What scalar/scalar shipped

This week on Scalar: the proxy got upstream TLS verification, request timeouts, hop-by-hop header stripping, and cleaner error output, plus fixes for origin isolation and streaming uploads. The API client now shows nonstandard HTTP status codes.

This week on Scalar: the CORS proxy got a set of security and reliability fixes, including upstream TLS verification, bounded header and idle timeouts, stripping of hop-by-hop headers, rejection of recursive proxy requests, and fixed error categories so credentials stay out of logs. Proxied content can no longer act on the proxy origin, and uploads now stream with a bounded replay copy. The API client now displays nonstandard HTTP status codes, the API reference renders Paths and Path Item extensions, json-magic adds bundling with reference diagnostics, and the Java integration supports path routing and deep links.

This week: the scalar.com landing page was redesigned around agents and your API, the API reference gained a Halloween theme preset, and localhost got a developer toolbar with a side panel. Downloads are now named after the document title when no slug is set.

This week in Scalar: the landing page was redesigned to tell one story, an agent meets your API, from docs to SDKs to acting users' agents. The API reference gained a Halloween theme preset with a moonlit sky, bats and pumpkin accents. On localhost, a developer toolbar with a side panel for its tools was added. Downloads are now named after the document title when no slug is set, AsyncAPI metadata rendering was improved, and the SDK generator docs gained a webhooks guide.

ScalarCodeBlock now runs on the smaller @scalar/highlight package. api-reference 1.76.0 adds Copy as Markdown for AsyncAPI channels and operations, and bundle mappings no longer allow prototype pollution. URL routing is now optional for embeds.

This week: ScalarCodeBlock moved to @scalar/highlight, a smaller state-machine highlighter. @scalar/api-reference 1.76.0 shipped with Copy as Markdown buttons for AsyncAPI channels and operations and operation-level payload examples. We fixed prototype pollution in bundle mappings, made the showDeveloperTools opt-out hide Generate SDK buttons on localhost, and added a urlRouting option so embedded references leave host page URLs and Back/Forward navigation alone. The desktop app now closes the active tab on CmdOrCtrl+W and closes the window on the last tab. Page feedback is on by default on scalar.com, off on 19 marketing pages.

This week: @scalar/api-reference 1.75.0 with AsyncAPI replies and tags, a new opt-in Mermaid plugin, AsyncAPI to Markdown export, and safer defaults for document loading and OAuth URLs.

This week's work on Scalar: @scalar/api-reference 1.75.0 renders AsyncAPI operation replies and AsyncAPI tags, including trait tags. AsyncAPI coverage widened with protocol bindings, non-JSON schemas shown as source, external documentation, discriminator variants, channel parameters and message content types. A new @scalar/asyncapi-to-markdown package exports AsyncAPI descriptions as Markdown. There is also an opt-in @scalar/mermaid-plugin for fenced diagrams in API Reference Markdown. On safety, server workspace and openapi-to-markdown document loading now block private-network requests by default and require an explicit base path for local files, the mock server rejects non-HTTP(S) OAuth callbacks, and the API client validates OAuth authorization URLs.

Java, Kotlin and Ruby SDK targets are now generally available. This week also brought a Generate SDK button for local development, Traditional Chinese localization, cookie Max-Age precedence fixes, and.NET options for schema display, localization and OAuth device authorization.

This week the SDK generator moved three targets forward: Java, Kotlin and Ruby are now generally available. The API Reference added a Generate SDK button for local development, matching the existing Generate MCP entry point, and gained Taiwan Traditional Chinese localization. AsyncAPI rendering now shows channels and messages that no operation referenced, along with a channel messages catalog and server metadata. On the client side, cookie Max-Age now takes precedence over Expires, and global cookie path matching respects path boundaries. The.NET integration gained native configuration for schema display, localization, featured HTTP clients and OAuth device authorization. Documentation was also corrected in several places that described behaviour the build does not have.

This week: AsyncAPI channels load in chunks, API Reference hides model names and controls visible properties, multipart uploads preserve binaries, and Markdown exports scale to readability.

Scalar shipped performance wins this week: AsyncAPI references load in chunks for faster pages, parameter examples stop re-walking schema graphs, code highlighting reuses instances, and search building reuses schema fields. Configuration got easier with hideModelNames, maxVisibleRequestBodyProperties, and custom extension display. Markdown exports improved for readability without schema repetition.

Scalar ships OpenAPI 3.2 querystring and additionalOperations support, XML example generation, desktop login fixes, and security patches for prototype pollution and external references.

This week Scalar added OpenAPI 3.2 support for querystring parameters and additionalOperations across the API client, reference, and mock server. Security improvements prevent prototype pollution in nested object operations and restrict AsyncAPI external references. Performance optimizations reduce memory usage when processing large API descriptions. An interactive SDK Generator demo now appears on the overview page, and desktop login no longer conflicts with port 3000.

Markdown generation 1.4–9.5x faster, workspace store cheaper on reads, AsyncAPI examples in the reference, and OpenAPI 3.2 QUERY support shipping this week.

This week: @scalar/openapi-to-markdown hits 1.0 with direct syntax tree rendering (1.4–9.5x faster, 26–67% less memory). Workspace store optimizations cut allocations on every property read. API client gains line wrapping for long values, auto-generated examples from schemas, and response interception. API reference now handles AsyncAPI message examples and traits. OpenAPI 3.2 QUERY method support lands in the client.