted when closing and reopening.

• #10284: Load the API client modal on its first open request instead of downloading it when the API reference or agent chat mounts. Preserve the requested operation, example, and request-body variant while loading. Show loading feedback and retry guidance if the request editor cannot be downloaded.

• #10175: Support API Client UI translations through localization.translations.apiClient, including the client embedded in API Reference. Ship client translations for English, Russian, Spanish, French, German, Simplified Chinese, Arabic, and Portuguese to match API Reference. Preserve English fallbacks across package providers and react to locale, direction, and translation updates.

• #10212: Improve type safety for schema display metadata, schema property merging, deprecated configuration migration, and cyclic test fixtures. Load Vite declarations for raw playground imports.

• #10208: Share OpenAPI 3.2 example-value selection across request bodies, response examples, and code snippets. Preserve serialized payloads verbatim, serialize structured JSON strings correctly, retain falsy values, and replace original example sources after body edits. Keep dataValue and serializedValue during document ingestion.

  Editing a request body, including form fields, discards its authored externalValue URL and replaces it with the edited inline value in the workspace and exported API description. Rendering or focusing a form field preserves the external source.

  Form editors prefer structured dataValue when both example fields exist, while raw editors, requests, and code snippets preserve serializedValue as wire text. Structured examples now affect generated request payloads and snippets; XML remains raw-only in the request editor.

• #10178: Support OpenAPI 3.2 streaming item schemas in the workspace store, request body examples, and API reference schema views. Frame generated and structured examples as JSON Lines, JSON Sequence, or server-sent events while preserving explicit wire-format strings.

  Preserve generated falsy request examples (0, false, and empty strings) for non-streaming bodies as well.

  Use cURL --data-binary for supported streaming media types, making framed body handling explicit. Authored arrays and objects are framed as stream records; authored wire-format strings remain unchanged. SSE records with no valid fields are safely omitted with one console warning per serialization call reporting the omitted count, including when all records are omitted.

• #10201: Support positional and nested multipart request encoding with prefixEncoding, itemEncoding, and nested encoding objects. Keep generated code snippets in sync with multipart request bodies.

  Reject ambiguous named positional items and multipart nesting beyond eight levels. Use a stable fallback root for XML parts.

  Document multipart content-type defaults and wildcard selection policies. Route structured XML parts through a shared adapter while retaining legacy root-name behavior.

  Regenerate multipart boundaries that collide with resolved text or nested delimiters, keeping binary payload bytes intact.

• #10208: Share OpenAPI 3.2 example-value selection across request bodies, response examples, and code snippets. Preserve serialized payloads verbatim, serialize structured JSON strings correctly, retain falsy values, and replace original example sources after body edits. Keep dataValue and serializedValue during document ingestion.

  Editing a request body, including form fields, discards its authored externalValue URL and replaces it with the edited inline value in the workspace and exported API description. Rendering or focusing a form field preserves the external source.

  Form editors prefer structured dataValue when both example fields exist, while raw editors, requests, and code snippets preserve serializedValue as wire text. Structured examples now affect generated request payloads and snippets; XML remains raw-only in the request editor.

• #10198: Support OpenAPI 3.2 cookie serialization with semicolon-separated entries and no percent-encoding in requests and code examples.

  Browser XHR and jQuery code examples now set explicit Cookie header values through document.cookie and enable credentialed requests, including when no structured HAR cookies are supplied. Run the cookie setup on the request origin. Requests without cookie-style parameters retain structured HAR cookies alongside explicit Cookie headers.

  Warn once per parameter name in the developer console when cookie-style parameters declare invalid explode: false, then use the expanded fallback consistently for requests and snippets. Browser cookie setup cannot assign cookies to an unrelated API domain; credentialed cross-origin responses require the appropriate CORS configuration and eligible stored cookies.

• #10178: Share JSON media-type detection across curl, wget, and RestSharp snippets.

  Share streaming media type detection and format selection between cURL snippets and streaming example serialization.

• #10207: Display JSON Lines, JSON Sequences, and multipart response parts as they arrive instead of waiting for the complete response. Preserve cancellation and show malformed records, incomplete multipart responses, and bounded display limits.

  JSON Lines responses (including application/jsonl and application/x-ndjson), JSON Sequences (application/json-seq and +json-seq) and multipart/mixed or multipart/x-mixed-replace responses now use the streaming text viewer, including finite responses. Other multipart subtypes, such as multipart/form-data, retain the buffered viewer. Nested parts use hierarchical labels, such as Part 1.1.

  The streaming viewer shows received bytes and offers Copy text and Download text for the displayed transcript, including after completion, cancellation, or a framing error. These exports contain formatted records and multipart labels/base64 rather than the original wire body. Streams retain at most 16 MiB of displayed text and reject records/parts above 8 MiB; preview plugins and virtualized raw-body rendering remain available only in the buffered viewer. HTTP status, headers, and declared Content-Length remain visible.

• #10206: Preserve authored references between embedded schema resources when the containing document has no declared identity. This keeps references valid across $id scopes and when exporting the bundle to a different retrieval URL.

• #10274: Add a standard-agnostic join utility with configurable merge strategies and conflict reporting to @scalar/json-magic/join. Use it in the OpenAPI parser while retaining OpenAPI upgrades, component prefixes, and OpenAPI conflict reports in the parser.

