swagger-api/swagger-ui

This system is Swagger UI, a web-based interface for visualizing and interacting with OpenAPI specifications. It renders API documentation with features for executing operations, managing authentication flows like OAuth2 and OIDC, and generating request snippets. The application supports multiple specification versions (Swagger 2.0, OpenAPI 3.0, 3.1, and 3.2) and provides a plugin-based architecture for extensibility, including a React component wrapper and Docker deployment options.

27 changes.

The project underwent a comprehensive architectural overhaul, restructuring the core library into a modular plugin system and migrating the UI to React 18. This period focused on implementing full OpenAPI 3 support, including new components for request bodies, callbacks, and OAuth2/OIDC authentication, while modernizing the build toolchain and styling infrastructure.

33 changes.

This period focused on modernizing the project by introducing a dedicated React component wrapper and upgrading the build system to Webpack 5 for native ESM support. Significant effort was also directed toward establishing a robust testing ecosystem, migrating unit tests to Jest and implementing comprehensive end-to-end test suites with Cypress and Selenium.

33 changes.

This period focused on implementing native support for OpenAPI 3.1 and the JSON Schema 2020-12 specification, including new rendering engines, component wrappers, and sample generation logic. The work also introduced usability features such as request snippets, dark mode, and mutual TLS authentication, while significantly expanding end-to-end test coverage and hardening security defaults.

14 changes.

This period focused on introducing native support for OpenAPI Specification 3.2.0, including the new QUERY method and JSON Schema 2020-12 rendering, while consolidating syntax highlighting and JSON Schema 5 logic into dedicated plugins. Significant improvements were made to accessibility through a skip-to-operations link and accessible copy buttons, alongside a robust refactoring of the configuration system with strict type casting. Comprehensive end-to-end and unit tests were added to verify these new features and ensure correct behavior across OpenAPI 3.x variants.

Introduces a new HttpAuth React component for the OAS3 plugin that renders input fields for HTTP Basic (username/password) and Bearer token authentication schemes. This component handles state management for credentials, displays authorization status, and includes accessibility improvements by associating HTML labels with their respective input fields via htmlFor and id attributes.

src/core/plugins/oas3/components/auth · high confidence

The new Icons plugin introduces a set of reusable SVG icon components (ArrowUp, ArrowDown, Arrow, Close, Lock, Unlock) that accept standard props like className, width, and height, along with arbitrary additional props passed via spread syntax. These components are registered in the plugin's index, making them available for use throughout the application while ensuring proper accessibility attributes like aria-hidden and focusable are set.

src/core/plugins/icons · high confidence

The \src/core/plugins/oas31/components\ directory now contains the specific React components required to render OpenAPI 3.1.0 definitions. This includes a \VersionPragmaFilter\ that explicitly recognizes and supports the \openapi: 3.1.x\ version field, an \Info\ component that renders the new \jsonSchemaDialect\ field (displaying a warning if a non-default dialect is used), and dedicated \Contact\, \License\, and \Webhooks\ components. These changes enable the UI to correctly parse and display metadata and webhook operations defined in OpenAPI 3.1 specifications.

src/core/plugins/oas31/components · high confidence

This change introduces a new plugin for OpenAPI Specification 3.2.x, enabling the UI to recognize and render specs with \openapi: 3.2.x\. It adds support for the new \QUERY\ HTTP method, displays the \info.summary\ field, and updates schema rendering to use JSON Schema 2020-12 (including \description\ and \properties\ keywords). The plugin also improves file-upload detection by supporting \contentMediaType\ and \contentEncoding\, and ensures version-pragma filters correctly handle OAS 3.2 definitions.

src/core/plugins/oas32 · high confidence

The top-bar plugin now includes a DarkModeToggle component that allows users to switch between light and dark themes, respecting the system's color scheme preference on initial load. This feature is supported by new SVG assets (lightbulb and lightbulb-off icons) and a Logo component, all wired together in the new TopBar component which integrates these elements into the application header.

src/standalone/plugins/top-bar · high confidence

Users can now skip directly to the API operations section using a new 'Skip to operations' link, which is registered as a component in the accessibility plugin. This enhancement improves keyboard navigation by allowing users to bypass introductory content and focus immediately on the available API endpoints.

src/core/plugins/accessibility · high confidence

A new plugin has been introduced that allows users to register an \onComplete\ callback via the configuration options. This callback is automatically invoked after the specification is updated (either via \updateSpec\ or \updateJsonSpec\), with a slight delay to ensure the DOM has reconciled before the user is notified.

src/core/plugins/on-complete · high confidence

The SwaggerUI global symbol now exposes its internal plugins and presets, allowing users to inspect or extend the UI's configuration at runtime. This change introduces the \downloadUrlPlugin\ for fetching and loading remote specifications with improved error handling for CORS and mixed-content issues, the \FormComponentsPlugin\ to expose layout utilities, and the \StandalonePreset\ which bundles the standalone-specific components like the top bar and layout.

src/core/plugins/download-url, src/core/presets/base/plugins/form-components, src/standalone · high confidence

This change introduces the foundational \spec\ plugin, establishing the core state management architecture for the Swagger UI application. It adds the \actions.js\ module to handle specification updates, URL changes, and request/response lifecycle events; \reducers.js\ to manage the immutable state of the parsed JSON spec, resolved subtrees, and parameter metadata; \selectors.js\ to provide accessors for spec data, operations, and security definitions; and \wrap-actions.js\ to intercept and extend default behaviors like spec parsing and resolution. This plugin serves as the central hub for all specification-related data flow.

