v0.9.2

Changed

• Bumped the bundled Scalar UI (@scalar/api-reference) from 1.65.0 to
  1.65.1 — across the CDN pin, the embedded bundle, and the
  package.json tracker. The patch carries a single upstream fix, in the
  object-diff helper that compares an array against an object, and
  preserves the configuration and CSP contracts stdocs relies on. The CDN
  SRI hash and the vendored bytes are re-pinned to the 1.65.1 bundle,
  verified byte-identical across the npm tarball and jsDelivr.

v0.9.1

Changed

• Bumped the bundled Scalar UI (@scalar/api-reference) from 1.62.6 to
  1.65.0 and Swagger UI (swagger-ui-dist) from 5.32.8 to 5.32.13 —
  across the CDN pins, the embedded bundles, and the package.json
  tracker. The Scalar 1.63–1.65 line adds component exports and print
  styles; the Swagger 5.32.9–5.32.13 patches are bug fixes and
  dependency bumps (including dompurify and axios). Both preserve the
  configuration and CSP contracts stdocs relies on. The CDN SRI hashes
  and the vendored bytes are re-pinned, verified byte-identical across
  the npm tarballs and jsDelivr with SLSA build provenance from the
  upstream repositories.

v0.9.0

Added

• Array parameters and slice fields can document their elements. A
  repeated query filter — ?severity=high&severity=low — now carries a
  machine-readable element enum instead of an opaque items: {type}:

  stdocs.QueryParam("severity", "array", "Repeated severity filter",
      stdocs.ParamItems("string", stdocs.ItemEnum("info", "low", "high")))

  A new ItemOpt family — ItemEnum, ItemFormat, ItemPattern,
  ItemMinLength, ItemMaxLength, ItemMinimum, ItemMaximum,
  ItemExclusiveMinimum, ItemExclusiveMaximum — nests inside
  ParamItems, which owns the element schema. There is deliberately no
  ItemDefault or ItemExample: a default or an example is a value for
  the parameter, not for one of its elements.

• On a slice or array field the scalar constraint tags now describe the
  elements rather than panicking, so Severity []string \query:"severity" enum:"info,low,high"`emitsitems.enum. This covers request bodies, responses, and webhook payloads as well as parameters, and the two parameter paths produce the same document. Only minItems, maxItems, and uniqueItemsdescribe the array, sominLengthon a[]stringmeans "each element is at least that long"; "at least that many elements" isminItems. Elements that cannot carry a constraint (slices of structs, of slices, or of maps) panic and name the elements. tsgen renders an element enum as a union array (("info" | "low" | "high")[]`).

Changed

• ParamItems now takes optional ItemOpt modifiers. Existing direct
  calls are unaffected; a reference to ParamItems as a function
  value is not, as with WithUI in v0.7.0.
• ParamFormat now rejects an array parameter: an array has no format
  of its own, and its elements' format comes from ItemFormat. This
  aligns the modifier with the format: tag, which describes the
  elements.
• Declaring ParamItems twice on one parameter panics when the first
  call carried element options — the second call replaces the element
  schema and would silently discard them. Re-declaring the element type
  alone stays the no-op it has always been.
• default: and example: on a slice or array field now explain why
  they are rejected (a lone value cannot say whether it is the whole
  array or one element), and ParamEnum on an array parameter points at
  ParamItems/ItemEnum.
• enum, format, and the bounds on a [N]byte field now apply to its
  integer elements instead of panicking. A byte array is an array of
  numbers on the wire; to document one as a string, use
  openapi:"type=string,format=uuid".

Fixed

• Lint now inspects array element schemas, so the exclusive-bounds
  advisory sees an exclusive bound on a slice field's elements. It was
  blind to them, which would have let the generator-hostile numeric
  3.1/3.2 form ship unreported.
• A WithParams struct field whose elements have no JSON representation
  (a slice of functions or channels) is rejected as a parameter instead
  of being accepted with an empty element schema.

v0.8.3

Changed

• Bumped the bundled Scalar UI (@scalar/api-reference) from 1.62.5 to
  1.62.6 — across the CDN pin, the embedded bundle, and the
  package.json tracker. The patch renders document-wide authentication
  for AsyncAPI documents and fixes a plugin auth accessor; it preserves
  the configuration and CSP contracts stdocs relies on. The CDN SRI hash
  and the vendored bytes are re-pinned to the 1.62.6 bundle, verified
  byte-identical across the npm tarball and jsDelivr.
• Bumped the bundled Stoplight Elements (@stoplight/elements) from
  9.0.23 to 9.0.24. Both vendored assets are byte-identical to 9.0.23, so
  only the pinned version moved and the SRI hashes are unchanged.

v0.8.2

Changed

• Bumped the bundled Scalar UI (@scalar/api-reference) from 1.62.1 to
  1.62.5 — across the CDN pin, the embedded bundle, and the
  package.json tracker. The 1.62.2–1.62.5 patches are rendering and
  behavior fixes (deep links to response properties, an allOf +
  oneOf/anyOf property-merge fix, AsyncAPI layout tweaks) and
  preserve the configuration and CSP contracts stdocs relies on. The
  CDN SRI hash and the vendored bytes are re-pinned to the 1.62.5
  bundle, verified byte-identical across the npm tarball and jsDelivr.