• #10206: Add generic document identity hooks for bundling and an explicit root URI option for reference proxies. Honor OpenAPI 3.2 $self through an OpenAPI plugin in workspace-store, including external documents and partial bundles, and enable it in OpenAPI bundling callers.

  URI resolution now honors root-relative and protocol-relative URLs, query/fragment references, and trailing-slash directory bases for all bundler consumers. Absolute non-HTTP identifiers remain unchanged instead of becoming filesystem paths; loader support is unchanged. Relative HTTP references retain query strings and fragments and are emitted only when they round-trip to the original URL.

  Preserve authored reference spellings through serialized partial bundles and editable exports, while keeping older OpenAPI resolution and configured loader restrictions unchanged.

  Keep references matching authored root schema identifiers intact so schema labels and anchors retain their existing behavior.

• #10290: Update Hono and its Node.js server, WebSocket, and OpenAPI integration dependencies.

  Replace the deprecated @hono/node-ws adapter with Node server v2 WebSocket support. createAsyncApiMockServer() now returns websocket instead of injectWebSocket. Start the server with serve({ fetch: app.fetch, websocket }) instead of calling injectWebSocket(server).

  AsyncAPI callers must upgrade to @hono/node-server v2. Node server v1 ignores the websocket option, so WebSocket channels will silently stop accepting connections if the server dependency is not upgraded.

• #10286: Fix JSON and YAML exports for file and URL inputs. Add an origin option to resolve relative references in already loaded documents without fetching the root document again.

• #10288: Upgrade documents to OpenAPI 3.2 when preparing mock responses, and use OpenAPI 3.2 for the empty-document default.

• #10176: Generate finite SSE, JSON Lines, NDJSON, and JSON Sequence mock responses from OpenAPI 3.2 itemSchema definitions, including custom handler responses.

  Honor named examples in custom stream handlers and keep media-type recognition consistent with stream serialization.

  Use the same stream serializer as documentation examples. SSE objects without valid fields are omitted with a console warning per serialization call; other records still stream normally. The mock serializes each item separately to retain individual chunk writes.

• #10191: Support OpenAPI 3.2 OAuth device authorization with verification codes, cancellable token polling, stored credentials, and OAuth metadata discovery. Add mock device authorization and approval endpoints with pending, denial, expiry, and polling backoff responses.

  Use consistent form-encoded Basic credentials and environment substitution across OAuth token and refresh flows. Allow HTTP metadata and verification links on local development hosts and reserved test domains, coerce discovery fields consistently, and report device-code expiry clearly.

• #10211: Preserve literal data and tag groups when upgrading to OpenAPI 3.2, migrate XML metadata only in schemas, and remove incompatible legacy XML flags. Make 3.2 upgrades leave the input unchanged, match the complete source version, prevent previously inactive parameter settings from changing serialization, and report path-specific errors for detected compatibility issues that require an author's decision.

  Tag kind values may change: navigation groups are classified from actual operation-tag usage instead of name substrings. Malformed 3.1 versions now report explicit errors, and successful 3.2 upgrades clone the input only once.

  Expose UpgradeIncompatibilityError so Markdown generation can retain OpenAPI 3.1 for descriptions requiring author decisions instead of failing or silently changing semantics. Clone safety and malformed-version errors still propagate.

  The mock server also retains OpenAPI 3.1 when the strict 3.2 migration reports compatibility diagnostics. Existing inline XML descriptions continue loading without inventing element names.

  Read only own data properties during migration so inherited parameter lists, XML metadata, and reference targets cannot modify prototype-owned objects.

  Add upgrade(input, '3.2', { onIncompatible: 'collect' }) to return a complete document and compatibility diagnostics. Compatible descriptions upgrade to 3.2; incompatible descriptions retain 3.1 without partial transformations. Strict mode remains the default, and malformed-version and clone-safety errors still propagate. The Markdown converter and mock server now use the shared collect mode.

• #10203: Add a picker for generated response examples with anyOf or oneOf schema variants.

  Apply union selections to primitive and array examples in the shared generator without reusing the selection for nested unions.

  The shared generator change also affects request examples, snippets, mock responses, and AsyncAPI payloads: root primitive/array unions now generate their chosen branch before type inference from sibling properties or items. For example, a string schema with oneOf: [{ const: "first" }, { const: "second" }] now generates "first" by default, and selecting the second branch generates "second". Keywords for unrelated types do not force object/array generation. Root selections are consumed once; nested unions retain their own default or path-specific choice.

  Do not show a response variant picker for an empty enum, which permits no valid alternatives.

  Preserve the generated branch shape in mock HTTP responses instead of re-wrapping selected primitive values as arrays based on root sibling items. Explicit authored examples retain the existing array normalization.

• #10206: Add generic document identity hooks for bundling and an explicit root URI option for reference proxies. Honor OpenAPI 3.2 $self through an OpenAPI plugin in workspace-store, including external documents and partial bundles, and enable it in OpenAPI bundling callers.

  URI resolution now honors root-relative and protocol-relative URLs, query/fragment references, and trailing-slash directory bases for all bundler consumers. Absolute non-HTTP identifiers remain unchanged instead of becoming filesystem paths; loader support is unchanged. Relative HTTP references retain query strings and fragments and are emitted only when they round-trip to the original URL.