src/core/plugins/spec · high confidence

The \dist\ directory now contains the complete static build for Swagger UI, including the main entry point \index.html\, the core stylesheet \index.css\, and the bundled JavaScript files (\swagger-ui-bundle.js\, \swagger-ui-standalone-preset.js\, \swagger-initializer.js\). This release introduces a dedicated \oauth2-redirect.html\ and its associated script to handle OAuth2 authorization code flow redirects, and the default configuration in \swagger-initializer.js\ is set to load the Petstore specification with deep linking enabled and the StandaloneLayout.

dist · high confidence

This change introduces the \src/core/plugins/oas3\ plugin, establishing a dedicated state management layer for OpenAPI 3 specifications. It adds new Redux actions, reducers, and selectors to handle OAS3-specific features, including server variable management, request body value tracking (with retention flags), content type selection, and active example switching. The plugin also implements validation logic for required request bodies and provides helper functions to detect file uploads and distinguish between OAS 3.0 and Swagger 2.0 specs, enabling the UI to correctly manage Try-It-Out interactions for OpenAPI 3 documents.

src/core/plugins/oas3 · high confidence

This change introduces the \swagger-ui-react\ flavor, providing a React component wrapper for Swagger UI. The component accepts configuration props such as \spec\, \url\, \plugins\, \presets\, \oauth2RedirectUrl\, and \persistAuthorization\, mapping them to the underlying Swagger UI instance. It also exposes static properties for presets, plugins, and configuration, and includes documentation on anonymized analytics collection via Scarf.

flavors/swagger-ui-react · high confidence

Adds a new layout plugin that manages UI state for the specification view, including the ability to filter displayed operations by tag and limit the number of displayed tags via configuration. It also introduces a mode system to handle branch nodes and provides selectors to determine visibility and current mode for layout elements.

src/core/plugins/layout · high confidence

Adds a new request-snippets plugin that provides a UI component for displaying and copying executable cURL snippets for the current operation. The plugin exposes generators for bash, Windows CMD, and PowerShell, handling proper escaping for shell-specific characters and supporting multipart form data uploads (including file objects) and binary/base64 encoded bodies. It includes selectors to manage the list of available languages, the active snippet language, and the default expanded state, allowing users to easily switch between shell variants and copy the generated command to their clipboard.

src/core/plugins/request-snippets · high confidence

A new standalone layout plugin has been added to structure the Swagger UI application shell. This includes a new StandaloneLayout component that renders the core UI structure, notably integrating a SkipToOperations component to enhance keyboard accessibility for users navigating to API operations. The layout also ensures the Topbar, BaseLayout, and OnlineValidatorBadge are correctly rendered within the main container.

src/standalone/plugins/stadalone-layout · high confidence

The safe-render plugin now wraps a defined set of core UI components (such as App, BaseLayout, Operations, and Models) with an ErrorBoundary. If any of these components fail to render, the user sees a generic fallback message instead of a broken interface, and the error details are logged to the browser console. This change improves application stability by preventing render errors in critical parts of the UI from crashing the entire page.

src/core/plugins/safe-render · high confidence

This change adds a new \oas31\ plugin that provides native support for OpenAPI 3.1.0 specifications. It introduces a dedicated rendering engine for JSON Schema 2020-12, enabling the display of new Schema Object keywords such as \discriminator\, \xml\, \externalDocs\, and \example\. The plugin also adds specific components for OpenAPI 3.1 features like Webhooks and the \jsonSchemaDialect\ field, while wrapping existing core components (Info, License, Contact, Models) to handle 3.1-specific behaviors and selectors.

src/core/plugins/oas31 · high confidence

A new preset at src/core/presets/apis/index.js is now available that bundles the base preset with plugins for OpenAPI 3.0, 3.1, and 3.2, as well as JSON Schema 2020-12 and its samples generator. This preset allows users to enable support for these specification versions and schema standards in a single configuration, with OpenAPI 3.2 loaded last to ensure it takes precedence over earlier versions.

src/core/presets/apis · high confidence

The \src/core/plugins/json-schema-2020-12/components\ directory now contains the React components and styles that power the new JSON Schema 2020-12 UI. This includes the \JSONSchema\ component for rendering schema definitions, \JSONViewer\ for displaying values, and \Accordion\/\ExpandDeepButton\ for interactive expansion. It also introduces specific keyword components (e.g., \$defs\, \AllOf\, \AnyOf\, \Constraint\) to visualize JSON Schema 2020-12 features like definitions, logical operators, and validation constraints.

src/core/plugins/json-schema-2020-12/components · high confidence

The \src/core/plugins/json-schema-2020-12\ directory now contains a complete, new rendering engine for JSON Schema 2020-12. This plugin introduces a React-based component hierarchy (including \JSONSchema\, \Keyword\*\ components, and UI helpers like \Accordion\) and a functional core (\fn.js\) that handles type inference, title generation, and expandability logic. It provides the necessary React contexts (\JSONSchemaContext\, etc.) and hooks (\useIsExpanded\, \usePath\) to manage the state of schema expansion and path tracking, effectively replacing or augmenting previous schema rendering capabilities with full support for 2020-12 keywords.

