• #9868: Control OAuth2 flow tabs from your OpenAPI document. Add x-order to a flow to set the order of the tabs in the auth section (the first tab is selected by default, so the lowest x-order also becomes the default flow), and add x-scalar-ignore to a flow to hide its tab — useful for flows that cannot run in the browser, like Client Credentials, which usually fails on CORS. x-scalar-ignore on a whole security scheme now hides it from the auth selector too.

• #9869: Show NDJSON responses instead of "Binary file". Responses with application/x-ndjson or application/ndjson are now rendered as text, with each JSON record pretty-printed in the preview.
• #9780: Make environment variables work in pre-request and post-response scripts. pm.environment.get() (and pm.variables.get()) now read the active environment, and pm.environment.set() / pm.environment.unset() persist back to it so values like a bearer token survive to the next request. Previously the script variable store was created empty per request and discarded afterwards, so scripted reads returned undefined and writes were lost even though {{variable}} placeholders resolved correctly.

• #9884: Export the AsyncAPI content components (AsyncApiChannel, AsyncApiOperation, AsyncApiMessage, AsyncApiTraversedEntry) from @scalar/api-reference/components so downstream renderers can render an individual channel/operation/message on its own page.

• #9856: Render model names as plain text when there is no models section to link to. The names next to types and on the request body heading used to be links even when the whole models section was hidden via hideModels, or when the referenced model itself was hidden via x-internal / x-scalar-ignore. There was nothing to scroll to, so clicking them did nothing. They now render as plain text in both cases.
• #9858: Only render a clickable model name link when the $ref actually targets #/components/schemas/. Refs into other component buckets (parameters, responses, ...) or external files now show the name as plain text instead of a dead link that scrolls nowhere.
• #9857: Fix dead model-name links for schemas grouped under a tag via x-tags. The models index now collects model entries from the whole navigation tree, so clicking a model name that lives under a tag group scrolls to the model instead of doing nothing.
• #9859: Fix empty popup when hovering the "Generate MCP" button without an MCP config
• #9862: Use the webhook icon for webhooks in search results so they are easy to tell apart from operations

• #9868: Control OAuth2 flow tabs from your OpenAPI document. Add x-order to a flow to set the order of the tabs in the auth section (the first tab is selected by default, so the lowest x-order also becomes the default flow), and add x-scalar-ignore to a flow to hide its tab — useful for flows that cannot run in the browser, like Client Credentials, which usually fails on CORS. x-scalar-ignore on a whole security scheme now hides it from the auth selector too.

• #9868: Control OAuth2 flow tabs from your OpenAPI document. Add x-order to a flow to set the order of the tabs in the auth section (the first tab is selected by default, so the lowest x-order also becomes the default flow), and add x-scalar-ignore to a flow to hide its tab — useful for flows that cannot run in the browser, like Client Credentials, which usually fails on CORS. x-scalar-ignore on a whole security scheme now hides it from the auth selector too.

• #9850: Add OpenAPI 3.2 schema definitions under schemas/v3.2 (a copy of the v3.1 strict and loose schemas) with the new 3.2 fields: tag summary/parent/kind, response summary and optional description, server name, security-scheme deprecated and OAuth2 oauth2MetadataUrl, the OAuth device authorization flow, root $self, path item query and additionalOperations, parameter in: querystring, media type itemSchema/prefixEncoding/itemEncoding/description, nested encoding, example dataValue/serializedValue, components mediaTypes, discriminator defaultMapping, and XML nodeType. The workspace store still uses the v3.1 schemas; this only adds the v3.2 set as groundwork.

• #9878: Do not send the chat message while an IME composition is in progress. Pressing Enter to confirm Japanese, Chinese, or Korean input used to send the message too early and drop part of the text (macOS Chrome and Safari). Enter now sends only once composition has finished.
• #9870: Remove a stray debug console.log from the response body view.
• #9869: Show NDJSON responses instead of "Binary file". Responses with application/x-ndjson or application/ndjson are now rendered as text, with each JSON record pretty-printed in the preview.

• #9838: Show a clearer error when a response is missing its description. Before, the validator reported the confusing must have required property '$ref' (or oneOf must match exactly one schema in oneOf) instead of pointing at the actual problem.

• GPU particles: re-bake gradient lookup textures in place for value edits - by increasinglyHuman (#18787)
• Fix Zstd-compressed UASTC textures failing to load (bytesPlane = 0) - by alexchuber (#18793)
• Fix NativeEngine command scope leaking when a render throws - by bkaradzic-microsoft (#18789)
• Fix WebGPU vertex layout pipeline cache collisions - [Bug Fix] by Popov72 (#18791)
• Feat: Stream Gaussian Splatting LOD as a part of a compound mesh - by raymondyfei (#18774)
• Fix: texture view leak on WebGPU backend - by raymondyfei (#18784)
• KHR_interactivity: importer update to the latest spec (refs, events, pointer selection, math ops) - by SergioRZMasson (#18615)
• feat(XR): support CPU depth sensing on WebGPU - [New Feature] by RaananW (#18782)
• Fix GreasedLine corrupting the shared TmpVectors scratch slot and Vector3.UpReadOnly - by bkaradzic-microsoft (#18781)
• Disable Space Warp before session creation - [Bug Fix] by RaananW (#18780)
• feat(XR): add WebGPU quad layer path - [New Feature] by RaananW (#18779)
• fix(XR): clear WebGPU AR projection textures - [Bug Fix] by RaananW (#18778)
• Fix Tools.LoadScript treating ES module source as a URL on Babylon Native - by bkaradzic-microsoft (#18776)

