Update dependency swagger-ui-dist to v5.32.14

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
swagger-ui-dist	5.7.2 → 5.32.14

---

Release Notes

swagger-api/swagger-ui (swagger-ui-dist)

v5.32.14

Compare Source

Bug Fixes

• a11y: add accessible names for buttons (d5a04d5)
• build: include license and source map in dist (#​10979) (7fb32b5), closes #​8317
• dark-mode: indicate dark color-scheme for native browser controls (#​10844) (7cf5114)

Huge thanks to our contributors who made this release happen: @​moskvin, @​tstarling, and @​yogeshwaran-c

v5.32.13

Compare Source

Bug Fixes

• a11y: add aria-labels to copy-to-clipboard buttons (#​10842) (e6ce7d8)
• a11y: add skip-to-operations link, banner and main landmarks (#​10849) (92669ea)
• a11y: close Authorization popup with Escape key and backdrop click (#​10987) (311b0d2)
• a11y: name and state for dark-mode toggle button (#​10848) (13a90fa)
• a11y: restore icon visibility in Windows High Contrast Mode (#​10846) (edec467)
• a11y: topbar logo and dark-mode toggle visible in HCM (#​10847) (6beaebd)
• a11y: use for model titles to convey emphasis semantically (#​10876) (b4501b6)
• ci: bump cycjimmy/semantic-release-action to v6.0.0 (#​11001) (9b3eacb)
• ci: fix Trivy security scan and add dependency vulnerability scan (#​10996) (ff221a8)
• style: reduce padding on inline code blocks in markdown (#​7569) (#​10789) (a1a6cdc)

Huge thanks to our contributors who made this release happen: @​bmatar, @​yogeshwaran-c, @​jonnyjackson26, @​rkdfx, and @​adrianodpdiaz

v5.32.12

Compare Source

Bug Fixes

• deps: bump swagger-client to v3.37.8 (#​10980) (1a88283)

v5.32.11

Compare Source

Bug Fixes

• deps: bump dompurify from 3.4.11 to 3.4.12 (#​10972) (0aa8457)
• deps: bump immutable to 4.3.9 (#​10969) (159423c)

v5.32.10

Compare Source

Bug Fixes

• deps: bump axios from 1.16.0 to 1.18.1 (#​10963) (878390c)
• deps: bump swagger-client to 3.37.7 (#​10968) (d353bcd)

v5.32.9

Compare Source

Bug Fixes

• spec: avoid crash when requestBody has no content field (#​10837) (832008a)

v5.32.8

Compare Source

Bug Fixes

• avoid filling parameter input with invalid array initial values (#​10928) (014c512)

v5.32.7

Compare Source

Bug Fixes

• deps: bump dompurify from 3.4.0 to 3.4.9 (#​10923) (15fc7d1)
• deps: bump dompurify from 3.4.9 to 3.4.11 (#​10931) (52ef1c9)
• deps: bump form-data from 4.0.5 to 4.0.6 (#​10924) (f8bcbbf)
• deps: bump http-proxy-middleware to 2.0.10 and ws to 8.21.0 (#​10935) (dd0d338)
• deps: bump js-yaml from 4.1.1 to 4.2.0 (#​10927) (bf17869)
• deps: bump launch-editor from 2.10.0 to 2.14.1 (#​10926) (9b6b6ff)

v5.32.6

Compare Source

Bug Fixes

• deps-dev: address undici vulnerability (#​10870) (35f5a6a)
• docker: address CVE-2026-27135 nghttp2-libs vulnerability (#​10879) (0a63415)

v5.32.5

Compare Source

Bug Fixes

• deps: bump swagger-client to v3.37.3 (#​10858) (74e48ce)
• style: markdown list items default text color in Dark Mode (#​10790) (#​10791) (3608eaa)

Reverts

• Revert "Accessibility: Easier to access Authorization (#​10692)" (#​10850) (8d17c78)

v5.32.4

Compare Source

Bug Fixes

• authorization: increase backdrop z-index (#​10831) (fd08fe8)
• docker: upgrade alpine packages to address HIGH severity CVEs (#​10830) (095ee75)

v5.32.3

Compare Source

Bug Fixes

• style: move button margin from right to left (#​10696) (30279ef)