  Preserve authored reference spellings through serialized partial bundles and editable exports, while keeping older OpenAPI resolution and configured loader restrictions unchanged.

  Keep references matching authored root schema identifiers intact so schema labels and anchors retain their existing behavior.

• #10251: Preserve chained path-item references with non-enumerable links.

  Remove the HTML output APIs createHtmlFromOpenApi and renderer.renderHtml from @scalar/openapi-to-markdown. Use createMarkdownFromOpenApi or renderer.render and convert the resulting Markdown with an application-provided renderer when HTML is needed.

• #10222: Add a Copy as Markdown button to operations and webhooks in both API Reference layouts. Add a browser entry point for converting resolved OpenAPI documents to Markdown.

• #10275: Preserve operation and schema details, supplied and named examples, response headers and links, and request encoding metadata in Markdown output. Render composition siblings and schema annotations, respect readOnly/writeOnly when generating examples, and distinguish recursive references from deep schemas.

• #10211: Preserve literal data and tag groups when upgrading to OpenAPI 3.2, migrate XML metadata only in schemas, and remove incompatible legacy XML flags. Make 3.2 upgrades leave the input unchanged, match the complete source version, prevent previously inactive parameter settings from changing serialization, and report path-specific errors for detected compatibility issues that require an author's decision.

  Tag kind values may change: navigation groups are classified from actual operation-tag usage instead of name substrings. Malformed 3.1 versions now report explicit errors, and successful 3.2 upgrades clone the input only once.

  Expose UpgradeIncompatibilityError so Markdown generation can retain OpenAPI 3.1 for descriptions requiring author decisions instead of failing or silently changing semantics. Clone safety and malformed-version errors still propagate.

  The mock server also retains OpenAPI 3.1 when the strict 3.2 migration reports compatibility diagnostics. Existing inline XML descriptions continue loading without inventing element names.

  Read only own data properties during migration so inherited parameter lists, XML metadata, and reference targets cannot modify prototype-owned objects.

  Add upgrade(input, '3.2', { onIncompatible: 'collect' }) to return a complete document and compatibility diagnostics. Compatible descriptions upgrade to 3.2; incompatible descriptions retain 3.1 without partial transformations. Strict mode remains the default, and malformed-version and clone-safety errors still propagate. The Markdown converter and mock server now use the shared collect mode.

• #10211: Preserve literal data and tag groups when upgrading to OpenAPI 3.2, migrate XML metadata only in schemas, and remove incompatible legacy XML flags. Make 3.2 upgrades leave the input unchanged, match the complete source version, prevent previously inactive parameter settings from changing serialization, and report path-specific errors for detected compatibility issues that require an author's decision.

  Tag kind values may change: navigation groups are classified from actual operation-tag usage instead of name substrings. Malformed 3.1 versions now report explicit errors, and successful 3.2 upgrades clone the input only once.

  Expose UpgradeIncompatibilityError so Markdown generation can retain OpenAPI 3.1 for descriptions requiring author decisions instead of failing or silently changing semantics. Clone safety and malformed-version errors still propagate.

  The mock server also retains OpenAPI 3.1 when the strict 3.2 migration reports compatibility diagnostics. Existing inline XML descriptions continue loading without inventing element names.

  Read only own data properties during migration so inherited parameter lists, XML metadata, and reference targets cannot modify prototype-owned objects.

  Add upgrade(input, '3.2', { onIncompatible: 'collect' }) to return a complete document and compatibility diagnostics. Compatible descriptions upgrade to 3.2; incompatible descriptions retain 3.1 without partial transformations. Strict mode remains the default, and malformed-version and clone-safety errors still propagate. The Markdown converter and mock server now use the shared collect mode.

• #10278: Only migrate XML metadata in schemas when upgrading to OpenAPI 3.2. Preserve example payloads and other data containing xml properties instead of changing them or throwing errors.
• #10276: Migrate x-tagGroups to OpenAPI 3.2 parent tags and remove the extension, preserving group names, member order, and tag metadata. Resolve group/tag name collisions with unique names and preserve group labels with summary. Warn and preserve the original tags and extension for ambiguous or malformed hierarchies so the API description can still render. Avoid mutating a document prototype during tag migration.

• #10283: Add expandAllParameters, defaulting to true. Set it to false to start operation parameters collapsed and expand each parameter on click.

• #10212: Improve type safety for schema display metadata, schema property merging, deprecated configuration migration, and cyclic test fixtures. Load Vite declarations for raw playground imports.

• #10198: Support OpenAPI 3.2 cookie serialization with semicolon-separated entries and no percent-encoding in requests and code examples.

  Browser XHR and jQuery code examples now set explicit Cookie header values through document.cookie and enable credentialed requests, including when no structured HAR cookies are supplied. Run the cookie setup on the request origin. Requests without cookie-style parameters retain structured HAR cookies alongside explicit Cookie headers.

  Warn once per parameter name in the developer console when cookie-style parameters declare invalid explode: false, then use the expanded fallback consistently for requests and snippets. Browser cookie setup cannot assign cookies to an unrelated API domain; credentialed cross-origin responses require the appropriate CORS configuration and eligible stored cookies.

• #10178: Share JSON media-type detection across curl, wget, and RestSharp snippets.

  Share streaming media type detection and format selection between cURL snippets and streaming example serialization.

