Repository navigation
fix(deps): update dependency @redocly/cli to v2.71.1 - #53
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
Branch automerge failureThis PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
|
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
2 times, most recently
from
August 12, 2026 16:42
8e61437 to
b42a869
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
2 times, most recently
from
August 13, 2026 14:15
ea26098 to
f056a15
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
from
August 14, 2026 21:04
f056a15 to
5b77d21
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
4 times, most recently
from
August 18, 2026 10:15
e76599e to
a4af952
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
13 times, most recently
from
August 25, 2026 14:17
5eacc3c to
a5c9fa2
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
2 times, most recently
from
August 26, 2026 03:01
e0d3976 to
ad4b427
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
7 times, most recently
from
September 2, 2026 09:45
ccce087 to
9bacafb
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
3 times, most recently
from
September 3, 2026 19:07
01b2980 to
088b5ae
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
11 times, most recently
from
September 8, 2026 13:54
4c77501 to
f958295
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
3 times, most recently
from
September 9, 2026 20:19
d27fed1 to
9fefaea
Compare
renovate
Bot
force-pushed
the
renovate/redocly-cli-2.x
branch
from
September 10, 2026 01:37
9fefaea to
3996efc
Compare
| datasource | package | from | to | | ---------- | ------------ | ------ | ------ | | npm | @redocly/cli | 2.43.3 | 2.71.1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.43.3→2.71.1Release Notes
Redocly/redocly-cli (@redocly/cli)
v2.71.1Compare Source
Patch Changes
writeOnlyproperties in response types, mock data that broke the API description, and generated code that failed strict type checks.v2.71.0Compare Source
Minor Changes
project pr createandproject pr statuscommands to open a pull request in Redocly platform for the current branch of a cloned project and to show its status.Patch Changes
v2.70.0Compare Source
Minor Changes
build-docscommand to Redoc 3 and added support for AsyncAPI descriptions and GraphQL schemas.Added the
--openapi,--asyncapi,--graphql, and--inlineBundleoptions.Removed
--theme.openapiand--disableGoogleFont, pass Redoc options with--openapiinstead.Some Redoc 2 options were renamed or removed, see the
build-docsdocumentation.The command now applies the decorators and preprocessors from the configuration file.
Pages built with the
build-docscommand now send Redoc telemetry from readers' browsers by default.v2.69.0Compare Source
Minor Changes
previewcommand now runs@redocly/frameworkand accepts thepro,scaleandenterpriseplans with the--planoption.A project whose
package.jsonlists@redocly/realm,@redocly/redoc,@redocly/revel,@redocly/reefor one of their blends still previews with that package.The
--productoption is deprecated.v2.68.0Compare Source
Minor Changes
parametersfield of Arazzo 1.1.0 success and failure actions to therespectcommand.When an action references a workflow with
workflowId,respectpasses the action's parameters to that workflow as inputs.Patch Changes
Fixed an issue where the
structrule didn't report Arazzo 1.1.0 success and failure actions that hadparameterswithout aworkflowId, or action parameters with aninfield.Action parameters are passed as inputs to the target workflow, so they require a
workflowIdand can't have aninfield.Existing Arazzo descriptions with these actions fail
lint, andrespectdoesn't run them.Fixed an issue where
respectdidn't retry a step when itsretryfailure action had noretryLimit.Note: Previously, a workflow continued with the next step after a step had failed and used up its retries.
Fixed an issue where
respectskipped aretryfailure action after an earlierretryaction of the same step had used up its retries.Updated @redocly/openapi-core to v2.68.0.
Updated @redocly/respect-core to v2.68.0.
v2.67.1Compare Source
Patch Changes
respectcommand kept the inputs that a step passed to a workflow in the same file.Later runs of that workflow used them instead of their
--inputvalues or schema defaults.v2.67.0Compare Source
Minor Changes
excludedMethodsoption to theoperation-4xx-responserule, which skips operations that use the listed HTTP methods.Patch Changes
v2.66.1Compare Source
Patch Changes
oneOf.v2.66.0Compare Source
Minor Changes
skillscommand that installs the Redocly CLI agent skills for AI coding agents.Patch Changes
v2.65.1Compare Source
Patch Changes
Fixed the
no-schema-type-mismatchrule to reportpropertieson any non-objecttype anditemson any non-arraytype, such astype: stringwithproperties.Previously, the rule only reported
propertiesonarrayanditemsonobject.Note: Because the rule is an error in the
recommendedruleset, descriptions that passed before may now fail.Fixed an issue where the
structrule incorrectly reported an error fortype: filein response schemas of OpenAPI 2.0 API descriptions.Updated @redocly/openapi-core to v2.65.1.
