Skip to content

feat(java): disable Scalar by default#6781

Merged
marclave merged 2 commits intomainfrom
feat/disable-scalar-by-default
Sep 9, 2025
Merged

feat(java): disable Scalar by default#6781
marclave merged 2 commits intomainfrom
feat/disable-scalar-by-default

Conversation

@hanspagel
Copy link
Copy Markdown
Member

@hanspagel hanspagel commented Sep 9, 2025 •
edited
Loading

Problem

We got this message:

I would like to suggest making the following settings disabled (false) by default:

  • scalar.enabled

When scalar.enabled is enabled by default, it can be misleading, especially when using Scalar via the springdoc-openapi-starter-webmvc-scalar Java dependency.

Also, in 2024, the CVE board updated the CNA rules, including the following:

4.1.4 Insecure default configuration settings SHOULD be determined to be vulnerabilities
So, what do you think? Is this an insecure default configuration or not?

And I think we should make this change.

I’d say the Java community is a bit more security sensitive than others, and it just makes sense to give the user full control over it. Especially when our integration is installed as a dependency of another dependency.

Solution

This PR sets scalar.enabled = false by default.

⚠️ Minor release, because breaking change.

Checklist

I've gone through the following:

  • I've added an explanation why this change is needed.
  • I've added a changeset (pnpm changeset).
  • I've added tests for the regression or new feature.
  • I've updated the documentation.

@hanspagel hanspagel self-assigned this Sep 9, 2025
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Sep 9, 2025

🦋 Changeset detected

Latest commit: bd6a180

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@scalar/webjar Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@hanspagel hanspagel changed the title Feat/disable scalar by default feat(java): disable Scalar by default Sep 9, 2025
@relativeci
Copy link
Copy Markdown

relativeci bot commented Sep 9, 2025

#12994 Bundle Size — 2.7MiB (+0.31%).

bd6a180(current) vs 12d1843 main#12739(baseline)

Warning

Bundle introduced 2 new packages: @scalar/typebox, js-base64 – View changed packages

Note

Bundle removed 3 duplicate packages – View changed duplicate packages

Bundle metrics  Change 5 changes Regression 1 regression Improvement 2 improvements
                 Current
#12994		      Baseline
#12739
Regression  Initial JS 2.7MiB(+0.31%) 2.69MiB
No change  Initial CSS 0B 0B
Change  Cache Invalidation 100% 0%
No change  Chunks 1 1
No change  Assets 1 1
Change  Modules 1855(-0.91%) 1872
No change  Duplicate Modules 0 0
No change  Duplicate Code 0% 0%
Improvement  Packages 168(-1.18%) 170
Improvement  Duplicate Packages 0(-100%) 3
Bundle size by type  Change 1 change Regression 1 regression
                 Current
#12994		      Baseline
#12739
Regression  JS 2.7MiB (+0.31%) 2.69MiB

Bundle analysis report Branch feat/disable-scalar-by-default Project dashboard

Generated by RelativeCI Documentation Report issue

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Sep 9, 2025

Preview Examples

https://923d0fb9-d0c7-4ffe-a2da-928e123714bc--scalar-deploy-preview.netlify.app

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Sep 9, 2025

Preview Storybook

https://6af862de-9a54-46ee-b129-5d126dc17fef--scalar-components.netlify.app

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Sep 9, 2025

Scalar Components Snapshot Test Results

passed  88 passed

Details

report  Open report ↗︎
stats  88 tests across 18 suites
duration  19.6 seconds
commit  bd6a180

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Sep 9, 2025

Scalar CDN Snapshot Diff Results

passed  18 passed

Details

report  Open report ↗︎
stats  18 tests across 1 suite
duration  33.4 seconds
commit  bd6a180
info  These tests are non-blocking and will not prevent merging of your PR.

Important

These tests detect visual differences between the current PR and the latest CDN build which means they may be affected by other changes in main that haven't been released yet.

They can help determine if the changes in the PR are causing any unexpected visual regressions but may be less helpful in isolating the exact cause. For more details see the readme.

@marclave marclave merged commit fac3b3c into main Sep 9, 2025
45 of 47 checks passed
@marclave marclave deleted the feat/disable-scalar-by-default branch September 9, 2025 17:01
This was referenced Sep 9, 2025
Merged
Merged
@zakaria-shahen zakaria-shahen mentioned this pull request Oct 30, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marclave marclave marclave approved these changes

@xC0dex xC0dex xC0dex approved these changes

@amritk amritk Awaiting requested review from amritk amritk is a code owner

@geoffgscott geoffgscott Awaiting requested review from geoffgscott geoffgscott is a code owner

Assignees

@hanspagel hanspagel

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@hanspagel @marclave @xC0dex