Performance Improvements

• operation: limit number of rerenders (#​10796) (68f6fde)

v5.32.2

Compare Source

Bug Fixes

• docker: bump libpng and zlib versions to fix CVE-2026-33416, CVE-2026-33636 and CVE-2026-22184 (#​10802) (c200a69)

v5.32.1

Compare Source

Bug Fixes

• invalidate models components cache based on location (#​10764) (fb78dd2)
• style: use container queries for responsive design (#​10763) (e35000e)

v5.32.0

Compare Source

Features

• oas32: add basic OpenAPI 3.2.0 support (#​10721) (4675ad7)

v5.31.2

Compare Source

Bug Fixes

• core: remove mistakenly put condition (#​10212) (#​10730) (62525f9)
• deps: update swagger-client to v3.36.2 to resolve peer dep issue (#​10734) (707010a)

Performance Improvements

• reduce conversion from immutablejs to plain js objects (#​10682) (ae79054)

v5.31.1

Compare Source

Bug Fixes

• deps: align the tree-sitter version (#​10694) (6453290)
• deps: update vulnerable dependencies (#​10725) (23d6c26)
• utils: disallow schema type array value string (#​10691) (e87ecd7)
• validated support for OpenAPI 3.1.2 and updated docs (8bf8ed9)

Reverts

• Revert "fix(utils): disallow schema type array value string (#​10691)" (#​10710) (0a7ff5b)

v5.31.0

Compare Source

Features

• add dark mode (#​10653) (5f42eee), closes #​5327#​9964#​10089

v5.30.3

Compare Source

Bug Fixes

• deps: update vulnerable @​release-it/conventional-changelog to 10.0.2 (#​10645) (6acfc6e)
• deps: update vulnerable dependencies (js-yaml & glob) (#​10644) (03cf01b)
• utils: handle sanitizing multi-level relative paths (#​10640) (58aff59), closes #​4107

v5.30.2

Compare Source

Bug Fixes

• deps: bump react-syntax-highlighter to 16.0.0 (#​10620) (270d96d)

v5.30.1

Compare Source

Bug Fixes

• prevent webook from crashing in case of openapi 3.0 (#​10623) (e1ad309)

v5.30.0

Compare Source

Features

• deps: update ApiDOM to v1.0.0-rc.1 (#​10619) (5f013e9)

v5.29.5

Compare Source

Bug Fixes

• core: handle complex value stringification in Property component (#​10604) (0422415), closes #​10535
• correct spec paths for parameters, responses and request bodies (#​10609) (583c4fb)

v5.29.4

Compare Source

Bug Fixes

• core: refactor UNSAFE_ lifecycle methods in ContentType and OperationContainer (#​10373) (2814709), closes #​10212
• ignore rendering responses with extensions in the schema (#​10592) (23e3e00)
• include script in body (#​10593) (456274c)
• update vulnerable libxml2 to 2.13.9-r0 (#​10600) (8138154)
• use h1 for title heading to improve accessibility (#​10598) (c0bd7b6), closes #​10480

v5.29.3

Compare Source

Bug Fixes

• auth: ensure schema is immutable when persisting authorization (#​10588) (9124f59), closes #​10569

v5.29.2

Compare Source

Bug Fixes

• include oauth2-redirect.js in npm package distribution (#​10585) (443c011), closes #​10574

v5.29.1

Compare Source

Bug Fixes

• security: update Axios to non-vulnerable 1.12.2 version (#​10579) (54276b9)

v5.29.0

Compare Source

Features

• oauth2-redirect: externalize inline script for CSP compliance (#​10559) (35eb103)

v5.28.1

Compare Source

Bug Fixes

• provide polyfill for buffer in build (#​10554) (bbb1282), closes #​10553

v5.28.0

Compare Source

Features

• add initial support for React 19 (#​10551) (7a13771), closes #​10243

v5.27.1

Compare Source

Bug Fixes

• use open-cli instead of require('open') for Node 20+ compatibility (#​10517) (47a5c1f)

v5.27.0

Compare Source

Bug Fixes

• permissions of files to allow running as non-root (#​10515) (679e73b)
• sanitization of relative OpenAPI JSON paths (#​10528) (60dee8b)