• Fix Reflector bridge relay dropping and crashing on client messages - [Bug Fix] by ryantrem (#18800)
• Inspector v2: sort particle gradients before refresh - [Bug Fix] by VicenteCartas (#18794)

• Make the glTF loader's unique root url actually unique - [Bug Fix] by bghgary (#18798)
• Feat: Stream Gaussian Splatting LOD as a part of a compound mesh - by raymondyfei (#18774)
• KHR_interactivity: importer update to the latest spec (refs, events, pointer selection, math ops) - by SergioRZMasson (#18615)

• KHR_interactivity: importer update to the latest spec (refs, events, pointer selection, math ops) - by SergioRZMasson (#18615)

• Enable Babylon Lite device-lost recovery in the Lite Viewer - [New Feature] by ryantrem (#18785)

• fix: make published crossProject BFF client declarations resolvable in consumers in https://github.com/web-infra-dev/modern.js/pull/8797

• fix: 修复发布后的 crossProject BFF 客户端声明在消费方项目中无法解析类型的问题， 详情可查看 https://github.com/web-infra-dev/modern.js/pull/8797

• New localExtraField option in ZipWriter#add() to write extra field records only in the local file header, complementing the extraField option which writes them in both the local file header and the central directory. This helps reproducing entries whose records appear only in the local file header, as written by some tools
• The Info-ZIP Unix type 1 extra field (0x5855), written notably by macOS Archive Utility and ditto, and the PKWARE Unix extra field (0x000d) are now read. They are exposed via the new extraFieldUnixType1 and extraFieldPkwareUnix properties of entries, and populate the lastModDate, lastAccessDate, uid and gid properties. The extended timestamp and NTFS extra fields still take precedence for the dates when present

• AES-encrypted entries added with passThrough set to true and a provided crc32 value are now marked as AE-1 and store the CRC-32 in the entry headers, instead of being written as AE-2 entries with zeroed CRC-32 fields. Copying an AE-1 entry read with the passThrough option no longer loses the stored CRC-32. Without the crc32 option, entries are still written as AE-2
• The export methods of the filesystem API, e.g. FS#exportBlob(), now forward the internal file attributes, the uid/gid values (written as an Info-ZIP Unix extra field, or as configured with unixExtraFieldType), and the custom extra field records of imported entries instead of dropping them
• The rawLastAccessDate and extraFieldUSDZ properties are now copied to the entries returned by ZipReader#getEntries(); they were parsed but missing from the entry objects

• The MIME type table is now generated at build time from a compact string encoding, reducing the builds embedding it by approximately 8.5KB when minified, e.g. index.min.js, without changing the results of getMimeType()
• The JSR package now only contains the files needed at runtime, shrinking it from 7.8MB (404 files) to 0.7MB (76 files), and all its entry points are now associated with the type declarations
• The browser test suites now run headlessly on Chrome, Firefox and WebKit with playwright. The WebKit suite adds Safari-engine coverage that did not exist before

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.8.44...v2.8.45

Fix some issues in devtools and persist middleware.

• fix(devtools): correct V8 stack regex when source path contains spaces by @dai-shi with @Copilot in https://github.com/pmndrs/zustand/pull/3531
• fix(persist): clearStorage() should invalidate concurrent async rehydration by @dai-shi with @Copilot in https://github.com/pmndrs/zustand/pull/3555

Full Changelog: https://github.com/pmndrs/zustand/compare/v5.0.14...v5.0.15

• Ads: Restrict click-through URIs to http(s) schemes (#10412) (66c6c4d)

• Ads: Restrict click-through URIs to http(s) schemes (#10412) (cac53ff)
• Only mark MSE append errors recoverable when the stream is disabled (#10409) (0d93077)
• UI: Align seek bar chapter markers with the playhead thumb (#10229) (aa283cc)

• Ads: Restrict click-through URIs to http(s) schemes (#10412) (44953fc)
• CMCD: Re-arm the reporter on every load() (#10416) (33edc15)
• Don't re-encode existing query parameters when appending new ones (#10415) (9f93f62)
• HLS: Fix audio/video desync in muxed TS segments mode (#10406) (26ed0a1), closes #10341
• Only mark MSE append errors recoverable when the stream is disabled (#10409) (4a0e440)
• UI: Align seek bar chapter markers with the playhead thumb (#10229) (bbbb2a4)

[!IMPORTANT] Vuetify Needs Your Support! The OpenCollective funds dried up. We are currently unable to compensate our contributors for their continued work on the framework and the ecosystem tools.

If Vuetify is part of your stack, please consider sponsoring the project so we can continue delivering updates and fixes.

Sponsor via Open Collective

Even if you look with optimism into the future (despite the sad economic reality), it is not responsible to keep your largest open source dependency in this poor financial state. Vuetify is on the borrowed time - if anything happens to maintainers primary employment, they are more likely to drop off.

Every contribution helps us keep Vuetify alive and signals to maintainers that their effort is appreciated.

Thank you.

---

• rounded: restore classes for side/corner values containing 0 (27962f3), closes #23090
• validation: consistently validate cleared fields (58b5537), closes #23084
• VDataTableVirtual: height accounting when expanding multiple rows (6f5f04b), closes #23014
• VSelect: focus correct item after opening with keyboard (Shadow DOM) (#23102) (8d15390), closes #23101
• VVirtualScroll: ignore zero-height items when estimating spacer (abe744e)

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/create-rari-app@0.5.22...create-rari-app@0.5.23