v2.65.0Compare Source
Minor Changes
--openapi-versionoption to thegenerate-speccommand to choose between OpenAPI3.1and3.2(the default) for the generated description.Patch Changes
capitalizationassertion inrecheckrules so that it names the style, such as "sentence case", instead of printing$sentence.redocly recheck --fixso that the report lists only the findings that remain after the fixes, not the findings it just fixed.redocly recheck --fixsummary so that inserted text with a line break prints as\ninstead of breaking the output line.v2.64.1Compare Source
Patch Changes
respectcommand altered string values in runtime expressions that contained a dot followed by a digit.For example, a token read through
$response.body#/tokenor a quoted value in success criteria.lintandbundlecrashed withUnknown type name found: stringon OpenAPI 3.2 descriptions that had adeviceAuthorizationOAuth flow with non-emptyscopes.v2.64.0Compare Source
Minor Changes
onSettledmiddleware hook to the generated TypeScript client.Added the
client.telemetryoption to thegenerate-clientcommand.Patch Changes
v2.63.0Compare Source
Minor Changes
Added the
body-linkpagination style to thegenerate-clientcommand.Generated clients use it to follow the next page URL from a field in the response, set with the
nextLinkoption.The
tanstack-querygenerator also creates infinite query options for these operations.Patch Changes
AbortSignal.timeout()orAbortSignal.any(). Timed-out requests correctly throwTimeoutErrorinstead ofAbortErrorin Chrome 103–123.v2.62.2Compare Source
Patch Changes
loginandpushdid not exit after a request through a proxy timed out.login,push, and other Reunite commands failed on Node.js 26.Updated
undicito the7.30.0version.handlebarsto4.7.10to resolveCVE-2026-106444,CVE-2026-106445, andCVE-2026-106446.respectcommand ignored the--mtlscertificates when a request went through a proxy.v2.62.1Compare Source
Patch Changes
project clonecommand so that Git keeps finding its credential helper after a clone run withnpxorpnpm dlx.v2.62.0Compare Source
Minor Changes
in: querystringparameters to the experimentaldriftcommand.The command validates the whole query string against the parameter's schema, instead of reporting every query key as undocumented.
In
--coverage, each key of a form-urlencoded querystring schema counts as a separate parameter.project clonecommand to work with a Redocly-hosted Reunite project as a Git repository.Patch Changes
schema-consistencyrule of thedriftcommand so that a requiredreadOnlyproperty in a parameter schema is no longer reported as missing from the request.v2.61.0Compare Source
Minor Changes
A stream body is sent as is in one attempt, and the caller's
Content-Typewins over the one in the API description.Patch Changes
Update to Node.js 22.12.0 or higher.
@modelcontextprotocol/sdkto1.32.1to resolveGHSA-6qxp-vccf-f47h.v2.60.0Compare Source
Minor Changes
--file-name-conflicts-severityoption for thesplitcommand to control how file name conflicts are reported.Patch Changes
Fixed an issue where
splitlost content when two components, paths, webhooks, channels, operations, or code samples got the same file name.Warning:
splitoutput may differ from older releases: when several names would share one file, each later file now gets a-nsuffix, wherenis its order, for exampleuser-2.yamlnext toUser.yaml.v2.59.0Compare Source
Minor Changes
Improved
redocly recheckto lint thedescriptionfields of API descriptions.Findings report the source line and column.
You can suppress the findings by file, rule, and pointer, or adjust rules for descriptions only.
Note:
ResolvedRecheckConfiggains a requireddescriptionRulesfield.Library code that builds that object by hand must set it.
