disable "/v3/api-docs", and "/swagger-ui.html" by default and upgrade to Scalar 0.2.1

[zakaria-shahen]

Disable SpringDoc by default to maintain alignment with Scalar (scalar/scalar#6781) and ensure that the default configuration follows secure-by-default principles.

[bnasslahsen]

i have merged with the latest version.
We prefer to keep scalar enabled by default.
If someone, is interested to disable it - it can be changed through property.

[zakaria-shahen]

@bnasslahsen

Making it disabled by default would be better. You could introduce a new property like springdoc.scalar.enabled to allow users to enable or disable it, rather than relying on scalar.enabled.

From previous experience, I've found that people typically disable SpringDoc via springdoc.swagger-ui.enabled only in production profiles, without realizing for several months that their other endpoints remain exposed to the internet through /v3/api-docs.

You might say this is a noob mistake, but in reality, the mistake is made by principal-level developers, and it passes both internal and external penetration testing. No one catches it for months in production, until a curious junior developer (me at one of my previous companies) discovers it by accident.

There may still be other systems/companies where this issue hasn't been discovered yet, so it's better to disable it by default and ensure users familiarize themselves with your library before enabling it.

Note that I sent the same concern to Scalar via email, and they accepted it: scalar/scalar#6781 (Of course, I also sent the same concern to SpringDoc via email)

I agree with you that it may seem overkill, but when you look at it from the user's perspective, it makes sense.

Also, in 2024, the CVE board updated the CNA rules, including the following:

• 4.1.4 Insecure default configuration settings SHOULD be determined to be vulnerabilities

So what do you think?

Thank you for your effort in providing the Spring ecosystem with this library which makes our lives easier.

[jimisola]

This change seems like a breaking change. Does not SpringDoc use semantic versioning?