Repository navigation
chore(deps): update dependency @redocly/cli to v2.57.0 - #7455
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
from
October 11, 2026 23:15
0fb9c12 to
3b66beb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.31.5→2.57.0Release Notes
Redocly/redocly-cli (@redocly/cli)
v2.57.0Compare Source
Minor Changes
Added
constchecking to theno-enum-type-mismatchrule: aconstvalue must conform to the schema'stype, the same way everyenumvalue does.Note: linting output may include new errors for schemas whose
constvalue doesn't match theirtype.Patch Changes
no-enum-type-mismatchdropped violations and reported a wrong location whentypewas written as an array.v2.56.1Compare Source
Patch Changes
v2.56.0Compare Source
Minor Changes
bundlecommand output.Pass overlays with the new
--overlayoption or list them underoverlaysfor an API inredocly.yaml.copyaction field, the$selffield, and reusable actions incomponents.actions.The
spec-ref-siblingsrule now checks the fields next to a reusable action$refin Overlay documents.Patch Changes
respectfailed with an unexpected error when a step used anoperationIdwithout the$sourceDescriptions.<name>.prefix and the Arazzo file also listed anarazzosource description.Such
operationIds are looked up in theopenapisource descriptions only.undicito the6.29.0version.v2.55.0Compare Source
Minor Changes
--replaceoption to thepushcommand.--replaceremoves the files under the mount path that are not part of the push.Patch Changes
respectso known secrets are masked in non-JSON request bodies, such asapplication/x-www-form-urlencodedtoken requests.respectso a step fails with a clear error when a runtime expression embedded in a string has no value, such asBearer {$outputs.accessToken}.workflow-dependsOnrule reported a duplicate when different workflows listed the same workflow independsOn.v2.54.3Compare Source
Patch Changes
application/gzip,application/x-tar), PDF files, Office documents, audio, video and font responses as JSON instead of decoding them as binary.REDOCLY_ENVIRONMENTenvironment variable to theuser-agentheader of thelogin,push, andpush-statusrequests.v2.54.2Compare Source
Patch Changes
v2.54.1Compare Source
v2.54.0Compare Source
v2.53.3Compare Source
Patch Changes
respectso a same-workflowgotono longer cleared$stepsoutputs from steps that already ran.Previously, this broke $steps expressions in the target step.
v2.53.2Compare Source
Patch Changes
startandendline and column positions to each problem location in the--format=jsonlint output.v2.53.1Compare Source
Patch Changes
build-docscommand about the upcoming switch to Redoc 3.v2.53.0Compare Source
Minor Changes
disallowDefaultoption to theoperation-2xx-responserule, which requires an explicit 2xx response when enabled.There is no change in current behavior.
Patch Changes
v2.52.1Compare Source
Patch Changes
redocto the2.5.4version to fix accessibility problems in the HTML produced bybuild-docs.Added the
langattribute to the defaultbuild-docstemplate.v2.52.0Compare Source
Minor Changes
redocly-clifor everyday CLI usage,redocly-lint-rulesfor writing configurable rules and custom plugins.Install them with
npx skills add https://redocly.com.inspect-node-typescommand to navigate the Redocly's node type tree of an API description.inspect-node-typeshelps pick the correctsubjecttypes for a configurable rule or the correct visitor for a custom plugin.strategyoption to thecomponent-name-uniquerule, matching the--component-names-strategyoption of thebundlecommand.introspect-mcpcommand that analyzes a running MCP server and records its tools, prompts, resources, and capabilities.introspect-mcprecords its findings in thex-mcpextension of an OpenAPI description.Patch Changes
v2.51.2Compare Source
Patch Changes
fast-urito the3.1.7version to resolveCVE-2026-75931,CVE-2026-75975,CVE-2026-75899, andCVE-2026-76172.driftandcoveragefailing to match a path template whose segment mixes literal text with parameters, such as/instances/{worldId}:{instanceId}.v2.51.1Compare Source
Patch Changes
generate-arazzoproduced a malformed remote description URL insourceDescriptions(https://collapsed tohttps:/) when--output-filewas provided.$faker.string.email()used without options generated addresses at theundefined.comdomain.@faker-js/fakerto the10.6.0version to resolve the high severity advisoryGHSA-qxc2-j82w-r537.v2.51.0Compare Source
Minor Changes
generate-arazzocommand to print a ready-to-runrespectcommand after generation, including an--inputplaceholder for every workflow input.--with-ai,--ai-provider,--ai-model,--ai-concurrency, and--max-workflowsoptions to thegenerate-arazzocommand.--with-aiuses a local AI CLI (claude,codex, orcursor) and OpenAPI descriptions to redesign the generated one-workflow-per-operation skeleton into multi-step workflows.The AI designs at most
--max-workflowsworkflows (default 10), and the generated file is marked as AI-inferred.For descriptions that don't fit a single prompt, the AI first selects scenarios from a compact operation index, then it designs each workflow separately.
