Releases

• #10269: Add title filtering and keyboard-friendly search to the multi-document API selector.

• #10217: Generate AsyncAPI payload examples from JSON Schema when no explicit payload example is provided. Preserve literal proto keys when cloning example data.

• #10253: Keep deep-linked headings visible below sticky or fixed headers, including stacked navigation bars. Preserve scrolling inside embedded containers and existing scroll margins, and exclude sidebars beside the target from the header offset.

• #10240: Load external examples on demand when their selected preview is visible or Test Request opens, instead of downloading every payload while loading the API description. Share and cache downloads, preserve relative URL origins, and show loading and retry states while preventing incomplete requests from being sent.

• #10249: Show response example summaries and descriptions alongside their payloads.

• #10232: Intersect enum values when merging allOf schemas so inherited properties show only allowed values.

  Preserve sibling keywords when merging nested allOf properties. Display an explanation when enum constraints allow no values, and omit empty enum annotations.

• #10269: Add title filtering and keyboard-friendly search to the multi-document API selector.

• #10264: Add a compact option to the server workspace store, which shrinks the sparse document the browser downloads before it can render anything: Cloudflare's public API goes from 4,447 KB to 431 KB (346 KB to 63 KB gzipped). The navigation becomes one more lazily resolved chunk, and the per-node chunk references become one x-scalar-chunk-index extension the client expands back into the very same references as it ingests the document. Defaults are unchanged, and what the client holds in memory is identical either way.
• #10240: Load external examples on demand when their selected preview is visible or Test Request opens, instead of downloading every payload while loading the API description. Share and cache downloads, preserve relative URL origins, and show loading and retry states while preventing incomplete requests from being sent.
• #10263: feat: add a reactive: false option to the client workspace store, which keeps the whole store API on plain objects for read-mostly consumers such as a server render

• #10268: Save content-based parameter edits in the media type's examples so enabled JSON query parameters are included in requests. Preserve previously saved edits and migrate them when the parameter is edited again.

• #10255: fix(api-client): auto-enable optional header/query/cookie rows that have a pre-populated value

  Optional parameters (headers, query params, cookies) start disabled by default. When the API description provides a default or enum value for such a parameter (e.g. x-scenario-id with an enum), the row was rendered with its checkbox unchecked even though a value was already selected — so the parameter was silently dropped from every request until the user manually checked it.

  The fix auto-enables any row that is only disabled by default (no explicit x-disabled: true) and already carries a non-empty value, mirroring the existing behaviour when a user types a value into a previously-empty row.

  Use the same enablement rules for the parameter editor, outgoing requests, and generated code snippets.

• #10255: fix(api-client): auto-enable optional header/query/cookie rows that have a pre-populated value

  Optional parameters (headers, query params, cookies) start disabled by default. When the API description provides a default or enum value for such a parameter (e.g. x-scenario-id with an enum), the row was rendered with its checkbox unchecked even though a value was already selected — so the parameter was silently dropped from every request until the user manually checked it.

  The fix auto-enables any row that is only disabled by default (no explicit x-disabled: true) and already carries a non-empty value, mirroring the existing behaviour when a user types a value into a previously-empty row.

  Use the same enablement rules for the parameter editor, outgoing requests, and generated code snippets.

• #10240: Load external examples on demand when their selected preview is visible or Test Request opens, instead of downloading every payload while loading the API description. Share and cache downloads, preserve relative URL origins, and show loading and retry states while preventing incomplete requests from being sent.

• #10240: Load external examples on demand when their selected preview is visible or Test Request opens, instead of downloading every payload while loading the API description. Share and cache downloads, preserve relative URL origins, and show loading and retry states while preventing incomplete requests from being sent.

• #10289: Update @faker-js/faker from 10.4.0 to 10.6.0.

• #10232: Intersect enum values when merging allOf schemas so inherited properties show only allowed values.

  Preserve sibling keywords when merging nested allOf properties. Display an explanation when enum constraints allow no values, and omit empty enum annotations.