• #10178: Support OpenAPI 3.2 streaming item schemas in the workspace store, request body examples, and API reference schema views. Frame generated and structured examples as JSON Lines, JSON Sequence, or server-sent events while preserving explicit wire-format strings.

  Preserve generated falsy request examples (0, false, and empty strings) for non-streaming bodies as well.

  Use cURL --data-binary for supported streaming media types, making framed body handling explicit. Authored arrays and objects are framed as stream records; authored wire-format strings remain unchanged. SSE records with no valid fields are safely omitted with one console warning per serialization call reporting the omitted count, including when all records are omitted.

• #10191: Support OpenAPI 3.2 OAuth device authorization with verification codes, cancellable token polling, stored credentials, and OAuth metadata discovery. Add mock device authorization and approval endpoints with pending, denial, expiry, and polling backoff responses.

  Use consistent form-encoded Basic credentials and environment substitution across OAuth token and refresh flows. Allow HTTP metadata and verification links on local development hosts and reserved test domains, coerce discovery fields consistently, and report device-code expiry clearly.

• #10283: Add expandAllParameters, defaulting to true. Set it to false to start operation parameters collapsed and expand each parameter on click.

• #10178: Support OpenAPI 3.2 streaming item schemas in the workspace store, request body examples, and API reference schema views. Frame generated and structured examples as JSON Lines, JSON Sequence, or server-sent events while preserving explicit wire-format strings.

  Preserve generated falsy request examples (0, false, and empty strings) for non-streaming bodies as well.

  Use cURL --data-binary for supported streaming media types, making framed body handling explicit. Authored arrays and objects are framed as stream records; authored wire-format strings remain unchanged. SSE records with no valid fields are safely omitted with one console warning per serialization call reporting the omitted count, including when all records are omitted.

• #10175: Support API Client UI translations through localization.translations.apiClient, including the client embedded in API Reference. Ship client translations for English, Russian, Spanish, French, German, Simplified Chinese, Arabic, and Portuguese to match API Reference. Preserve English fallbacks across package providers and react to locale, direction, and translation updates.
• #10222: Add a Copy as Markdown button to operations and webhooks in both API Reference layouts. Add a browser entry point for converting resolved OpenAPI documents to Markdown.
• #10212: Improve type safety for schema display metadata, schema property merging, deprecated configuration migration, and cyclic test fixtures. Load Vite declarations for raw playground imports.

• #10177: Use OpenAPI 3.2 schemas throughout workspace-store consumers, stories, tests, and type generation. Update the app editor to offer OpenAPI 3.2 validation and completion while continuing to accept existing 3.1 documents.

  Preserve OpenAPI 3.2 fields in the loose workspace schema, including tag hierarchy, streaming media types, nested encoding, additional operations, and OAuth device authorization.

  The editor intentionally offers the 3.2 field set to documents declaring 3.1 as well; it does not flag 3.2-only fields solely because the declared version is 3.1. This does not certify conformance to the declared version or automatically update it. Before using 3.2-only fields, migrate and explicitly declare OpenAPI 3.2, and verify support in other validators and generators. Remove the unused 3.1 loose-schema generator to prevent schema drift.

  Migration: the OpenAPI 3.1 loose-schema generator (@scalar/workspace-store/schemas/v3.1/openapi, published through the wildcard as @scalar/workspace-store/schemas/v3.1/openapi/index) and its @scalar/workspace-store/schemas/v3.1/openapi/reference helpers have been removed. Import the generator from @scalar/workspace-store/schemas/v3.2/openapi/index and the reference helpers from @scalar/workspace-store/schemas/v3.2/openapi/reference instead. The ./schemas/* wildcard and the 3.1 strict-schema exports remain available; the explicit 3.2 strict-schema exports are additive. Locally generated types now use the OpenAPIV3_2 namespace instead of OpenAPIV3_1.

  Inline the editor path-extension reference so Monaco retains the leading-slash path pattern and does not report valid paths as unknown properties.

  Document ingestion continues to upgrade only to OpenAPI 3.1, so existing inline XML bodies without xml.name remain loadable. This schema migration does not opt consumers into the stricter OpenAPI 3.2 XML upgrade.

• #10191: Support OpenAPI 3.2 OAuth device authorization with verification codes, cancellable token polling, stored credentials, and OAuth metadata discovery. Add mock device authorization and approval endpoints with pending, denial, expiry, and polling backoff responses.

  Use consistent form-encoded Basic credentials and environment substitution across OAuth token and refresh flows. Allow HTTP metadata and verification links on local development hosts and reserved test domains, coerce discovery fields consistently, and report device-code expiry clearly.

• #10208: Share OpenAPI 3.2 example-value selection across request bodies, response examples, and code snippets. Preserve serialized payloads verbatim, serialize structured JSON strings correctly, retain falsy values, and replace original example sources after body edits. Keep dataValue and serializedValue during document ingestion.

  Editing a request body, including form fields, discards its authored externalValue URL and replaces it with the edited inline value in the workspace and exported API description. Rendering or focusing a form field preserves the external source.

  Form editors prefer structured dataValue when both example fields exist, while raw editors, requests, and code snippets preserve serializedValue as wire text. Structured examples now affect generated request payloads and snippets; XML remains raw-only in the request editor.

• #10178: Support OpenAPI 3.2 streaming item schemas in the workspace store, request body examples, and API reference schema views. Frame generated and structured examples as JSON Lines, JSON Sequence, or server-sent events while preserving explicit wire-format strings.

