From 8492a2c422f0d883922c7352b9f41c55d1815ae4 Mon Sep 17 00:00:00 2001
From: lbellows <liam@lbellows.com>
Date: Tue, 29 Sep 2026 21:14:03 -0400
Subject: [PATCH] fix: update swagger-ui to 5.29.1 and add SRI hashes

---
 docs/ui.go      |  6 +++---
 docs/ui_test.go | 10 ++++++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/docs/ui.go b/docs/ui.go
index 05ab8bc83..579b5a458 100644
--- a/docs/ui.go
+++ b/docs/ui.go
@@ -9,7 +9,7 @@ var ui = `
   <head>
     <meta charset="UTF-8">
     <title>Swagger UI</title>
-    <link rel="stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.15.5/swagger-ui.css" >
+    <link rel="stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/5.29.1/swagger-ui.css" integrity="sha512-eZpfl9qlKnbDvlJ2brfdx3nhlP1FMsA23w65motxKdYsUcfMcdO2bcLPr7mXhvyzmDZwuzYCJKrl/sEo1ditVQ==" crossorigin="anonymous" referrerpolicy="no-referrer" >
     <link rel="icon" type="image/png" href="./favicon-32x32.png" sizes="32x32" />
     <link rel="icon" type="image/png" href="./favicon-16x16.png" sizes="16x16" />
     <style>
@@ -36,8 +36,8 @@ var ui = `
   <body>
     <div id="swagger-ui"></div>
 
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.15.5/swagger-ui-bundle.js"> </script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.15.5/swagger-ui-standalone-preset.js"> </script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/5.29.1/swagger-ui-bundle.js" integrity="sha512-iDdi6WwSTimAFh1NhPyFZpHJWr16m/PupHztElqQL+gQoQDavUATsP9hcvgs9Yci+EUA//WvZYZsCTDhRDKc3g==" crossorigin="anonymous" referrerpolicy="no-referrer"> </script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/5.29.1/swagger-ui-standalone-preset.js" integrity="sha512-oGq+mP+3XUyYDm9vsprsd6YdhOokdkcLNUZnmEE6HJzG0F9fIaB8kgGZsjdfTWN8w/1f2kN4a/0xkla0hsetcQ==" crossorigin="anonymous" referrerpolicy="no-referrer"> </script>
     <script>
     function getBaseURL() {
       var path = window.location.pathname
diff --git a/docs/ui_test.go b/docs/ui_test.go
index 806bb2e6f..eef3743f3 100644
--- a/docs/ui_test.go
+++ b/docs/ui_test.go
@@ -2,6 +2,7 @@ package docs
 
 import (
 	"net/http/httptest"
+	"regexp"
 	"testing"
 
 	"github.com/gin-gonic/gin"
@@ -22,3 +23,12 @@ func TestUI(t *testing.T) {
 	content := recorder.Body.String()
 	assert.NotEmpty(t, content)
 }
+
+func TestUIExternalResourcesHaveIntegrity(t *testing.T) {
+	tags := regexp.MustCompile(`<(?:script|link)[^>]*https://[^>]*>`).FindAllString(ui, -1)
+	assert.Len(t, tags, 3)
+	for _, tag := range tags {
+		assert.Regexp(t, `integrity="sha512-[A-Za-z0-9+/=]+"`, tag)
+		assert.Contains(t, tag, `crossorigin="anonymous"`)
+	}
+}