Patch Changes
respectand thex-security-scheme-required-valuesrule incorrectly rejectedx-securityHTTP schemes written with non-lowercase casing (such asBasic,Bearer, orDigest).RFC 7235 scheme names are case-insensitive.
v2.50.0Compare Source
Minor Changes
schemaassertion for configurable rules.The assertion validates a property value against a JSON Schema.
Patch Changes
v2.49.1Compare Source
Patch Changes
$refs pointed to the same path item.v2.49.0Compare Source
Minor Changes
Added the
no-illogical-composition-keywordsrule.Note: the rule is set to
warnin therecommendedruleset and toerrorinrecommended-strict. Existing API descriptions may report new problems.Patch Changes
npmwas not available.v2.48.0Compare Source
Minor Changes
python,go,php, andcligenerators beside the TypeScript client, each self-documenting with--docs, configurable per generator, and available as source in your own repository througheject-generator.Patch Changes
bundlecommand didn't resolve$refs inside an AsyncAPI 3 Multi Format Schema Object.respect --har-outputrecorded an emptypostDatafor every request.Request bodies are written to the HAR.
Captures replayed through
driftcan have their request bodies validated instead of silently passing.v2.47.0Compare Source
Minor Changes
statscommand that reports how many distinctx-extensions a description file uses and how often each one occurs.Patch Changes
statscommand reporting wrong parameter count for AsyncAPI descriptions.v2.46.2Compare Source
Patch Changes
v2.46.1Compare Source
Patch Changes
@redocly/ajvto^8.18.3.v2.46.0Compare Source
Minor Changes
spec-ref-siblingsrule that reports properties placed next to a$refwhich the specification does not allow.Patch Changes
v2.45.0Compare Source
Minor Changes
bundlecommand losing schema keywords (such astitle,properties, orrequired) written next to a$refwhen the referenced schemas started with their own$ref.Patch Changes
v2.44.2Compare Source
Patch Changes
security-definedrule for AsyncAPI 2.x and 3.x in therecommendedruleset fromerrortowarn.AsyncAPI descriptions with undefined or unresolved security no longer fail linting by default.
v2.44.1Compare Source
Patch Changes
undicito the6.28.0version.operation-4xx-problem-details-rfc7807rule incorrectly reported thetypeandtitleproperties inherited throughallOfas missing.v2.44.0Compare Source
Minor Changes
Added the
no-duplicated-enum-valuesrule that requires all values in anenumto be unique.The rule is enabled at the
warnlevel in therecommendedruleset.Note: linting output may include new warnings for API descriptions that contain duplicated enum values.
Added the
no-unsafe-markdownrule that disallows potentially executable content indescriptionfields.The rule is enabled at the
warnlevel in therecommendedruleset.Note: linting output may include new warnings for
descriptionfields that contain potentially executable content.Patch Changes
v2.43.3Compare Source
Patch Changes
v2.43.2Compare Source
Patch Changes
v2.43.1Compare Source
Patch Changes
v2.43.0Compare Source
Patch Changes
v2.42.0Compare Source
Minor Changes
generate-clientcommand that generates a typed, zero-dependency TypeScript client from an OpenAPI description — auth, retries, middleware, typed SSE streaming, pagination, and multipart included — plus optional companion generators for Zod validation, TanStack Query and SWR hooks, MSW mocks, and date transformers.See the
generate-clientcommand reference and the Use the generated client guide.Patch Changes
v2.41.2Compare Source
Patch Changes
Updated js-yaml from
5.2.1to5.2.2to resolve a vulnerability in YAML parsing.Added support for the Arazzo spec-compliant workflow reference form
$sourceDescriptions.<name>.<workflowId>independsOn, stepworkflowId, and success/failure actionworkflowId.Unresolvable workflow references fail only the affected workflow with a clear error message, and no longer abort the whole run or pass unnoticed.
Updated @redocly/openapi-core to v2.41.2.