  Preserve generated falsy request examples (0, false, and empty strings) for non-streaming bodies as well.

  Use cURL --data-binary for supported streaming media types, making framed body handling explicit. Authored arrays and objects are framed as stream records; authored wire-format strings remain unchanged. SSE records with no valid fields are safely omitted with one console warning per serialization call reporting the omitted count, including when all records are omitted.

• #10298: Keep the navigation header inline in a compact document, so x-scalar-navigation.name, title and the other fields stay readable by plain property access and auth, history and the client modal keep working. Only the children travel in the navigation chunk, and resolve(['x-scalar-navigation']) loads them onto the document in place. This replaces the 0.64.0 compact wire form, which sent the whole navigation as a chunk reference.

  Keep pending navigation loads separate when a workspace is reloaded or a document is replaced, so the current document receives its children and stale requests do not publish changes.

• #10251: Preserve chained path-item references with non-enumerable links.

  Remove the HTML output APIs createHtmlFromOpenApi and renderer.renderHtml from @scalar/openapi-to-markdown. Use createMarkdownFromOpenApi or renderer.render and convert the resulting Markdown with an application-provided renderer when HTML is needed.

• #10203: Add a picker for generated response examples with anyOf or oneOf schema variants.

  Apply union selections to primitive and array examples in the shared generator without reusing the selection for nested unions.

  The shared generator change also affects request examples, snippets, mock responses, and AsyncAPI payloads: root primitive/array unions now generate their chosen branch before type inference from sibling properties or items. For example, a string schema with oneOf: [{ const: "first" }, { const: "second" }] now generates "first" by default, and selecting the second branch generates "second". Keywords for unrelated types do not force object/array generation. Root selections are consumed once; nested unions retain their own default or path-specific choice.

  Do not show a response variant picker for an empty enum, which permits no valid alternatives.

  Preserve the generated branch shape in mock HTTP responses instead of re-wrapping selected primitive values as arrays based on root sibling items. Explicit authored examples retain the existing array normalization.

• #10201: Support positional and nested multipart request encoding with prefixEncoding, itemEncoding, and nested encoding objects. Keep generated code snippets in sync with multipart request bodies.

  Reject ambiguous named positional items and multipart nesting beyond eight levels. Use a stable fallback root for XML parts.

  Document multipart content-type defaults and wildcard selection policies. Route structured XML parts through a shared adapter while retaining legacy root-name behavior.

  Regenerate multipart boundaries that collide with resolved text or nested delimiters, keeping binary payload bytes intact.

• #10272: Preserve components named __proto__ when generating sparse server documents.

• #10303: Preserve parameter edits when another parameter changes, including parameters displaying downloaded examples. Keep downloaded values out of the document until explicitly edited, and use examples and defaults from resolved schema references when building requests.

• #10172: Preserve boolean schema semantics during client and server ingestion by normalizing true and false schemas to equivalent object schemas before coercion. Keep boolean examples, annotations, and additionalProperties values unchanged.

  Server normalization now copies only changed schema containers and their ancestors, preserving caller-owned values and sharing unchanged bundled data. Iterative normalization supports deep schema graphs without adding a recursive clone at server ingestion. Opaque example/default/enum/const values remain literal, including in external resources named like OpenAPI map fields.

  Internal schema markers remain available through backing-data APIs such as getRaw, but are omitted from public proxy serialization, rendered schema fields, and saved JSON/YAML API-description exports.

  After saving, normalized schema positions export true as {} and false as { not: {} }. Validation semantics are unchanged, but the saved representation can differ from the authored text. Boolean additionalProperties stays literal true or false, including after saving and exporting. Original, unsaved exports retain their authored boolean schemas. JSON and YAML exports share the existing save/edit cleanup boundary for internal markers.

• #10198: Support OpenAPI 3.2 cookie serialization with semicolon-separated entries and no percent-encoding in requests and code examples.

  Browser XHR and jQuery code examples now set explicit Cookie header values through document.cookie and enable credentialed requests, including when no structured HAR cookies are supplied. Run the cookie setup on the request origin. Requests without cookie-style parameters retain structured HAR cookies alongside explicit Cookie headers.

  Warn once per parameter name in the developer console when cookie-style parameters declare invalid explode: false, then use the expanded fallback consistently for requests and snippets. Browser cookie setup cannot assign cookies to an unrelated API domain; credentialed cross-origin responses require the appropriate CORS configuration and eligible stored cookies.

• #10206: Add generic document identity hooks for bundling and an explicit root URI option for reference proxies. Honor OpenAPI 3.2 $self through an OpenAPI plugin in workspace-store, including external documents and partial bundles, and enable it in OpenAPI bundling callers.

  URI resolution now honors root-relative and protocol-relative URLs, query/fragment references, and trailing-slash directory bases for all bundler consumers. Absolute non-HTTP identifiers remain unchanged instead of becoming filesystem paths; loader support is unchanged. Relative HTTP references retain query strings and fragments and are emitted only when they round-trip to the original URL.

  Preserve authored reference spellings through serialized partial bundles and editable exports, while keeping older OpenAPI resolution and configured loader restrictions unchanged.

  Keep references matching authored root schema identifiers intact so schema labels and anchors retain their existing behavior.