src/core/plugins/json-schema-2020-12 · high confidence

The \json-schema-2020-12-samples\ plugin introduces a new engine for generating example values from JSON Schema 2020-12 definitions. This location provides the core implementation, including registries for content encoders (e.g., base64, binary), data formats (e.g., int32, email, uuid), and media types (e.g., application/json, text/xml). It also exposes an option API for configuration and a schema merging mechanism, enabling the system to produce structured samples for JSON, YAML, and XML content types based on the updated schema specification.

src/core/plugins/json-schema-2020-12-samples · high confidence

This change introduces the \json-schema-5-samples\ plugin, which provides a new mechanism for generating example values from JSON Schema definitions. The plugin exposes functions to generate samples in JSON, YAML, and XML formats, handling content-type routing and serialization (e.g., stringifying JSON objects, converting to YAML with specific line-width settings, and generating XML with root element name resolution). It also includes a JSON Schema merging utility (\mergeJsonSchema\) to combine \oneOf\/\anyOf\ schemas and primitives for generating realistic sample data (dates, times, UUIDs, etc.), along with a fix to mitigate ReDoS risks when generating strings from regex patterns.

src/core/plugins/json-schema-5-samples · high confidence

The \src/core/plugins/oas3/components\ directory now contains the concrete React components that power OpenAPI 3.x UI features. The \Callbacks\ component renders callback operations (with \Try It Out\ disabled) using the \OperationContainer\. The \OperationServers\ component displays server selection and variable inputs specific to an operation or path, distinguishing them from global servers. The \Servers\ and \ServersContainer\ components handle the global server dropdown and variable editing. The \RequestBody\ and \RequestBodyEditor\ components manage the display and editing of request bodies, including file uploads, form-encoded data, and example selection. The \OperationLink\ component renders OpenAPI 3.1 operation links. These components are exported via \index.js\ to be registered with the Swagger UI component system.

src/core/plugins/oas3/components · high confidence

The \src/core/components/parameters\ directory introduces a new \Parameters\ React component that renders operation parameters in a grouped table format (grouped by location such as query, header, etc.) and integrates with the Try-It-Out workflow. For OpenAPI 3 (OAS3) specs, it adds a tabbed interface supporting both Parameters and Callbacks, and implements logic to manage request body state—specifically clearing responses and requests when the media type changes, while respecting user edits to retain body values. It also exposes props for controlling try-out behavior and resetting parameters.

src/core/components/parameters · high confidence

A new filter plugin has been introduced in the core plugin system, providing an \opsFilter\ function that allows users to filter tagged operations based on a specific phrase. This enables more granular control over which operations are included or excluded based on their tags.

src/core/plugins/filter · high confidence

The OpenAPI 3.1 plugin now includes dedicated React components to render specific JSON Schema 2020-12 keywords within the UI. This change adds support for displaying the \description\ as markdown, \example\ values via a JSON viewer, \externalDocs\ with expandable URL and description details, \xml\ serialization attributes (name, namespace, prefix, wrapped), \properties\ with required status and dependent requirements, and generic OpenAPI extensions. These components enable the interface to correctly visualize these schema structures when browsing OpenAPI 3.1 specifications.

src/core/plugins/oas31/json-schema-2020-12-extensions/components/keywords · high confidence

The dev-helpers directory now provides a complete, self-contained setup for running a local Swagger UI instance. This includes an HTML entry point (index.html) that loads the UI bundle and a dedicated initializer script (dev-helper-initializer.js) which configures the UI with default Petstore settings and OAuth2 credentials. An updated OAuth2 redirect handler (oauth2-redirect.js) now explicitly supports the 'authorization\_code' flow alongside existing flows, ensuring proper state validation and callback handling during authentication. These changes allow developers to easily spin up a local development environment with pre-configured authentication flows without modifying the core application code.

dev-helpers · high confidence

This change introduces a new set of component wrappers in the OAS 3.1 plugin that adapt core UI components to support OpenAPI 3.1 features. The Model and Models wrappers now render schemas using the JSON Schema 2020-12 engine, applying specific configuration for dialects, expansion levels, and read-only/write-only inclusion. Additionally, new wrappers for Auth, Auths, Contact, Info, License, and VersionPragmaFilter delegate to OpenAPI 3.1-specific implementations, with the Auth wrapper specifically enabling support for mutual TLS authentication.

src/core/plugins/oas31/wrap-components · high confidence

The UI now renders the \discriminator\ keyword for Schema Objects in OpenAPI 3.1 specifications. This change adds new components (\Discriminator\ and \DiscriminatorMapping\) that display the discriminator's \propertyName\ and iterate over any defined \mapping\ entries. The component also supports displaying OpenAPI 3.1 extensions on the discriminator object and integrates with the existing JSON Schema 2020-12 expansion and path context systems.

src/core/plugins/oas31/json-schema-2020-12-extensions/components/keywords/Discriminator · high confidence

The OAS3 auth extension now translates OpenAPI 3 security definitions into a format compatible with the existing authorization UI. This includes full support for OAuth 2.0 flows (converting \oauth2\ types with multiple flows into individual entries) and new support for OpenID Connect (\openIdConnect\) by extracting authorization and token endpoints from the OIDC discovery document. HTTP and API Key security schemes remain supported as before, ensuring a consistent authorization experience across different OpenAPI 3 security types.