Updated @redocly/respect-core to v2.41.2.
v2.41.1Compare Source
Patch Changes
driftcommand'sschema-consistencyrule reported false-positive findings foroneOfschemas with adiscriminator.Payloads are validated only against the branch selected by the discriminator value instead of every
oneOfbranch.Schemas whose discriminator does not meet Ajv's structural requirements keep the previous behavior.
driftcommand's built-in undocumented-header ignore list withx-amz-,x-amzn-andx-github-prefixes, and thex-hub-signature/x-hub-signature-256webhook signature headers.v2.41.0Compare Source
Minor Changes
security-scopes-definedthat requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme.The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in
requireScopesoption that requires OAuth2 security requirements to list at least one scope.Patch Changes
respectwhere the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed.cursorAI provider of thegenerate-speccommand sent only the instructions to the model and the operation to refine never reached it.v2.40.0Compare Source
Minor Changes
--ignore-headersoption to the experimentaldriftandproxycommands.It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing
*matches by prefix (for examplex-consumer-*).Use it to silence headers a gateway or proxy adds that are not part of the API contract.
generate-speccommand that infers an OpenAPI description from recorded HTTP traffic.Patch Changes
Fixed the
driftcommand'sschema-consistencyrule reporting false-positive "Undocumented query parameter" findings fordeepObject-style query parameters.Traffic keys like
namespace[id]=...&namespace[name]=...are now matched to the documentednamespaceparameter, and the reconstructed object is validated against the parameter schema.Fixed an issue where the
driftcommand'sschema-consistencyrule reported false-positive request findings for exchanges the server rejected with a4xxclient error.For example: missing required parameter, missing required body, request-body schema mismatch.
A
4xxresponse means the server never accepted the request.Validating it against the operation's success-path contract flagged the server's own correct rejection as drift.
Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.
Fixed an issue where the
joincommand silently dropped path-levelx-*extensions with non-string values.Updated js-yaml from
4.2.0to5.2.1.Fixed an issue where strings that look like numbers with underscores (for example
'12_34') had quotation marks removed by thebundlecommand.These strings stay quoted in the output.
Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error.
Parse errors are reported at the offending token instead of the end of the document.
Fixed an issue where the
driftcommand'ssecurity-baselinerule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example:localhost,*.localhost,127.0.0.0/8,[::1].Sandboxed recordings no longer produce transport warnings.
Fixed an issue where the
bundlecommand rewrote internal$refs pointing to other$refs.The issue caused AsyncAPI 3 operation
messagesreferences to point tocomponentsinstead of channel messages.Updated @redocly/openapi-core to v2.40.0.
v2.39.0Compare Source
Minor Changes
structrule to validate the contents of AsyncAPI protocol-specific bindings.Added typed definitions for the
sns,sqs,ibmmq,googlepubsub,pulsarandros2bindings.Patch Changes
v2.38.0Compare Source
Minor Changes
driftcommand that compares recorded HTTP traffic (HAR, Kong, Nginx/Apache JSON, NDJSON) against an OpenAPI description and reports undocumented endpoints, schema mismatches, and security findings.proxycommand that captures live HTTP traffic through a reverse proxy into a HAR file and optionally validates it against an OpenAPI description in real time.Patch Changes
v2.37.0Compare Source
Minor Changes
.graphql/.gql).Patch Changes
v2.36.0Compare Source
Minor Changes
build-docs, ensuring the script's integrity.v2.35.1Compare Source
Patch Changes
undicito the6.27.0version.v2.35.0Compare Source
Minor Changes
lintcommand.spec-step-mutually-exclusive-fieldsArazzo rule to flag steps that use more than one mutually exclusive operation field (operationId,operationPath,workflowId,channelPath, orx-operation).v2.34.0Compare Source
Minor Changes
Improved CLI install speed by bundling the CLI into a dependency-free package.
Warning: The published package no longer ships runtime dependencies in
node_modules.Plugins that relied on importing packages hoisted from the CLI (such as
@redocly/openapi-core) must now declare those packages as their own dependencies.v2.33.2Compare Source
Patch Changes
splitcommand that might have written files outside the chosen--outDir.v2.33.1Compare Source
Patch Changes
v2.33.0Compare Source
Minor Changes
--component-names-strategyoption to thebundlecommand.This option allows a choice of how inline Schema components are named:
basename(default) ortitle(from each schema'stitlefield).Patch Changes
v2.32.2Compare Source
Patch Changes
v2.32.1Compare Source
Patch Changes
v2.32.0Compare Source
Minor Changes
junitoutput in thelintcommand.Patch Changes
v2.31.6Compare Source
Patch Changes
lint --format=checkstyleto produce a single combined XML document when multiple APIs are passed to the command, instead of concatenated per-file documents.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.