Features

• json-schema: support x-additionalPropertiesName (#​10006) (4bada92)

v5.26.2

Compare Source

Bug Fixes

• style: restore paragraph spacing in parameter and response descriptions (#​10514) (efe6eb5)

v5.26.1

Compare Source

Bug Fixes

• oas3: reset request body values in try it out (#​9717) (32dd3af)

v5.26.0

Compare Source

Features

• release Swagger UI to Packagist (#​10513) (d48549f)

v5.25.4

Compare Source

Bug Fixes

• docker: bump nginx image to version 1.29.0-alpine to fix CVE-2025-48174 (#​10508) (94f0818)

v5.25.3

Compare Source

Bug Fixes

• fix opened model schema resolving issue on spec change (#​10509) (0ddc74d)

v5.25.2

Compare Source

Bug Fixes

• dist: provide correct npm token for swagger-ui-dist release (a9ce4bb)

v5.24.2: Swagger UI v5.24.2 Released!

Compare Source

Bug Fixes

• align expanded content inside expand collapse button (#​10497) (2574351)

v5.24.1: Swagger UI v5.24.1 Released!

Compare Source

Features

• oas3: show the schema tab in the Try it Out mode (#​10440) (ac106cd)

v5.24.0: Swagger UI v5.24.0 Released!

Compare Source

Bug Fixes

• mitigate ReDoS when generating examples from pattern (#​10477) (71c9314)
• packagist: exclude large obsolete directories from publishing to Packagist (#​10329) (cbd4b30)
• release: fix failed v5.23.0 release (8045f06)

Features

• json-schema-5-samples: add support for time format example generation (#​10420) (#​10421) (fc6fb24)

v5.22.0: Swagger UI v5.22.0 Released!

Compare Source

Bug Fixes

• assure parameter is an immutable map when grouping parameters (#​10457) (8577d71)
• avoid accessing properties of empty Example Objects (#​10453) (6a07ac8)
• docker: address CVE-2025-32414/CVE-2025-32415 (#​10461) (01e380e)
• json-schema-2020-12-samples: generate proper samples for XML atttributes (#​10459) (5d346fd)
• oauth2: avoid processing authorizationUrl when it is not a string (#​10452) (119052e)
• security: update Axios to non-vulnerable 1.9.0 version (#​10460) (c85865c)
• spec: assure operation is an immutable map in operations selectors (#​10454) (b6151d4)
• spec: avoid accessing $ref when path item is not an object (#​10456) (581d544)
• use spec compliant JSON Pointer implementation (#​10455) (2f0cbba)

Features

• observability: allow defining custom uncaught exception handler (#​10462) (0a438f2)

v5.21.0: Swagger UI v5.21.0 Released!

Compare Source

Bug Fixes

• align OpenAPI 3.x.y file uploads with specification (#​10409) (c29e712), closes #​9278
• json-schema-2020-12: infer type string when contentEncoding or contentMediaType is present (#​10411) (22adad3), closes #​9278

Features

• oas31: display file upload input when contentMediaType or contentEncoding keywords are present (#​10412) (2696730), closes #​9278

v5.20.8: Swagger UI v5.20.8 Released!

Compare Source

Bug Fixes

• docker: address multiple HIGH security vulnerabilities (#​10410) (6e0cc0e)

v5.20.7: Swagger UI v5.20.7 Released!

Compare Source

Bug Fixes

• style: prevent operationId from wrapping when space is available (#​10259) (da5935e)

v5.20.6: Swagger UI v5.20.6 Released!

Compare Source

Bug Fixes

• json-schema-2020-12-samples: use zero as default example value for int32 and int64 (#​10230) (7c346e7)
• json-schema-2020-12: use consistent comparison operators for displaying min/max constraints (#​10159) (d9c778e)

v5.20.5: Swagger UI v5.20.5 Released!