src/core/plugins/oas3/auth-extensions · high confidence

The OAS 3.1 authentication UI now recognizes and displays the new 'mutualTLS' security scheme type. When a spec defines mutualTLS requirements, the interface renders a dedicated section explaining that certificates are managed via the OS or browser, allowing users to view these security definitions alongside existing OAuth2 and other auth types.

src/core/plugins/oas31/components/auth · high confidence

OpenAPI 3.1 specifications can now utilize mutualTLS (mTLS) as an authentication scheme. The system's security definitions selector has been extended to recognize and include 'mutualTLS' type definitions, ensuring they are available for authorization. Additionally, a new wrapper component for OAS 3.0 handles HTTP authentication types, rendering the standard HttpAuth component for 'http' schemes while passing through other types to the original implementation.

src/core/plugins/oas3/wrap-components/auth, src/core/plugins/oas31/auth-extensions · high confidence

The syntax highlighting feature has been consolidated into a dedicated plugin that registers supported languages (JSON, JavaScript, XML, YAML, HTTP, Bash, PowerShell) and provides configurable themes (Agate, Art, Monokai, Nord, Obsidian, Tomorrow Night, Idea). The new HighlightCode component includes copy-to-clipboard buttons with proper aria-labels for accessibility, and the system now respects the 'syntaxHighlight.activated' configuration to toggle between highlighted code and plain text viewing.

src/core/plugins/syntax-highlighting · high confidence

The legacy \src/main/html/index.html\ entry point and the bundled \jquery-1.6.2.min.js\ library have been removed from the distribution. This change eliminates the old static HTML skeleton and the specific jQuery version it relied upon, indicating a shift in how the UI is served or initialized (likely moving to a modern build process or a different entry point not included in this diff).

src/main · high confidence

The Docker entrypoint script for Swagger UI has been updated to disable embedding the UI in frames or iframes from different origins by default. This change improves security by preventing clickjacking attacks; users who require embedding functionality must now explicitly set the EMBEDDING environment variable to 'true'.

docker/docker-entrypoint.d · high confidence

The core library has been restructured to use a plugin and preset system, centralizing initialization in \src/core/index.js\ which now registers plugins like \Configs\, \Auth\, and \View\ via the \System\ class. This change introduces a \VersionsPlugin\ that exposes SwaggerUI build metadata (version, git commit, build time) on the global \window.versions\ object, and a \LogsPlugin\ that provides a configurable logging utility. Additionally, a \ViewLegacyPlugin\ is added to support React versions 16 and 17 using \ReactDOM.render\, ensuring backward compatibility.

src/core · high confidence

Added new container components (OperationContainer, AuthorizeBtnContainer, FilterContainer, InfoContainer) in src/core/containers to handle state mapping and action dispatching for their respective UI presentational components. This refactoring separates data fetching and state management logic from the view layer, improving maintainability and enabling better integration with the application's state management system.

src/core/containers · high confidence

The configuration management plugin has been relocated from its previous location into the core \src/core/plugins/configs\ directory. This structural change consolidates the handling of application settings, including the logic for fetching remote configurations, parsing YAML, and managing state updates, within the core plugin system.

src/core/plugins/configs · high confidence

This change introduces a comprehensive set of configuration files that modernize the development environment and build toolchain. It adds TypeScript support via a new \tsconfig.json\ and ESLint configuration, standardizes code formatting with \.prettierrc.yaml\ and \.editorconfig\, and establishes commit message conventions using \.commitlintrc.json\. The repository also updates its release automation to use semantic-release targeting the \main\ branch, enforces strict npm installation rules via \.npmrc\, and updates the Dockerfile to use \nginx:1.31.5-alpine\ with pinned, non-vulnerable system libraries. Additionally, it adds a \CLAUDE.md\ guide for AI assistants and updates the default Node.js version to 24.21.

(repo-wide) · high confidence

The release workflow is now automated using the \release-it\ tool, configured via a new \.release-it.json\ file. This setup introduces a pre-release hook that checks for breaking changes (aborting unless \BREAKING\_OKAY\ is set), updates the \swagger-client\ dependency, and runs tests before bumping the version. Post-release, it builds the project and creates a draft GitHub release with a changelog generated by a new shell script that categorizes commits by type (features, improvements, fixes).

release · high confidence

The visual presentation of the Swagger UI has been completely redesigned and restructured. The legacy LESS stylesheets have been removed and replaced with a new, modular SCSS architecture (split into files like \_variables.scss, \_buttons.scss, \_form.scss, etc.) that is loaded via the main entry point. This update introduces a native dark mode, activated via the \.dark-mode\ class on the HTML element, which provides a comprehensive set of color variables and styles for all UI components. Additionally, the layout and form elements now utilize CSS container queries for improved responsiveness, and accessibility has been enhanced with support for High Contrast Mode (HCM) and semantic HTML adjustments.

src/style · high confidence

The JSON Schema 5 rendering logic has been consolidated into a dedicated plugin, introducing a new set of React components (including Model, ObjectModel, ArrayModel, PrimitiveModel, and EnumModel) to display schemas and their examples. To improve performance when many schemas are present, the Models list now uses virtualization (via @tanstack/react-virtual) to render only visible items. Additionally, the schema type detection logic has been refactored into a shared utility function, and the model titles now use semantic \<strong\> tags for better accessibility.