v0.8.1

Changed

• Bumped the bundled Scalar UI (@scalar/api-reference) from 1.61.0 to
  1.62.1 — across the CDN pin, the embedded bundle, and the
  package.json tracker. The 1.62.x line adds UI localization (seven
  languages plus RTL) and schema-rendering fixes (JSON Schema 2020-12
  $dynamicRef, discriminator-only variants, and an allOf
  self-reference crash), and preserves the configuration and CSP
  contracts stdocs relies on. The CDN SRI hash and the vendored bytes
  are re-pinned to the 1.62.1 bundle, verified byte-identical across the
  npm tarball and jsDelivr.

v0.8.0

Added

• openapi:"schema=json-schema" documents a json.RawMessage (or any)
  field as a JSON Schema document — a free-form object carrying the
  description "A JSON Schema document." — instead of the opaque schema
  reflection produces for raw bytes. It flows into the component schemas
  and the tsgen types (as Record<string, unknown>); a doc: tag
  overrides the default description, a pointer or openapi:"nullable"
  makes it nullable, and stdocs does not validate the embedded schema.
  On these fields the example: tag takes a JSON literal (not a scalar),
  so an author can show a representative schema in the docs; stdocs never
  injects a default example of its own.

Fixed

• The built-in docs page now renders the examples array (the form
  OpenAPI 3.1/3.2 emit), so a field's example — including one on a
  schema=json-schema field — appears there and not only in the richer
  UIs; previously the page read only the singular example keyword and
  silently dropped examples under 3.1/3.2.

Security

• The built-in docs page's inline script is re-pinned by sha256 in the
  default Content-Security-Policy (its example handling changed);
  TestDefaultDocsCSP recomputes the hash from the served page, so the
  policy cannot drift from the script it secures.

stdocs v0.7.1

Changed

• Bumped the bundled UI versions: Scalar (@scalar/api-reference) to
  1.61.0, Swagger UI (swagger-ui-dist) to 5.32.8, and Stoplight
  Elements (@stoplight/elements) to 9.0.23 — across the CDN pins, the
  embedded bundles, and the package.json tracker. All three are
  additive/patch upstream releases that preserve the configuration and
  CSP contracts stdocs relies on; the CDN SRI hashes and vendored bytes
  are re-pinned (Scalar's bundle and Swagger UI's JS changed; Swagger
  UI's CSS and Stoplight's assets are byte-identical to the prior pin).

stdocs v0.7.0

Added

• Each bundled UI sub-package's WithUI now accepts options, with a
  WithConfiguration(map[string]any) that forwards UI-native
  configuration to the docs page without forking the template or its
  CSP — Scalar's configuration (via data-configuration), Swagger UI's
  SwaggerUIBundle options and Redoc's Redoc.init options (via a
  non-executable JSON block read by a hash-pinned initializer), and
  Stoplight's <elements-api> attributes. It is carried by a new
  exported Config.UIConfig field.
• The OpenAPI spec endpoint sends Content-Disposition: inline with a
  filename (openapi.json / openapi.yaml), so a direct download gets a
  sensible name while the document still opens in the browser.

Changed

• The bundled Scalar and Swagger UI pages now disable, by default, the
  features that cannot work under the strict docs CSP, so the page has no
  dead chrome: Scalar's "Ask AI" and "Generate MCP" (they call
  scalar.com) and its external web fonts, and Swagger UI's spec-validator
  badge (it loads from validator.swagger.io). Their no-config output
  therefore differs from v0.6.x. Re-enable any of them with
  WithConfiguration, and relax the policy with
  WithDocsSecurityHeaders(false) or WithCSP so the feature can reach
  its service. Redoc now boots through an inline Redoc.init initializer
  instead of the <redoc> web component.

Security

• The Swagger UI inline initializer is re-pinned and Redoc's new inline
  initializer is pinned by sha256 in its Content-Security-Policy; UI
  configuration travels in a non-executable data block, so it never
  affects those hashes or relaxes script-src.

stdocs v0.6.8

Changed

• Updated the bundled Scalar UI (ui/scalar and ui/scalaremb) to
  @scalar/api-reference 1.60.0 — an additive minor (a content.start
  plugin slot and an opt-in sidebar for plugin views) plus a handful of
  rendering fixes. The standalone build and the data-url bootstrap the
  UIs rely on are unchanged, so the docs page and its CSP are untouched;
  the CDN sha384 SRI and the vendored air-gapped bundle are re-pinned to
  the new bytes, verified byte-identical between the npm tarball and the
  pinned jsDelivr URL.

Fixed

• The README described the built-in docs page as ~1.6 KB — accurate at
  v0.1.0, but it has grown to ~10 KB across the v0.6.x additions (the
  security headers, the dismissable notice, method badges, and the
  expandable operations). Corrected the figure and aligned it with the
  source. Also tidied a couple of stale doc comments left over from
  older "Tier" terminology.