• #10279: Write workspace chunks to the requested absolute output directory, including Windows drives and network shares.

• #10304: Accept Astro 7 as a peer dependency. Astro 7 escapes attribute quotes as ", so the render test now normalizes the entity before asserting.

• #10290: Update Hono and its Node.js server, WebSocket, and OpenAPI integration dependencies.

  Replace the deprecated @hono/node-ws adapter with Node server v2 WebSocket support. createAsyncApiMockServer() now returns websocket instead of injectWebSocket. Start the server with serve({ fetch: app.fetch, websocket }) instead of calling injectWebSocket(server).

  AsyncAPI callers must upgrade to @hono/node-server v2. Node server v1 ignores the websocket option, so WebSocket channels will silently stop accepting connections if the server dependency is not upgraded.

• #10284: Load the API client modal on its first open request instead of downloading it when the API reference or agent chat mounts. Preserve the requested operation, example, and request-body variant while loading. Show loading feedback and retry guidance if the request editor cannot be downloaded.

• #10206: Add generic document identity hooks for bundling and an explicit root URI option for reference proxies. Honor OpenAPI 3.2 $self through an OpenAPI plugin in workspace-store, including external documents and partial bundles, and enable it in OpenAPI bundling callers.

  URI resolution now honors root-relative and protocol-relative URLs, query/fragment references, and trailing-slash directory bases for all bundler consumers. Absolute non-HTTP identifiers remain unchanged instead of becoming filesystem paths; loader support is unchanged. Relative HTTP references retain query strings and fragments and are emitted only when they round-trip to the original URL.

  Preserve authored reference spellings through serialized partial bundles and editable exports, while keeping older OpenAPI resolution and configured loader restrictions unchanged.

  Keep references matching authored root schema identifiers intact so schema labels and anchors retain their existing behavior.

• #10212: Improve type safety for schema display metadata, schema property merging, deprecated configuration migration, and cyclic test fixtures. Load Vite declarations for raw playground imports.

• #10175: Support API Client UI translations through localization.translations.apiClient, including the client embedded in API Reference. Ship client translations for English, Russian, Spanish, French, German, Simplified Chinese, Arabic, and Portuguese to match API Reference. Preserve English fallbacks across package providers and react to locale, direction, and translation updates.
• #10175: Preserve literal dollar sequences in interpolated translation values, including existing API Reference translations.

• #10274: Add a standard-agnostic join utility with configurable merge strategies and conflict reporting to @scalar/json-magic/join. Use it in the OpenAPI parser while retaining OpenAPI upgrades, component prefixes, and OpenAPI conflict reports in the parser.

• #10273: Accept valid OpenAPI 3.1 and 3.2 schemas with JSON Schema core keywords, references with sibling keywords, custom formats, and keywords independent of the declared type.

• #10212: Improve type safety for schema display metadata, schema property merging, deprecated configuration migration, and cyclic test fixtures. Load Vite declarations for raw playground imports.

• #10290: Update Hono and its Node.js server, WebSocket, and OpenAPI integration dependencies.

  Replace the deprecated @hono/node-ws adapter with Node server v2 WebSocket support. createAsyncApiMockServer() now returns websocket instead of injectWebSocket. Start the server with serve({ fetch: app.fetch, websocket }) instead of calling injectWebSocket(server).

  AsyncAPI callers must upgrade to @hono/node-server v2. Node server v1 ignores the websocket option, so WebSocket channels will silently stop accepting connections if the server dependency is not upgraded.

• #10290: Update Hono and its Node.js server, WebSocket, and OpenAPI integration dependencies.

  Replace the deprecated @hono/node-ws adapter with Node server v2 WebSocket support. createAsyncApiMockServer() now returns websocket instead of injectWebSocket. Start the server with serve({ fetch: app.fetch, websocket }) instead of calling injectWebSocket(server).

  AsyncAPI callers must upgrade to @hono/node-server v2. Node server v1 ignores the websocket option, so WebSocket channels will silently stop accepting connections if the server dependency is not upgraded.

• #10177: Use OpenAPI 3.2 schemas throughout workspace-store consumers, stories, tests, and type generation. Update the app editor to offer OpenAPI 3.2 validation and completion while continuing to accept existing 3.1 documents.

  Preserve OpenAPI 3.2 fields in the loose workspace schema, including tag hierarchy, streaming media types, nested encoding, additional operations, and OAuth device authorization.

  The editor intentionally offers the 3.2 field set to documents declaring 3.1 as well; it does not flag 3.2-only fields solely because the declared version is 3.1. This does not certify conformance to the declared version or automatically update it. Before using 3.2-only fields, migrate and explicitly declare OpenAPI 3.2, and verify support in other validators and generators. Remove the unused 3.1 loose-schema generator to prevent schema drift.

  Migration: the OpenAPI 3.1 loose-schema generator (@scalar/workspace-store/schemas/v3.1/openapi, published through the wildcard as @scalar/workspace-store/schemas/v3.1/openapi/index) and its @scalar/workspace-store/schemas/v3.1/openapi/reference helpers have been removed. Import the generator from @scalar/workspace-store/schemas/v3.2/openapi/index and the reference helpers from @scalar/workspace-store/schemas/v3.2/openapi/reference instead. The ./schemas/* wildcard and the 3.1 strict-schema exports remain available; the explicit 3.2 strict-schema exports are additive. Locally generated types now use the OpenAPIV3_2 namespace instead of OpenAPIV3_1.