Compare Source

Bug Fixes

• utils: fix error messages for range validation of number parameters (#​10344) (a78278e)

v5.20.4: Swagger UI v5.20.4 Released!

Compare Source

Bug Fixes

• json-schema-2020-12-samples: fix examples for nullable primitive types defined as list of types (#​10390) (d375f50)

v5.20.3: Swagger UI v5.20.3 Released!

Compare Source

Bug Fixes

• json-schema-2020-12: avoid accessing properties of null schemas (#​10397) (d2fff7c)

v5.20.2: Swagger UI v5.20.2 Released!

Compare Source

Bug Fixes

• fix definition resolving being affected by the order of schemas (#​10386) (28f77cb), closes #​10096

v5.20.1: Swagger UI v5.20.1 Released!

Compare Source

Bug Fixes

• docker: fix security issues CVE-2024-56171, CVE-2025-24928 (#​10351) (3dc2cd6)
• security: fix CVE-2025-27152 in Axios comming from SwaggerClient/ApiDOM (swagger-client@3.34.2)

v5.20.0: Swagger UI v5.20.0 Released!

Compare Source

Bug Fixes

• docker: add OpenContainer labels
• json-schema-5: fix JumpToPath feature for schemas, closes swagger-api/swagger-editor#4035
• fix JumpToPath feature for auth methods
• display the correct name of security methods
• fix console errors appearing when security scheme is not defined
• components: render examples only when their shape is correct
• swagger-client: allow resolving URLs without extensions, closes swagger-api/apidom#4298
• css: fix css sourcemaps
• security: update axios to address CVE-2024-39338
• swagger-client: do not encode server variables, closes swagger-api/swagger-js#3656
• security: fix unsafe cookie serialization, addresses CVE-2024-47764, GHSA-pxg6-pf52-xh8x
• spec: compensate if OpenAPI.paths field is defined as unexpected structure
• json-schema-2020-12: check for schema type before extracting extension keywords, closes swagger-ui/issues#9376
• json-schema-2020-12: fix rendering of uniqueItems keyword
• json-schema-2020-12: fix overrides of JSON Schema extension keywords
• spec: clear JSON state when loading a new definition
• oas31: fix caching of JSON Schema 2020-12 context
• json-schema-2020-12: fix default expansion being applied to components after initial render
• json-schema-2020-12: fix complex schemas expanding beyond the default expansion depth
• json-schema-2020-12: fix deep expansion not expanding some of the keywords
• oas31: fix expansion of Schema Object fixed fields

Features

• swagger-ui-react: add support for initialState prop
• add horizontal scrollbar for schemas, refs swagger-api/swagger-ui#8940
• display schema of complex parameters
• display schema of complex request body properties
• json-schema-2020-12: allow to use fn outside of React context
• oas31: display schema of complex parameters with union type
• oas31: display schema of complex request body properties with union type
• oas31: display textarea for parameters with complex union type
• json-schema-2020-12: allow to use getTitle outside of JSON Schema 2020-12 context
• json-schema-2020-12: introduce system bound HOC
• json-schema-2020-12: add support for rendering extension keywords, closes swagger-ui/issues#9376
• json-schema-2020-12: add support for rendering examples keyword
• json-schema-2020-12: use JSON Viewer to display keywords with complex values
• json-schema-2020-12: handle empty objects and arrays in JSONViewer
• oas3: more support for OpenAPI 3.0.4
• introduce custom URL sanitization mechanism
• apply additional fixes for custom URL sanitization mechanism
• oas31: add support for OpenAPI extensions
• json-schema-2020-12: respect showExtensions config option

---

Attributions (alphabetical order)

@​char0n
@​glowcloud
@​robert-hebel-sb

v5.19.0: Swagger UI v5.19.0 Released!

Compare Source

Features

• add support for OpenAPI 3.0.4 (#​10247) (d437474)

v5.18.3: Swagger UI v5.18.3 Released!