src/core/plugins/json-schema-5 · high confidence

The \src/core/components\ directory has been refactored to use new, standalone component files (e.g., \app.jsx\, \execute.jsx\, \live-response.jsx\, \deep-link.jsx\). This change restructures the internal rendering logic for the Swagger UI interface, including how operations are executed, how responses are displayed, and how deep links are handled, without altering the external API or configuration options.

src/core/components · high confidence

The deep-linking plugin now automatically updates the browser's URL fragment (hash) to reflect the current visibility state of tags and operations. When a user expands or collapses a tag or operation, the hash is updated to include the relevant identifiers (e.g., \\#/operations/tagId/operationId\), allowing users to bookmark or share specific UI states. This behavior is driven by new \OperationWrapper\ and \OperationTagWrapper\ components that register scrollable elements with the layout system, and a \setHash\ helper that manages the URL history. The plugin also handles parsing these hashes on load to restore the correct expanded/collapsed state, including support for UTF-16 encoded characters in tags and IDs.

src/core/plugins/deep-linking · high confidence

The Docker Nginx setup has been restructured to use templating for environment variables and introduces new configuration files to improve security and caching behavior. A new \cors.conf\ handles Cross-Origin Resource Sharing headers, while \embedding.conf\ adds X-Frame-Options and Content-Security-Policy headers to prevent the UI from being embedded in iframes by default. The main \default.conf.template\ now explicitly sets cache-control headers to prevent caching of JSON, YAML, and YML assets, and configures gzip compression for static files.

docker · high confidence

The OpenAPI 3.1 plugin now correctly identifies file upload inputs when a schema includes a \contentMediaType\ or \contentEncoding\ property, in addition to the existing checks for \type: string\ with \format: binary/byte\. This ensures that file upload UI controls are displayed for schemas adhering to the OpenAPI 3.1 specification's handling of encoded content.

src/core/plugins/oas31/oas3-extensions · high confidence

The .husky directory now contains explicit shell scripts for commit-msg and pre-commit hooks. The commit-msg hook runs npx commitlint -e to validate commit messages, and the pre-commit hook runs npx lint-staged to execute staged file linters. This change reflects an update to the Husky setup, likely aligning with the version bump from 8.0.3 to 9.0.10, by using npx to invoke the tools rather than relying on global or local binary paths directly.

.husky · medium confidence

The layout rendering structure is reorganized by introducing two new core components: \BaseLayout\ and \XPane\. \BaseLayout\ serves as the primary container for the standard Swagger UI view, handling loading states, error display, and the arrangement of information, servers, schemes, operations, and models. \XPane\ provides an alternative layout specifically for the editor experience, featuring a split view with an overview, an editable code editor, and operations, along with controls to toggle the editor visibility. These components replace the previous monolithic layout logic, providing a more modular foundation for the UI.

src/core/components/layouts · high confidence

The Docker image now supports a full-spectrum runtime configuration system that injects Swagger UI settings via environment variables. This new mechanism replaces static code with configured data by injecting a changeable configuration block into the Swagger UI initializer, allowing users to control settings like OAuth2 credentials, PKCE support, and basic auth via environment variables. The implementation includes a security fix that disables reading config parameters from URL search params to prevent potential information leakage, and adds support for persisting authorization variables. Additionally, the system provides helpful error messages if injection fails, guiding users to add the required markers to their custom HTML/JavaScript.

docker/configurator · high confidence

The error-transformers module has been introduced to standardize and improve the readability of validation error messages. This change adds a new system where errors are processed through specific transformers before being stored; currently, this includes a transformer that rephrases JSON Schema 'not of a type' errors into more user-friendly language (e.g., changing 'is not of a type(s)' to 'should be a... or...'). A second transformer for 'parameter-oneof' errors is also included but remains disabled pending further implementation. This modular approach allows for cleaner, more helpful error reporting in the UI.

src/core/plugins/err/error-transformers · high confidence

The project now enforces that source code does not import extraneous (non-dev) dependencies via a new ESLint rule in src/.eslintrc, and exposes a clean public API entry point in src/index.js that re-exports the core SwaggerUI module.

src · high confidence

The project has migrated its unit testing framework to Jest, introducing two new configuration files in the \config/jest\ directory: \jest.unit.config.js\ for general unit tests and \jest.artifact.config.js\ for build-artifact tests. This change establishes a structured testing environment using \jest-environment-jsdom\, includes specific setup files (\jest-shim.js\ and \setup.js\), and configures module name mappings for SVGs and standalone resources. It also sets up transformation ignore patterns to ensure compatibility with specific dependencies like \sinon\, \react-syntax-highlighter\, and \@asamuzakjp/css-color\.

config/jest · high confidence

The view plugin has been refactored to support React 18 by utilizing \ReactDOM.createRoot\ for rendering, replacing the legacy root API. To address performance concerns, \getComponent\ and \makeMappedContainer\ are now memoized to prevent unnecessary re-renders and calculation overhead. The implementation also introduces lifecycle method prefixes (e.g., \UNSAFE\_componentWillReceiveProps\) to align with React 18 deprecations and adds a \getDisplayName\ utility to improve component debugging and identification.

src/core/plugins/view · high confidence

The \flavors/swagger-ui-react/release\ directory now contains the build and packaging scripts (\run.sh\, \create-manifest.js\, \template.json\) used to generate the \swagger-ui-react\ npm package. This infrastructure merges the core Swagger UI distribution files with a custom manifest that removes internal dependencies, defines ESM/CommonJS entry points, and enforces React 16.8–19 as peer dependencies, ensuring the released package is properly structured for consumption.

