Bump the all-ui-bundles group with 2 updates

[dependabot]

Bumps the all-ui-bundles group with 2 updates: @scalar/api-reference and swagger-ui-dist.

Updates @scalar/api-reference from 1.65.1 to 1.66.1

Changelog

Sourced from @​scalar/api-reference's changelog.

1.66.1

Patch Changes

• #9941: Republish every package through npm trusted publishing. No functional changes.

1.66.0

Minor Changes

• #9917: Expose every sidebar URL to crawlers in server-rendered HTML. The interactive sidebar keeps the children of collapsed groups out of the DOM, so links to operations and models inside collapsed tags were missing from server-rendered output unless defaultOpenAllTags was enabled. The server-rendered HTML now includes a hidden, flat list of plain anchors for every navigation entry, so crawlers can discover all deep links without executing JavaScript. The list is dropped right after hydration and never affects the interactive experience.
• #9918: Render sidebar navigation as anchor links instead of buttons.
  • @scalar/sidebar: ScalarSidebar and SidebarItem accept a new getHref callback. When it returns a URL for an item, that item renders as a real link — this covers every entry except tag-group headings, which are section labels rather than navigation targets. Plain left clicks on the link still emit selectItem for in-app navigation (with the default navigation prevented), modified clicks are left to the browser so links can be opened in a new tab, and clicks on decorator content outside the link keep their native behavior. Items are built with the existing button slot on ScalarSidebarItem and ScalarSidebarGroup, so @scalar/components needs no new API to support this.
  • @scalar/api-reference: the sidebar now passes getHref using the new SSR-safe makeHrefFromId helper, so the rendered sidebar contains real anchor tags whose paths match the URLs pushed to history (the hrefs are relative, so they do not carry the current query string). With path routing this makes the navigation crawlable and indexable by search engines; with hash routing and hash-base-path routing the fragment hrefs improve link semantics and open-in-new-tab behavior, but search engines do not treat fragments as separate URLs — configure pathRouting if URL discovery is the goal. Note that sidebar entries now follow standard link keyboard semantics (Enter activates them, Space scrolls the page), and links inside collapsed groups are only present in server-rendered HTML for groups that are expanded during SSR (for example via defaultOpenAllTags).
  • @scalar/helpers: new isPlainLeftClick helper in dom/is-plain-left-click for deciding when a click should be hijacked for client-side navigation.

Patch Changes

• #9927: Show a composed schema's own description when it has no properties of its own. A schema that only carries allOf plus a top-level description dropped that description and rendered the first allOf member's description instead, which was visible when browsing the schema standalone in the Models section.

• #9936: Add bottom padding to the classic layout so the last section is no longer glued to the bottom edge of the screen

• #9406: feat: support OpenAPI 3.2 nested tags

  The navigation tree now nests tags via the OpenAPI 3.2 tag.parent field, building an arbitrary-depth hierarchy. A parent tag with no operations of its own is treated as a section; a tag that has both operations and children renders as both. Native parent nesting takes precedence over x-tagGroups, which stays as the fallback for older documents. The summary field is used as the tag title (after x-displayName), and the new parent, kind and summary fields are recognized on the Tag Object (both in @scalar/workspace-store and @scalar/schemas). In the modern layout, operation-less parent tags now render their own summary and description header instead of being flattened like a legacy x-tagGroups wrapper.

• #9893: Show schema pattern as a hover dropdown in the API reference, similar to examples. Long regex patterns are now revealed on hover instead of being truncated inline.

• #9871: Add a short CDN URL for the ESM standalone build: https://cdn.jsdelivr.net/npm/@scalar/api-reference/esm.js

• #9865: Ship source maps with the standalone browser build (dist/browser) so config errors are easier to debug

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​scalar/api-reference since your current version.

Updates swagger-ui-dist from 5.32.13 to 5.32.14

Release notes

Sourced from swagger-ui-dist's releases.

v5.32.14

5.32.14 (2026-08-18)

Bug Fixes

• a11y: add accessible names for buttons (d5a04d5)
• build: include license and source map in dist (#10979) (7fb32b5), closes #8317
• dark-mode: indicate dark color-scheme for native browser controls (#10844) (7cf5114)

Huge thanks to our contributors who made this release happen: @​moskvin, @​tstarling, and @​yogeshwaran-c

Commits

• 6e8ce24 chore(release): cut the 5.32.14 release
• fefb1df chore(build): add TypeScript support to toolchain (#11000)
• 050e996 chore(docs): consolidate swagger-client naming (#11015)
• 7cf5114 fix(dark-mode): indicate dark color-scheme for native browser controls (#10844)
• 1b556c9 chore(deps): bump aquasecurity/trivy-action (#11014)
• be2e4b0 chore(deps): bump swagger-client to 3.38.0 (#11009)
• 3d9d091 chore(deps-dev): bump cypress, @​pmmmwh/react-refresh-webpack-plugin (#11008)
• 2e906d5 chore(deps): bump react-redux from 9.2.0 to 9.3.0 (#11005)
• d5a04d5 fix(a11y): add accessible names for buttons
• 0828bda chore(deps-dev): bump autoprefixer from 10.4.21 to 10.5.4 (#11004)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[FumingPower3925]

Superseded by #125, which bumps both bundles across all pin sites (CDN + embedded + package.json) with full supply-chain verification: SLSA provenance from scalar/scalar and swagger-api/swagger-ui, byte-identical npm/jsDelivr, and every flagged delta classified (the new scratch host is a new URL("http://scratch") throwaway base, and atob 4→6 is a duplicated Zod copy's base64/JWT format validators). Merging this package.json-only change alone would red the pinning tests.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml