@scalar/express-api-reference 0.9.19 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/dist/apiReference.js +2 -2
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,25 @@
|
|
|
1
1
|
# @scalar/express-api-reference
|
|
2
2
|
|
|
3
|
+
## 0.10.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- [#9422](https://github.com/scalar/scalar/pull/9422): Add a `nonce` option for Content Security Policy support.
|
|
8
|
+
|
|
9
|
+
When you pass a `nonce`, the rendered HTML stamps it onto the inline `<script>` and the CDN `<script>` tag (and Scalar's own `<style>` tags, plus a matching `<meta property="csp-nonce">`). This lets the API Reference run under a strict `script-src` with no `unsafe-inline` and no `unsafe-eval`.
|
|
10
|
+
|
|
11
|
+
```ts
|
|
12
|
+
ApiReference({
|
|
13
|
+
url: '/openapi.json',
|
|
14
|
+
// Match this value in your `script-src` CSP directive.
|
|
15
|
+
nonce: 'r4nd0m',
|
|
16
|
+
})
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
Note: `style-src` still needs `'unsafe-inline'`. The reference renders inline `style="…"` attributes, which a CSP nonce can never authorize (nonces only apply to `<script>`, `<style>` and `<link>` elements), so a nonce-only `style-src` is not possible. The win is a fully strict `script-src`.
|
|
20
|
+
|
|
21
|
+
## 0.9.20
|
|
22
|
+
|
|
3
23
|
## 0.9.19
|
|
4
24
|
|
|
5
25
|
## 0.9.18
|
package/dist/apiReference.js
CHANGED
|
@@ -16,7 +16,7 @@ export function apiReference(givenConfiguration) {
|
|
|
16
16
|
};
|
|
17
17
|
// Respond with the HTML document
|
|
18
18
|
return (_, res) => {
|
|
19
|
-
const { cdn, pageTitle, ...config } = configuration;
|
|
20
|
-
res.type('text/html').send(renderApiReference({ config, pageTitle, cdn }));
|
|
19
|
+
const { cdn, pageTitle, nonce, ...config } = configuration;
|
|
20
|
+
res.type('text/html').send(renderApiReference({ config, pageTitle, cdn, nonce }));
|
|
21
21
|
};
|
|
22
22
|
}
|
package/package.json
CHANGED
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
"url": "git+https://github.com/scalar/scalar.git",
|
|
11
11
|
"directory": "integrations/express"
|
|
12
12
|
},
|
|
13
|
-
"version": "0.
|
|
13
|
+
"version": "0.10.0",
|
|
14
14
|
"engines": {
|
|
15
15
|
"node": ">=22"
|
|
16
16
|
},
|
|
@@ -45,7 +45,7 @@
|
|
|
45
45
|
"documentation": "https://scalar.com/products/api-references/integrations/express"
|
|
46
46
|
},
|
|
47
47
|
"dependencies": {
|
|
48
|
-
"@scalar/client-side-rendering": "0.
|
|
48
|
+
"@scalar/client-side-rendering": "0.2.0"
|
|
49
49
|
},
|
|
50
50
|
"devDependencies": {
|
|
51
51
|
"@types/express": "5.0.3",
|