flavors/swagger-ui-react/release · high confidence

The Markdown rendering logic has been extracted into a dedicated provider component (\src/core/components/providers/markdown.jsx\) that uses a scoped DOMPurify instance to prevent global state mutation. This change enforces stricter security by default: it disables smart quotes and replacements, forbids \style\ and \form\ tags, and adds \rel="noopener noreferrer"\ to links. It also introduces a deprecation warning for the \useUnsafeMarkdown\ config option, which previously allowed more permissive sanitization.

src/core/components/providers · high confidence

A new plugin at src/core/plugins/util/index.js has been added to centralize and expose common utility functions. This plugin makes the shallowEqualKeys comparison function and the sanitizeUrl URL sanitization function available via the plugin's fn namespace, allowing other parts of the application to access these utilities through a standardized interface.

src/core/plugins/util · high confidence

The model display for OpenAPI Specification 3.1 has been updated to utilize the JSON Schema 2020-12 rendering engine. This change introduces a new React component and associated SCSS styles that specifically target JSON Schema 2020-12 elements, ensuring that schema objects in operations and webhooks are presented with the correct visual hierarchy and styling defined for the 2020-12 standard.

src/core/plugins/oas31/components/model · high confidence

This change introduces the selector layer for the OpenAPI 3.1 spec-extension plugin. It adds new selectors to extract and resolve OAS 3.1-specific fields such as \webhooks\, \license\, \contact\, \info\, \externalDocs\, \jsonSchemaDialect\, and \components.schemas\, ensuring they are properly resolved and formatted for rendering. Additionally, it provides a selector wrapper (\wrap-selectors.js\) that ensures OAS 3.1 specific selectors are used when the spec is identified as OAS 3.1, falling back to standard OAS 3 behavior otherwise.

src/core/plugins/oas31/spec-extensions · high confidence

The OAS3 plugin now provides dedicated selectors for servers, security definitions, and schema lookups, ensuring that Swagger 2-specific fields (host, basePath, consumes, produces, schemes) return null for OpenAPI 3 specs. This change enables correct rendering of OAS3 features like callbacks and webhooks by isolating OAS3-specific logic from Swagger 2 behavior.

src/core/plugins/oas3/spec-extensions · high confidence

The OAS3 plugin now provides a set of wrapped core components to tailor the UI for OpenAPI 3 specifications. File uploads for string schemas with the 'binary' format are now handled via a dedicated file input. Markdown rendering is stricter, rejecting non-string inputs and enabling GitHub Flavored Markdown tables. Model displays now explicitly highlight deprecated schemas. The online validator badge is re-enabled for OAS3, and the OpenAPI version indicator is set to '3.0'.

src/core/plugins/oas3/wrap-components · high confidence

The authentication plugin now allows OAuth2 password flow requests to include \client\_id\ and \client\_secret\ within the form body, in addition to the existing support for HTTP Basic authentication headers. This change enables compatibility with OAuth2 servers that require client credentials to be sent as form parameters rather than in the Authorization header. The implementation also introduces a \passwordType\ configuration option to select between 'request-body' and 'basic' modes, and ensures that the \client\_id\ and \client\_secret\ are correctly passed to the token endpoint based on this setting.

src/core/plugins/auth · high confidence

The swagger-ui-dist package now exports the absolute path utility as a function named \getAbsoluteFSPath\ (while retaining the legacy \absolutePath\ property for backward compatibility). This function is browser-safe: it returns the absolute file system path when executed in Node.js, but throws a descriptive error if called in a browser environment, preventing silent failures. Additionally, the main entry point (\index.js\) now wraps the loading of Swagger UI bundles in a try/catch block to gracefully handle missing assets in browser contexts without crashing.

swagger-ui-dist-package · high confidence

The error handling plugin in \src/core/plugins/err\ has been restructured into distinct modules (actions, reducers, selectors) and now uses the \serialize-error\ library to safely serialize thrown errors before storing them in the state. This change introduces new action creators for batch error handling (\newThrownErrBatch\, \newSpecErrBatch\) and adds a \lastError\ selector to retrieve the most recent error, while maintaining existing capabilities for clearing errors by filter or predicate.

src/core/plugins/err · high confidence

The authentication interface in the core components has been completely rewritten to support modern security standards and better user experience. The new implementation adds native OpenID Connect (OIDC) support for OAS3 specs and introduces PKCE (Proof Key for Code Exchange) for OAuth2 authorization code flows, which enhances security for public clients. Accessibility has been significantly improved: the authorization popup can now be closed using the Escape key or by clicking the backdrop, and the operation-level authorize button includes proper ARIA labels for screen readers. The UI also features more descriptive button labels (e.g., 'Close' instead of 'Done') and ensures unique IDs for input fields to improve form handling and password manager compatibility.

src/core/components/auth · high confidence

The Swagger client plugin now respects the \withCredentials\ configuration option, ensuring that HTTP requests include credentials (such as cookies or authorization headers) when this setting is enabled. Additionally, the plugin exposes a more comprehensive set of functions and strategies, including specific resolvers for OpenAPI 2.0, 3.0, and 3.1 (via ApiDOM), and allows for custom model and parameter macros, request/response interceptors, and subtree resolution options to be passed through the configuration.