• @scalar/api-reference@1.70.0

• @scalar/api-reference@1.70.0

• @scalar/api-reference@1.70.0

• @scalar/api-reference@1.70.0

• @scalar/api-reference@1.70.0

• @scalar/api-reference@1.70.0

• @scalar/api-reference@1.70.0

Full Changelog: https://github.com/zumerlab/snapdom/compare/v3.0.0...v3.1.0

• The filesystem API tries several passwords on an entry imported from a zip file when its data is read. The core ZipReader API keeps one password per reader or per call. The new passwords option lists the candidates, and the new requestPassword option is a function asked for a password when every candidate has failed, or when there is none: it is called with the entry being read and the error raised by the last candidate, it can return a promise, e.g. to prompt the user, and it gives up by returning undefined or null, in which case the entry fails with ERR_INVALID_PASSWORD, or with ERR_ENCRYPTED when nothing was tried. Both options are accepted by the import*() methods, by the readerOptions of the export*() methods and by the get*() methods of a file entry. The candidates are tried in order: the password or rawPassword option, then the passwords that already decrypted another entry of the same zip file, most recent first, then the passwords list, so the wrong candidates ahead of the right one are tried once for the archive, not once per entry. When several entries are read concurrently, e.g. by export*() with bufferedWrite, one requestPassword call is pending at a time, and the other entries try its answer before asking. With candidates in play, a ZipCrypto entry, whose one-byte check accepts one wrong password in 256, is checked on its header first without reading the content, the CRC-32 of the content is then verified whatever checkCrc32 says, and any failure of that read counts as a wrong password. An AES entry reports a failure of the read as-is. ERR_INVALID_PASSWORDS and ERR_INVALID_REQUEST_PASSWORD are thrown when the options have the wrong type, and the latter also when the function returns a value of another type
• An error raised while exporting because the data of an entry cannot be read now carries the entry as entry and its name relative to the exported directory as entryName, next to the entryId it already had, and keeps its own cause, e.g. the codec error behind ERR_INVALID_COMPRESSED_DATA for an entry imported from a corrupted zip file. The export used to replace the cause with an object holding the entry, a property that was not documented

• A read or write of the WebAssembly codec torn down before the end of the entry, by a cancelled readable, an aborted signal, a failing source, a corrupted body or a wrong password, kept its two 64 KB buffers and its zlib state in the 16 MB heap of the module in every browser, because the codec freed them in the cancel() hook of a TransformStream transformer, which Node.js and Deno call and no browser does. That codec runs for deflate when useCompressionStream is false or the host has no native "deflate-raw", and its AES engine runs for the encrypted entries, whose contexts live in the same heap. About 120 aborted inflates or 40 aborted deflates exhausted the heap of the worker, or of the page without workers, and every later entry failed with allocation failed. The bundled zlib-streams 1.2.3 frees them on any teardown, the AES streams release their engine context the same way, and the wrappers of the entry stream cancel the codec when their own read fails. On a page that loads web-streams-polyfill, which Firefox below 102 needs, such a read used to error without cancelling the codec, so the pair stayed allocated for the life of the page
• An empty rawPassword, i.e. an empty Uint8Array, means no raw password, like an empty password string. Reading an encrypted entry with one used to wait forever for a key that was never derived, and writing an entry with one used to encrypt it with an empty key, so it could not be read back with the password string passed next to it

• EntryError documents its entry property, and ERR_DUPLICATE_IMPORTED_ENTRY documents that its cause.entry holds the EntryMetaData of the entry that could not be imported

• New tests cover the password candidates, with the ZipCrypto false accept found by brute force on the encryption header, the entry and the cause carried by an export error, the WebAssembly buffers and the AES contexts released by aborted reads and writes on the browser matrix, the heap capacity of the module after those teardowns, and the empty raw password on both sides
• npm run test-deno-polyfill, part of npm run test-ci, runs the suite on Deno with web-streams-polyfill in place of the native streams, pipeTo() and pipeThrough() removed from the platform readables and CompressionStream and DecompressionStream removed, which is what the Firefox 79 job runs and the only way to reproduce a failure of that job on a developer machine
• The mangling audit of the test suite lists the internal fields whose name collides with a host property, e.g. a DOM one, and therefore ships unmangled. Four were renamed, with no API change
• The browser runner prints the message of a failing test with its stack

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.16.0...v2.16.1

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

September 21, 2026

• Added the layoutGroup event property that keeps related events on the same line in resourceTimeline views (674)
• Fixed an event id given as null or undefined being turned into a string

Special thanks to the following sponsors of EventСalendar:

@ekwi-tech @syncsynchalt @aurawindsurfing

• @docx-editor.dev/fonts@2.21.1

• 6a7b93a: Match Word when resolving paragraph breaks before tables, numbering-reference insertion history, and partial section-property history. Preserve protection and selected-decision boundaries, and expose structural operation details and accurate table/cell review anchors.

  Show structural decisions in the React and Vue review sidebars by default, with descriptive row, cell, merge, and numbering labels. Keep run/paragraph formatting in balloons while showing formatting without a painted anchor in the sidebar.

• Updated dependencies [6a7b93a]
  • @docx-editor.dev/i18n@2.21.1

• 6a7b93a: Match Word when resolving paragraph breaks before tables, numbering-reference insertion history, and partial section-property history. Preserve protection and selected-decision boundaries, and expose structural operation details and accurate table/cell review anchors.

  Show structural decisions in the React and Vue review sidebars by default, with descriptive row, cell, merge, and numbering labels. Keep run/paragraph formatting in balloons while showing formatting without a painted anchor in the sidebar.

• Updated dependencies [6a7b93a]
  • @docx-editor.dev/i18n@2.21.1