fix(tokenlist,contracts): replace unpinned Scalar CDN with @scalar/hono-api-reference#946
Open
decofe wants to merge 4 commits into
Open
fix(tokenlist,contracts): replace unpinned Scalar CDN with @scalar/hono-api-reference#946decofe wants to merge 4 commits into
decofe wants to merge 4 commits into
Conversation
…no-api-reference The Scalar API reference docs pages loaded `@scalar/api-reference` from jsdelivr CDN without version pinning or SRI, meaning any new npm publish could silently change the script running on our pages. Migrate both apps to the official `@scalar/hono-api-reference` Hono middleware, which pins the version via the npm dependency and generates the docs page server-side. Amp-Thread-ID: https://ampcode.com/threads/T-019e1c7a-506b-7059-912a-b9e2daf86379
Bundle Size Report
Chunk changes (>1KB)
Compared against main branch (baseline from 4/27/2026, 4:02:54 PM) |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Cloudflare Deployments
|
added 3 commits
May 12, 2026 14:20
Pass the config as a callback function directly to the Scalar middleware
instead of manually invoking the returned handler. This resolves the
TS2345 type error where Context<{ Bindings: Cloudflare.Env }> was not
assignable to Context<Env>.
Amp-Thread-ID: https://ampcode.com/threads/T-019e1c7a-506b-7059-912a-b9e2daf86379
The Scalar callback form loses the Hono generic bindings type, causing 'context.env is possibly undefined' and 'VITE_BASE_URL does not exist' errors. Use a typed route handler that invokes the Scalar middleware inline instead. Amp-Thread-ID: https://ampcode.com/threads/T-019e1c7a-506b-7059-912a-b9e2daf86379
The @scalar/hono-api-reference middleware returns a handler typed for
generic Env, which is incompatible with Hono<{ Bindings: Cloudflare.Env }>.
Instead, import renderApiReference from @scalar/client-side-rendering
(the underlying rendering function) and call context.html() directly.
This preserves the typed Cloudflare bindings context while still pinning
the Scalar version via npm.
Verified locally: both tokenlist and contract-verification pass
check:types and check:biome.
Amp-Thread-ID: https://ampcode.com/threads/T-019e1c7a-506b-7059-912a-b9e2daf86379
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The Scalar API reference docs pages in
tokenlistandcontract-verificationloaded@scalar/api-referencefrom the jsdelivr CDN without version pinning or SRI hashes. Any new npm publish of that package could silently change the script running on our pages — a supply-chain risk.Changes
@scalar/hono-api-reference(^0.10.14) to the pnpm workspace catalog and both apps' dependencies.<script>tag indocs.tsxwithScalar()from@scalar/hono-api-reference. Updatedindex.tsxto use the returned Hono handler directly.renderDocs()(raw HTML + CDN tag) inroute.docs.tsxwith theScalar()middleware, preserving the dynamicbaseUrland all server entries.Why this is safer
The
@scalar/hono-api-referencemiddleware generates the docs page server-side using the version pinned inpackage.json/ lockfile, eliminating the unpinned CDN dependency.