src/core/plugins/swagger-client · high confidence

The Schemas section in the OAS 3.1 plugin now uses virtualization to render large numbers of schemas efficiently. When the number of schemas exceeds a defined threshold, the \models.jsx\ component switches to a virtualized list (using \@tanstack/react-virtual\), displaying only the visible items to improve performance and reduce DOM size. The new \schema-item.tsx\ component handles individual schema rendering by delegating to the \JSONSchema202012\ component, and the accompanying \\_models.scss\ styles ensure proper layout and scrolling behavior for the virtualized container.

src/core/plugins/oas31/components/models · high confidence

The build tooling has been migrated from Webpack 4 to Webpack 5, introducing several configuration changes that affect how the library is packaged. The build now generates a true ESM (ECMAScript Module) bundle (\swagger-ui-es-bundle-core\) alongside the existing UMD bundles, enabling better tree-shaking and compatibility with modern module systems. To support this, the configuration uses Webpack 5's native asset modules (replacing file loaders) and the \experiments.outputModule\ flag. Additionally, the build now explicitly polyfills Node.js globals like \Buffer\ and \process\ via \ProvidePlugin\ and \fallback\ aliases to ensure the browser bundles work correctly without requiring external polyfills. The standalone preset and style extraction configs have also been updated to align with the new Webpack 5 API.

webpack · high confidence

The configuration system in src/core/config has been refactored to consolidate all options into a single, frozen defaults file and a robust type-casting mechanism. This ensures that configuration values (such as booleans, numbers, arrays, and functions) are strictly validated and converted to their expected types, preventing runtime errors from malformed input. The update also introduces new default options, including the addition of 'query' to the supportedSubmitMethods array, a new 'uncaughtExceptionHandler' option, and a 'queryConfigEnabled' flag to control reading options from the URL query string.

src/core/config · high confidence

The \src/core/utils\ directory has been restructured from a monolithic \index.js\ into individual modules (e.g., \url.js\, \get-parameter-schema.js\, \combine-reducers.ts\). This change introduces a dedicated \sanitizeUrl\ function in \url.js\ that blocks dangerous schemes (javascript, data, vbscript) and safely resolves relative paths, addressing security and URL handling issues. It also adds \createHtmlReadyId\ for safe ID generation, \parseParameterArrayValue\ for robust array parsing, and \combineReducers\ to replace the deprecated \redux-immutable\ package with Immutable.js Maps.

src/core/utils · high confidence

Added Cypress e2e test support infrastructure; Added Selenium page object for main UI components; Added accessibility tests for authorization popup and response tabs; Added end-to-end tests for API documentation features; Added end-to-end tests for JSON Schema 2020-12 plugin features; Added end-to-end tests for OAuth2 application and password flows; Added end-to-end tests for OpenAPI 3.1 plugin features; Added end-to-end tests for OpenAPI 3.x plugin behaviors; Added end-to-end tests for Swagger UI scenarios; Added end-to-end tests for security edge cases; Added security-focused test fixtures for OpenAPI/Swagger documents; Added static HTML page for Cypress end-to-end testing; Added static test fixtures and HTML entry point for Selenium E2E tests; Added static test pages for multi-url, JSON Schema expansion, and OAuth scenarios; Added tests for OpenAPI 3.2.0 support; Added tests for XSS sanitization in Info and Markdown components; Added tests for build artifact exports; Added unit tests for Docker configuration translators; Added unit tests for JSON Schema 2020-12 sample generation; Added unit tests for JSON Schema 5 plugin components; Added unit tests for JSON Schema sample generation logic; Added unit tests for OAS 3.1 plugin components and utilities; Added unit tests for accessibility skip-to-operations and top-bar banner landmark; Added unit tests for anchor target security attributes; Added unit tests for configuration type casting; Added unit tests for core UI components; Added unit tests for core helper functions; Added unit tests for core system wrapping mechanisms; Added unit tests for core utilities, OAuth2 authorization, and curlify; Added unit tests for error transformer plugins; Added unit tests for swagger-client withCredentials configuration; Added unit tests for the DarkModeToggle component; Added unit tests for the OAS3 plugin; Added unit tests for the auth plugin and core utilities; Added unit tests for the configs plugin's downloadConfig action; Expanded end-to-end test coverage for Swagger UI bug fixes; Migrate unit tests to Jest.

This release updates numerous dependencies across the project, including bumping @jest/globals from 29.6.4 to 29.7.0, less from 3.11.2 to 4.1.1, sass-loader from 9.0.3 to 12.6.0, and @commitlint/cli from 18.6.0 to 19.0.3. Several security vulnerabilities in both production and development dependencies were addressed, including fixes for dompurify, swagger-client, and other packages flagged by npm audit.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 36 → 54 (+18.6)
• Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 41 → 49 (+8.3)
• Architecture 88 (new)
• Maturity 59 → 71 (+12.4)
• Readiness 21 → 76 (+54.5)
• Security 64 → 83 (+18.9)
• Accessibility 44 (new)