Compare Source

Enhancements

• docker: document new SwaggerUI docker registry usage (#​10260) (9d6fdb2)

---

SwaggerUI Docker image is now served under the new authoritative registry URL:

Before:

$ docker pull swaggerapi/swagger-ui

Now:

$ docker pull docker.swagger.io/swaggerapi/swagger-ui

v5.18.2: Swagger UI v5.18.2 Released!

Compare Source

Bug Fixes

• update Scarf.js to v1.4.0 to avoid breaking Vitest (#​10204) (adc1c3c), closes #​10197

v5.18.1: Swagger UI v5.18.1 Released!

Compare Source

Bug Fixes

• docker: return explicit Node.js installation (#​10198) (3e3dfc6), closes #​10195

v5.18.0: Swagger UI v5.18.0 Released!

Compare Source

Features

• analytics: use Scarf.js to provide anonymized installation analytics (#​10194) (fb55b9c)

---

Anonymized analytics

SwaggerUI uses Scarf to collect anonymized installation analytics. These analytics help support the maintainers of this library and ONLY run during installation. To opt out, you can set the scarfSettings.enabled field to false in your project's package.json:

// package.json
{
// ...
"scarfSettings": {
"enabled": false
}
// ...
}

Alternatively, you can set the environment variable SCARF_ANALYTICS to false as part of the environment that installs your npm packages, e.g., SCARF_ANALYTICS=false npm install.

v5.17.14: Swagger UI v5.17.14 Released!

Compare Source

Bug Fixes

• system: remediate component wrapping functionality (#​9978) (8aa5292), closes #​9919

v5.17.13: Swagger UI v5.17.13 Released!

Compare Source

Bug Fixes

• swagger-ui-react: re-render on spec prop change (#​9966) (df03a8f), closes #​9965

v5.17.12: Swagger UI v5.17.12 Released!

Compare Source

Bug Fixes

• config: define missing default options and their types (#​9949) (04bbeaa), closes #​9945
• release: fix failed v5.17.11 release (a35a71e)
• swagger-client: fix OpenAPI 3.1.0 dereferencing (#​9950) (10e1a5f), closes #​9941

v5.17.10: Swagger UI v5.17.10 Released!

Compare Source

Bug Fixes

• components: add support for oneOf/anyOf JSON Schema keywords in parameter-row rendering (#​9934) (9037acf), closes #​7912
• oas31: fix initial rendering of the Webhooks section (#​9938) (b5c84f4), closes #​9937

v5.17.9: Swagger UI v5.17.9 Released!

Compare Source

Bug Fixes

• deps: allow to consolidate deps in downstream projects (#​9930) (335372d), closes #​9929

v5.17.8: Swagger UI v5.17.8 Released!

Compare Source

Bug Fixes

• components: fix rendering for empty examples in responses (#​9926) (94f2d82), closes #​9499
• swagger-client: resolve multiple path parameters with the same name in path templates, closes #​9928

v5.17.7: Swagger UI v5.17.7 Released!

Compare Source

Bug Fixes

• components: render parameter extensions in the description column (#​9883) (1367a8f)
• json-schema-5: allow collapsing for primitive models (#​9639) (450bb99), closes #​9595
• render null values included in enum (#​9683) (0dd9afa)

v5.17.6: Swagger UI v5.17.6 Released!

Compare Source

Bug Fixes

• swagger-ui-react: display definition defined as YAML or JSON string (#​9918) (6ae2c1f), closes #​9915
• system: allow wrapping components both from presets and plugins (#​9919) (877470b), closes #​7232

v5.17.5: Swagger UI v5.17.5 Released!

Compare Source

Bug Fixes

• config: perform configuration synchronously (5fa60ce)
• try-it-out: fix parsing null values when building requests (#​9914) (fc7410b)

v5.17.4: Swagger UI v5.17.4 Released!

Compare Source

Bug Fixes

• security: remove patch-package production dependency (#​9909) (cb9a06f)

v5.17.3: Swagger UI v5.17.3 Released!

Compare Source

Bug Fixes

• distribute proper source maps in npm distribution packages (#​9877) (8c90d5d), closes #​9101
• swagger-ui-react: call onComplete hook with system instance (#​9895) (3f67b08), closes [#​9876](https://redirect.github

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.