Release notes: 19–26 September 2026

A big week for OpenAPI 3.2. The API reference and API client now understand querystring parameters, custom HTTP methods through additionalOperations, the new dataValue and serializedValue examples, streaming item schemas, and OAuth device authorization. There is also a new Copy as Markdown button, API client translations, live streaming response views, and a batch of fixes and hardening. A few changes need attention when you upgrade; they are collected at the end.

Everything below comes from the changelogs of @scalar/api-reference and @scalar/api-client and the commit history of the monorepo for the week. Each item links to its pull request.

Versions released this week

Package	Versions	Release dates
@scalar/api-reference	1.70.0, 1.71.0, 1.72.0, 1.72.1	21, 22, 24 and 25 September
@scalar/api-client	3.19.3, 3.20.0, 3.21.0, 3.21.1	21, 22, 24 and 25 September

The integrations (ASP.NET Core, FastAPI, NestJS, Hono and the rest) pick up API reference changes through their normal releases.

OpenAPI 3.2 support

OpenAPI 3.2 adds several features that did not have a home in 3.1. This week, a lot of them landed in both the reference and the client.

• in: querystring parameters. A parameter can now describe the entire query string as one piece of content, for example a JSON object. The reference renders its schema, the client lets you edit the whole query string, and generated request URLs and code samples encode it correctly. Named query parameters keep their existing encoding when they sit alongside whole-query content. (#10189)
• additionalOperations and custom HTTP methods. Operations using methods outside the standard set, such as QUERY or PROPFIND, now appear in navigation, documentation, callbacks and the client, with their original spelling preserved when displayed, sent and turned into code samples. The client shows a clear error for methods browsers refuse to send (CONNECT, TRACE, TRACK), and request bodies are preserved for extension methods. (#10186)
• dataValue and serializedValue examples. Named parameters use these new example fields in the editor, in outgoing requests and in code samples, without encoding an already serialized value twice. Optional parameters with one of these examples are now enabled by default, matching the older value examples. (#10322) Example selection is shared across request bodies, response examples and snippets. (#10208)
• Streaming item schemas. Request body examples and schema views support 3.2 streaming item schemas, and generated examples are framed as JSON Lines, JSON Sequence or server-sent events. cURL snippets use --data-binary for streaming media types. (#10178)
• OAuth device authorization. The client supports the device authorization flow, with verification codes, cancellable token polling, stored credentials and OAuth metadata discovery. (#10191)
• XML examples. Examples are now generated from schema XML metadata, including attributes, namespaces, array wrappers and 3.2 text and CDATA nodes, and the same serialization is used for request bodies, code samples, response examples, mock responses and Markdown. (#10192)

Behind these, the workspace store and editor moved to OpenAPI 3.2 schemas while continuing to accept 3.1 documents. The editor offers 3.2 fields to documents that declare 3.1 as well; it does not certify that your document conforms to the version it declares. (#10177)

New in the API reference

• Copy as Markdown. Operations and webhooks have a Copy as Markdown button in both layouts, handy for pasting an endpoint into an issue, a pull request or a chat with an AI assistant. (#10222) It also respects document-defined additional operations. (#10186)
• expandAllParameters option. Defaults to true. Set it to false to start operation parameters collapsed and expand each one on click. (#10283)
• Searchable document selector. The multi-document selector gained title filtering and keyboard-friendly search. (#10269)
• Discriminator values in schema selectors. oneOf and anyOf selectors show discriminator mapping values next to schema names. (#10317)
• Response variant picker. Generated response examples with anyOf or oneOf variants get a picker. (#10203)
• Response example descriptions. Example summaries and descriptions are shown with their payloads. (#10249)
• AsyncAPI payload examples are generated from JSON Schema when no explicit example is provided. (#10217)
• SDK samples follow the example switcher. SDK code samples can be linked to named request body examples. (#10310)
• Clearer authentication tooltips, with separate headings, readable scheme types, and API key locations and names. (#10335)

New in the API client

• Live streaming responses. JSON Lines, JSON Sequences and multipart responses are displayed as they arrive instead of after the full response completes, with cancellation, malformed-record reporting and bounded display limits. (#10207)
• Translations. The client UI, including the client embedded in the API reference, can be translated through localization.translations.apiClient, and ships with English, Russian, Spanish, French, German, Simplified Chinese, Arabic and Portuguese. (#10175)