• Change coupling: JSONSchema.jsx ↔ hoc.jsx (src/core/plugins/json-schema-2020-12/components/JSONSchema/JSONSchema.jsx)
• Change coupling: JSONSchema.jsx ↔ index.js (src/core/plugins/json-schema-2020-12/components/JSONSchema/JSONSchema.jsx)
• Change coupling: JSONSchema.jsx ↔ models.jsx (src/core/plugins/json-schema-2020-12/components/JSONSchema/JSONSchema.jsx)
• Change coupling: actions.js ↔ selectors.js (src/core/plugins/layout/actions.js)
• Change coupling: fn.js ↔ hoc.jsx (src/core/plugins/json-schema-2020-12/fn.js)
• Change coupling: hoc.jsx ↔ index.js (src/core/plugins/json-schema-2020-12/hoc.jsx)
• Change coupling: hoc.jsx ↔ models.jsx (src/core/plugins/json-schema-2020-12/hoc.jsx)
• Change coupling: index.js ↔ models.jsx (src/core/plugins/json-schema-2020-12/index.js)
• Change coupling: reducers.js ↔ selectors.js (src/core/plugins/layout/reducers.js)
• Change coupling: selectors.js ↔ wrap-selectors.js (src/core/plugins/oas3/spec-extensions/selectors.js)
• Dimension evaluation failed
• FileTooLong: core/system.js (src/core/system.js)
• FileTooLong: core/utils.js (test/unit/core/utils.js)
• FileTooLong: fn/index.js (src/core/plugins/json-schema-5-samples/fn/index.js)
• FileTooLong: json-schema-2020-12-samples/fn.js (test/unit/core/plugins/json-schema-2020-12-samples/fn.js)
• FileTooLong: json-schema-2020-12/fn.js (src/core/plugins/json-schema-2020-12/fn.js)
• FileTooLong: spec/actions.js (src/core/plugins/spec/actions.js)
• FileTooLong: spec/selectors.js (src/core/plugins/spec/selectors.js)
• FileTooLong: spec/selectors.js (test/unit/core/plugins/spec/selectors.js)
• FileTooLong: utils/index.js (src/core/utils/index.js)
• …and 68 more

• Base-context workflow trigger runs with an unscoped token
• BaseLayout.render (cognitive 24) (src/core/components/layouts/base.jsx)
• BaseLayout.render (cyclomatic 19) (src/core/components/layouts/base.jsx)
• Change coupling: curl.jsx ↔ request-snippets.jsx (src/core/components/curl.jsx)
• Change coupling: response.jsx ↔ model-example.jsx (src/core/components/response.jsx)
• Coverage not measured — JavaScript/TypeScript suite
• Documentation: hard to navigate (docs/development/scripts.md)
• Documentation: hard to navigate (docs/usage/configuration.md)
• Documentation: no installation or build instructions (README.md)
• Floating npm dependency: react
• Floating npm dependency: react-dom
• FunctionTooLong: ExternalDocs.ExternalDocs (src/core/plugins/oas31/json-schema-2020-12-extensions/components/keywords/ExternalDocs.jsx)
• FunctionTooLong: JSONViewer.JSONViewer (src/core/plugins/json-schema-2020-12/components/JSONViewer/JSONViewer.jsx)
• FunctionTooLong: Xml.Xml (src/core/plugins/oas31/json-schema-2020-12-extensions/components/keywords/Xml.jsx)
• FunctionTooLong: examples-select-value-retainer.stringifyUnlessList (src/core/components/examples-select-value-retainer.jsx)
• FunctionTooLong: index.validateValueBySchema (src/core/utils/index.js)
• Further sole-owners (lower concentration)
• High CVE: [GHSA redacted] (package-lock.json)
• High: security finding (details withheld)
• High: security finding (details withheld)
• …and 240 more

• 64 commits — 47 feature/other, 17 fixes

• (root) — 31 commits
• .github/workflows — 15 commits
• src/core — 11 commits
• src/style — 3 commits
• docs/usage — 2 commits
• .claude/implementation — 1 commit
• src/standalone — 1 commit

• fix: fix(a11y): add accessible names for buttons
• fix: fix(a11y): add aria-labels to copy-to-clipboard buttons (#10842)
• fix: fix(a11y): add skip-to-operations link, banner and main landmarks (#10849)
• fix: fix(a11y): close Authorization popup with Escape key and backdrop click (#10987)
• fix: fix(a11y): name and state for dark-mode toggle button (#10848)
• fix: fix(a11y): restore icon visibility in Windows High Contrast Mode (#10846)
• fix: fix(a11y): topbar logo and dark-mode toggle visible in HCM (#10847)
• fix: fix(a11y): use <strong> for model titles to convey emphasis semantically (#10876)
• fix: fix(build): include license and source map in dist (#10979)
• fix: fix(ci): bump cycjimmy/semantic-release-action to v6.0.0 (#11001)
• fix: fix(ci): fix Trivy security scan and add dependency vulnerability scan (#10996)
• fix: fix(dark-mode): indicate dark color-scheme for native browser controls (#10844)
• fix: fix(icons): operation copy-to-clipboard icon visibility (#11050)
• fix: fix(oas32): include query in default supportedSubmitMethods (#11021)
• fix: fix(style): reduce padding on inline code blocks in markdown (#7569) (#10789)
• fix: fix: use scoped DOMPurify instance to avoid mutating global (#11029)
• fix: refactor(deep-linking): convert layout to TypeScript and fix license issue (#11028)
• change: chore(build): add TypeScript support to toolchain (#11000)
• change: chore(deps): bump aquasecurity/trivy-action (#11014)
• change: chore(deps): bump dependabot/fetch-metadata (#10994)
• …and 44 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

swagger-api/swagger-ui was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.