Patch Changes
brace-expansionto2.1.7and5.0.12,dompurifyto3.4.16,fast-urito3.1.8, andjs-yamlto5.4.3to resolveCVE-2026-102276,CVE-2026-102277,CVE-2026-102278,CVE-2026-86472,GHSA-p98j-92pf-mc4p, andGHSA-r3ph-w7gj-g6xm.oxfmtto0.72.0andtinypoolto2.2.0to resolveCVE-2026-104848andCVE-2026-104849.proxy-addrto2.0.8andsource-map-jsto1.2.2to resolveCVE-2026-90711andCVE-2026-93749.v2.58.2Compare Source
Patch Changes
Undefined constant "OPERATIONS"when OPcache preload was enabled.v2.58.1Compare Source
Patch Changes
no-invalid-media-type-examples,no-invalid-schema-examples, andno-invalid-parameter-examplesrules by reusing validators for schemas that are referenced or repeated.v2.58.0Compare Source
v2.57.0Compare Source
Minor Changes
Added
constchecking to theno-enum-type-mismatchrule: aconstvalue must conform to the schema'stype, the same way everyenumvalue does.Note: linting output may include new errors for schemas whose
constvalue doesn't match theirtype.Patch Changes
no-enum-type-mismatchdropped violations and reported a wrong location whentypewas written as an array.v2.56.1Compare Source
Patch Changes
v2.56.0Compare Source
Minor Changes
bundlecommand output.Pass overlays with the new
--overlayoption or list them underoverlaysfor an API inredocly.yaml.copyaction field, the$selffield, and reusable actions incomponents.actions.The
spec-ref-siblingsrule now checks the fields next to a reusable action$refin Overlay documents.Patch Changes
respectfailed with an unexpected error when a step used anoperationIdwithout the$sourceDescriptions.<name>.prefix and the Arazzo file also listed anarazzosource description.Such
operationIds are looked up in theopenapisource descriptions only.undicito the6.29.0version.v2.55.0Compare Source
Minor Changes
--replaceoption to thepushcommand.--replaceremoves the files under the mount path that are not part of the push.Patch Changes
respectso known secrets are masked in non-JSON request bodies, such asapplication/x-www-form-urlencodedtoken requests.respectso a step fails with a clear error when a runtime expression embedded in a string has no value, such asBearer {$outputs.accessToken}.workflow-dependsOnrule reported a duplicate when different workflows listed the same workflow independsOn.v2.54.3Compare Source
Patch Changes
application/gzip,application/x-tar), PDF files, Office documents, audio, video and font responses as JSON instead of decoding them as binary.REDOCLY_ENVIRONMENTenvironment variable to theuser-agentheader of thelogin,push, andpush-statusrequests.v2.54.2Compare Source
Patch Changes
v2.54.1Compare Source
v2.54.0Compare Source
v2.53.3Compare Source
Patch Changes
respectso a same-workflowgotono longer cleared$stepsoutputs from steps that already ran.Previously, this broke $steps expressions in the target step.
v2.53.2Compare Source
Patch Changes
startandendline and column positions to each problem location in the--format=jsonlint output.v2.53.1Compare Source
Patch Changes
build-docscommand about the upcoming switch to Redoc 3.v2.53.0Compare Source
Minor Changes
disallowDefaultoption to theoperation-2xx-responserule, which requires an explicit 2xx response when enabled.There is no change in current behavior.