Performance

• The API client modal now loads the first time you open Test Request, not when the reference mounts, and shows loading feedback while it downloads. (#10284)
• The agent drawer and chat load when first opened. (#10287)
• External examples load on demand when they are visible or when Test Request opens, instead of all at once while the document loads. (#10240)

Fixes

API reference

• Nested object boundaries are preserved for properties composed from multiple allOf schemas. (#10336)
• enum values are intersected when merging allOf schemas, so inherited properties show only allowed values. (#10232)
• Deep-linked headings stay visible below sticky or fixed headers. (#10253)
• Sidebar navigation no longer scrolls past operations and models in themes with decorative backgrounds. (#10333)
• Server-rendered accordion headers, auth tables and the initial sidebar selection now hydrate correctly. (#10313)
• Colored x-badges pick black or white text from the background's lightness. (#10300)

API client

• Long response bodies stay scrollable in narrow layouts. (#10350)
• Optional form fields are included when you select files or edit values. (#10334)
• Optional header, query and cookie rows with a pre-populated default or enum value are enabled automatically instead of being silently dropped. (#10255)
• Typing a header, cookie or query parameter no longer creates duplicate rows or loses focus. (#10281)
• Parameter edits are preserved when another parameter changes. (#10303)

Security hardening

Several fixes this week harden how documents and configuration are handled. We recommend upgrading.

• Configuration data embedded in inline scripts is escaped in client-side rendering. (#10344)
• The workspace store prevents prototype pollution in nested object operations. (#10342)
• ts-deepmerge was updated in the object utilities to prevent method overrides. (#10338)
• The mock server restricts AsyncAPI external references. (#10343)
• Validation bounds union scoring depth, and trailing-dot encoding runs in linear time. (#10315, #10341)

Elsewhere in the monorepo

• The OpenAPI upgrader gained a best-effort upgrade mode, preserves Swagger 2.0 x-nullable, preserves semantics when upgrading to OpenAPI 3.2, and migrates tag groups to the 3.2 tag hierarchy. (#10346, #10306, #10211, #10276)
• The mock server supports streaming item schemas and document origins and exports. (#10176, #10286)
• JavaScript snippets preserve nested arrays. (#10305)
• OpenAPI-to-Markdown renders each shared schema once per page and preserves examples and schema details. (#10329, #10275)
• This blog now has an RSS feed. (#9984)

Upgrade notes

Most of this week is additive. Check these if they apply to you:

• Sticky headers on embedding sites (1.72.1). Scalar no longer discovers host page headers automatically when scrolling to content. If you embed the reference under your own fixed or sticky header, register it with the data-scalar-scroll-header attribute, or reserve its height with --scalar-custom-header-height. (#10333)
• XML snapshots (1.72.1, 3.21.1). Mock server XML responses now use the shared schema-aware serializer. If you snapshot XML responses in tests, expect them to change. (#10192)
• Custom HTTP method types (1.72.0, 3.21.0). Traversed operation methods use the exported OperationMethod type, which accepts custom strings. If you consume these types, handle unknown methods; exhaustive checks over a fixed method set no longer apply. (#10186)
• Optional parameters with examples (1.72.0, 3.21.0). Optional parameters with dataValue or serializedValue examples are enabled by default, so they are sent unless the user unchecks them. (#10322)
• Workspace store import paths (1.71.0, 3.20.0). The OpenAPI 3.1 loose-schema generator was removed from @scalar/workspace-store. Import from @scalar/workspace-store/schemas/v3.2/openapi/index and .../v3.2/openapi/reference instead. (#10177)
• Edited request bodies (1.71.0, 3.20.0). Editing a request body replaces an authored externalValue URL with the edited inline value in the workspace and exported API description. (#10208)

Found a problem after upgrading? Open an issue with the version and a minimal OpenAPI document, and we will take a look.

Related

• Learn: What is an API reference? · What is an API client?
• Docs: API reference configuration
• Product: API client — try this week's OpenAPI 3.2 support against your own document