  Inline the editor path-extension reference so Monaco retains the leading-slash path pattern and does not report valid paths as unknown properties.

  Document ingestion continues to upgrade only to OpenAPI 3.1, so existing inline XML bodies without xml.name remain loadable. This schema migration does not opt consumers into the stricter OpenAPI 3.2 XML upgrade.

• @scalar/api-reference@1.71.0

• @scalar/api-reference@1.71.0

• @scalar/api-reference@1.71.0

• @scalar/api-reference@1.71.0

• @scalar/api-reference@1.71.0

• @scalar/api-reference@1.71.0

• @scalar/api-reference@1.71.0

• feat(turbopack): support false values for resolveAlias config: #93331

• Enable AI upgrade for canary: #99001
• fix(turbo-persistence): preserve write errors on writer drop: #98840
• Skip slow valued tombstone test under Miri: #98992
• Improve the agent feedback review flow: #98937
• Run AI upgrades with the latest official canary: #98870
• test: move whole development-only suites out of e2e: #98842
• Fix instant-false codemod to run on route segment filenames: #98880
• test: migrate legacy deployment exclusion callers: #98473
• Split revalidation errors by execution context: #98993
• Enable strict route matching by default: #97397
• Surface agent feedback gate connection failures: #98991
• Generalize the build-time generator work-unit store name: #98891
• Use structural React keys during server rendering: #98944
• Upgrade React from ff8f88fc-20260915 to 59aff3e1-20260918: #98897
• Remove unused hasWarnings and warnings: #96956

Huge thanks to @sokra, @devjiwonchoi, @aurorascharff, @jamiboym, @gnoff, and @martinfrancois for helping!

• fix(QPagination): the page input clears once the page is submitted -> in input mode the typed text stayed in the field after pressing Enter, so on a 10-page pagination the field read "99" next to a placeholder reading "10 / 10". The field now empties and shows the current page again (#18552)
• fix(ui): color utils -> textToRgb() keeps the alpha of the rgb(R, G, B, A) form; only rgba() preserved it, rgb(255, 0, 0, 0.5) lost its fourth argument. rgba() written without an alpha still yields a: 100 (#18555)

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

• feat(mcp): workspaces -> started at the root of a workspace holding several Quasar apps, the server now serves all of them instead of only the first one found. The five local tools (list_pages, search_docs, get_page, list_api, get_api) take an optional app argument naming an app by its directory relative to the start directory; the client validates the name from the tool schema, so no listing tool is needed. Without it, the first app found is served (a full app before a library, path order otherwise). In a workspace, every answer opens with the app and versions it describes, the session-start instructions list the other apps with their versions, and check_updates covers every distinct version installed across the apps (#18554)
• feat(mcp): --project on a workspace root -> a directory that holds no Quasar packages itself but is the root of a workspace is scanned for its apps, the same way the working directory is (#18554)

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

• ERR_CODEC_OUT_OF_MEMORY is a new exported constant, thrown when the codec of an entry cannot allocate the memory it needs, e.g. when the 16 MB heap of the bundled WebAssembly module is exhausted by too many entries processed concurrently in the same worker, or on the page when workers are off, with the error of the codec as the cause. The failure is recognized by the code property of that error, "Z_MEM_ERROR", which the bundled zlib-streams 1.4.0 sets on its allocation failures and which the native DecompressionStream of Node.js would set. It is raised when reading an entry, both when the codec cannot allocate its state and when it fails while inflating, and when writing an entry whose codec cannot allocate its state; a failure while compressing keeps the error of the codec. Such a failure used to surface as the allocation failed error of the codec, so code matching that message should catch the constant instead