Patch Changes
v2.52.1Compare Source
Patch Changes
redocto the2.5.4version to fix accessibility problems in the HTML produced bybuild-docs.Added the
langattribute to the defaultbuild-docstemplate.v2.52.0Compare Source
Minor Changes
redocly-clifor everyday CLI usage,redocly-lint-rulesfor writing configurable rules and custom plugins.Install them with
npx skills add https://redocly.com.inspect-node-typescommand to navigate the Redocly's node type tree of an API description.inspect-node-typeshelps pick the correctsubjecttypes for a configurable rule or the correct visitor for a custom plugin.strategyoption to thecomponent-name-uniquerule, matching the--component-names-strategyoption of thebundlecommand.introspect-mcpcommand that analyzes a running MCP server and records its tools, prompts, resources, and capabilities.introspect-mcprecords its findings in thex-mcpextension of an OpenAPI description.Patch Changes
v2.51.2Compare Source
Patch Changes
fast-urito the3.1.7version to resolveCVE-2026-75931,CVE-2026-75975,CVE-2026-75899, andCVE-2026-76172.driftandcoveragefailing to match a path template whose segment mixes literal text with parameters, such as/instances/{worldId}:{instanceId}.v2.51.1Compare Source
Patch Changes
generate-arazzoproduced a malformed remote description URL insourceDescriptions(https://collapsed tohttps:/) when--output-filewas provided.$faker.string.email()used without options generated addresses at theundefined.comdomain.@faker-js/fakerto the10.6.0version to resolve the high severity advisoryGHSA-qxc2-j82w-r537.v2.51.0Compare Source
Minor Changes
generate-arazzocommand to print a ready-to-runrespectcommand after generation, including an--inputplaceholder for every workflow input.--with-ai,--ai-provider,--ai-model,--ai-concurrency, and--max-workflowsoptions to thegenerate-arazzocommand.--with-aiuses a local AI CLI (claude,codex, orcursor) and OpenAPI descriptions to redesign the generated one-workflow-per-operation skeleton into multi-step workflows.The AI designs at most
--max-workflowsworkflows (default 10), and the generated file is marked as AI-inferred.For descriptions that don't fit a single prompt, the AI first selects scenarios from a compact operation index, then it designs each workflow separately.
Patch Changes
respectand thex-security-scheme-required-valuesrule incorrectly rejectedx-securityHTTP schemes written with non-lowercase casing (such asBasic,Bearer, orDigest).RFC 7235 scheme names are case-insensitive.
v2.50.0Compare Source
Minor Changes
schemaassertion for configurable rules.The assertion validates a property value against a JSON Schema.
Patch Changes
v2.49.1Compare Source
Patch Changes
$refs pointed to the same path item.v2.49.0Compare Source
Minor Changes
Added the
no-illogical-composition-keywordsrule.Note: the rule is set to
warnin therecommendedruleset and toerrorinrecommended-strict. Existing API descriptions may report new problems.Patch Changes
npmwas not available.v2.48.0Compare Source
Minor Changes
python,go,php, andcligenerators beside the TypeScript client, each self-documenting with--docs, configurable per generator, and available as source in your own repository througheject-generator.Patch Changes
bundlecommand didn't resolve$refs inside an AsyncAPI 3 Multi Format Schema Object.respect --har-outputrecorded an emptypostDatafor every request.Request bodies are written to the HAR.
Captures replayed through
driftcan have their request bodies validated instead of silently passing.v2.47.0Compare Source
Minor Changes
statscommand that reports how many distinctx-extensions a description file uses and how often each one occurs.Patch Changes
statscommand reporting wrong parameter count for AsyncAPI descriptions.v2.46.2Compare Source
Patch Changes
v2.46.1Compare Source
Patch Changes
@redocly/ajvto^8.18.3.v2.46.0Compare Source
Minor Changes
spec-ref-siblingsrule that reports properties placed next to a$refwhich the specification does not allow.Patch Changes
v2.45.0Compare Source
Minor Changes
bundlecommand losing schema keywords (such astitle,properties, orrequired) written next to a$refwhen the referenced schemas started with their own$ref.Patch Changes
v2.44.2Compare Source
Patch Changes
security-definedrule for AsyncAPI 2.x and 3.x in therecommendedruleset fromerrortowarn.AsyncAPI descriptions with undefined or unresolved security no longer fail linting by default.
v2.44.1Compare Source
Patch Changes
undicito the6.28.0version.operation-4xx-problem-details-rfc7807rule incorrectly reported thetypeandtitleproperties inherited throughallOfas missing.v2.44.0Compare Source
Minor Changes
Added the
no-duplicated-enum-valuesrule that requires all values in anenumto be unique.The rule is enabled at the
warnlevel in therecommendedruleset.Note: linting output may include new warnings for API descriptions that contain duplicated enum values.
Added the
no-unsafe-markdownrule that disallows potentially executable content indescriptionfields.The rule is enabled at the
warnlevel in therecommendedruleset.Note: linting output may include new warnings for
descriptionfields that contain potentially executable content.Patch Changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.