• A zip file whose compressedSize overshoots the deflate stream of an entry, which the bundled codecs used to read by dropping the extra bytes, now fails on every codec, as it already did with a native DecompressionStream. The error is ERR_INVALID_COMPRESSED_DATA, with the error of the codec as the cause; on Node.js with checkCrc32 set it is ERR_INVALID_CRC32, since its native inflater reports the extra bytes only once the gzip trailer built by zip.js has been written. The bundled codecs are zlib-streams 1.4.0, the WebAssembly one, and zlib-streams-ts 1.2.0, the pure-JS one of the *-native builds
• A corrupted deflated entry rejects with ERR_INVALID_COMPRESSED_DATA whatever inflates it, with the error the codec raised as the cause: the TypeError of a native DecompressionStream, whose message depends on the engine, or the error of the bundled WebAssembly or pure-JS codec. Only the message-less error of Node.js used to be mapped, so the same corrupted zip file raised Invalid compressed data on Node.js, corrupt deflate stream on Deno, process error:-3 wherever the WebAssembly codec inflates, e.g. in a browser with useCompressionStream off, and inflate failed on Bun, and a caller comparing against the constant was right on Node.js only. An error raised while the data is being read, by the reader of the zip file or by the decryption of the entry, is not a codec failure and reaches the caller unchanged, with its own cause. On Safari and Bun, whose structured clone drops the cause of an error posted by a worker, the cause is rebuilt from its name and message
• With checkCrc32 set, a stored uncompressed size larger than the data now fails with ERR_INVALID_CRC32 instead of ERR_INVALID_UNCOMPRESSED_SIZE, on every codec, with the error of the inflater as the cause: the inflater verifies the checksum through a gzip trailer built from the stored CRC-32 and size, and rejects that trailer as a whole. With checkCrc32 off it is still ERR_INVALID_UNCOMPRESSED_SIZE, and a size smaller than the data is ERR_INVALID_UNCOMPRESSED_SIZE either way, as soon as the output exceeds it
• A signal aborted while an entry is being read by getData() or added by add() rejects the operation with the reason of the signal, whether the compressed data is still being consumed or the content still being written. The signal used to guard the pipe feeding the codec alone, so an abort landing once the input had been consumed, e.g. while a large content was still being written to the writer, was ignored and the operation completed. On the oldest supported engines, which ignore the signal option of pipeTo(), the data is written to the end before the operation is rejected
• With the passwords and requestPassword options of the filesystem API, the ERR_INVALID_PASSWORD error raised when every candidate has failed, or when requestPassword gives up, carries the error raised by the last candidate as its cause. A ZipCrypto entry whose read fails for a reason other than a false accept, i.e. a wrong password slipping past the one-byte header check of ZipCrypto, as one in 256 does, reports that failure instead of trying the next candidate: only ERR_INVALID_CRC32, ERR_INVALID_COMPRESSED_DATA and ERR_INVALID_UNCOMPRESSED_SIZE count as a wrong password, since such a password produces content that the CRC-32 check or the inflater rejects, while a failure of the reader, e.g. a network error, or an ERR_CODEC_OUT_OF_MEMORY error reaches the caller as-is. Any failure of the read used to count as a wrong password, so a reader failure surfaced as ERR_INVALID_PASSWORD once the candidates were exhausted. A corrupted entry read with the right password is still reported as a wrong password, since nothing tells it from a wrong password passing the check
• On Chrome before 103 or Node.js before 20.12, whose native inflater lacks "deflate-raw", when the WebAssembly codec cannot take over because its module failed to load, e.g. an *-external build deployed without zip-module.wasm next to it, an entry encrypted with AES that stores no CRC-32 (AE-2, what the writer emits for every encrypted entry) is inflated through a gzip container whose trailer carries the CRC-32 of the output received so far. A valid entry failed with ERR_INVALID_CRC32 now and then, more often on a loaded machine and on Node.js, because the trailer was written on a timing guess. It is now written once the inflater has returned everything, and the entry fails with ERR_INVALID_UNCOMPRESSED_SIZE when it inflates to fewer bytes as well as to more
• The same wrapper serves the checkCrc32 route on every host, where the rewrite costs about 3 µs per entry with the native codec, measured with the benchmark harness; the tables of BENCHMARKS.md are unchanged
• The WebAssembly codec (zlib-streams 1.4.0) and the pure-JS codec of the *-native builds (zlib-streams-ts 1.2.0) reject an unknown format with a TypeError when the stream is constructed, as the platform CompressionStream and DecompressionStream do; they used to treat it as "deflate". Nothing changes for a zip file; code that tests a format by constructing the stream now gets the right answer

• ERR_INVALID_COMPRESSED_DATA, ERR_INVALID_CRC32 and ERR_INVALID_UNCOMPRESSED_SIZE document when they are raised, the cause they carry and the routes on which one is raised in place of another, the signal option of the reader and of the writer documents the abort landing during the output, and PasswordCandidatesOptions documents the errors counted as a wrong password and the cause of the final ERR_INVALID_PASSWORD

• New tests cover the corrupted deflated entry on every inflate route, with the native and the WebAssembly codecs, with and without workers and with and without checkCrc32, the bytes trailing a deflate stream, the memory failure of the codec on both sides with the heap of the WebAssembly module actually exhausted, the gzip route with a large AE-2 entry read several times, which is what caught the race, the abort landing during the output of a read and of a write, and the reader failure and the cause under the password candidates
• The password candidates fixture is generated until none of the wrong candidates passes the one-byte check of ZipCrypto by chance, which one in 256 did and failed a job on Chrome 87 once
• The README of the tests names both compression globals that the polyfill runner removes

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.16.1...v2.17.0

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

Release 2026-09-21 20:24

• start-plugin-core: restore per route stylesheets on Windows (#8202) (222300b82f) by @czearing
• benchmarks: limit targeted bundle reports to measured scenarios (#8456) (ac223be013) by @Sheraff
• router-core: missing deepEqual signature changes in replace-equal-deep benchmark (#8462) (faec323dc5) by @Sheraff

• benchmarks: compress bundle-size outputs once (#8453) (2fb7723230) by @Sheraff

• @tanstack/react-start@1.168.57
• @tanstack/react-start-rsc@0.1.56
• @tanstack/solid-start@1.168.55
• @tanstack/start-plugin-core@1.171.47
• @tanstack/vue-start@1.168.54

• Updated dependencies [222300b]:
  • @tanstack/start-plugin-core@1.171.47

• #8202 222300b - Fix the Rsbuild Start manifest dropping every route's stylesheets and preloads on Windows by normalizing rspack module paths to the POSIX form the generated route tree uses.

• Updated dependencies [222300b]:
  • @tanstack/start-plugin-core@1.171.47
  • @tanstack/react-start-rsc@0.1.56

• Updated dependencies [222300b]:
  • @tanstack/start-plugin-core@1.171.47