From 029e302afaa066de00267151b08f0405bf280650 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 21 Jul 2026 11:58:45 +0000 Subject: [PATCH] =?UTF-8?q?chore:=20=F0=9F=94=96=20release=20new=20version?= =?UTF-8?q?s?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .changeset/drift-deepobject-query-params.md | 6 ---- .changeset/drift-ignore-headers.md | 7 ---- .../drift-skip-request-checks-on-4xx.md | 9 ------ .changeset/dull-adults-punch.md | 5 --- .changeset/floppy-rats-care.md | 5 --- .changeset/generate-spec-command.md | 5 --- .changeset/lazy-trees-cheer.md | 11 ------- .changeset/loopback-drift-transport.md | 6 ---- .changeset/moody-radios-serve.md | 7 ---- .changeset/public-ravens-taste.md | 5 --- docs/@v2/changelog.md | 32 +++++++++++++++++++ package-lock.json | 12 +++---- packages/cli/CHANGELOG.md | 32 +++++++++++++++++++ packages/cli/package.json | 6 ++-- packages/core/CHANGELOG.md | 19 +++++++++++ packages/core/package.json | 2 +- packages/respect-core/CHANGELOG.md | 6 ++++ packages/respect-core/package.json | 4 +-- 18 files changed, 101 insertions(+), 78 deletions(-) delete mode 100644 .changeset/drift-deepobject-query-params.md delete mode 100644 .changeset/drift-ignore-headers.md delete mode 100644 .changeset/drift-skip-request-checks-on-4xx.md delete mode 100644 .changeset/dull-adults-punch.md delete mode 100644 .changeset/floppy-rats-care.md delete mode 100644 .changeset/generate-spec-command.md delete mode 100644 .changeset/lazy-trees-cheer.md delete mode 100644 .changeset/loopback-drift-transport.md delete mode 100644 .changeset/moody-radios-serve.md delete mode 100644 .changeset/public-ravens-taste.md diff --git a/.changeset/drift-deepobject-query-params.md b/.changeset/drift-deepobject-query-params.md deleted file mode 100644 index e76a699399..0000000000 --- a/.changeset/drift-deepobject-query-params.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@redocly/cli': patch ---- - -Fixed the `drift` command's `schema-consistency` rule reporting false-positive "Undocumented query parameter" findings for `deepObject`-style query parameters. -Traffic keys like `namespace[id]=...&namespace[name]=...` are now matched to the documented `namespace` parameter, and the reconstructed object is validated against the parameter schema. diff --git a/.changeset/drift-ignore-headers.md b/.changeset/drift-ignore-headers.md deleted file mode 100644 index c60f1e9dd5..0000000000 --- a/.changeset/drift-ignore-headers.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@redocly/cli': minor ---- - -Added an `--ignore-headers` option to the experimental `drift` and `proxy` commands. -It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing `*` matches by prefix (for example `x-consumer-*`). -Use it to silence headers a gateway or proxy adds that are not part of the API contract. diff --git a/.changeset/drift-skip-request-checks-on-4xx.md b/.changeset/drift-skip-request-checks-on-4xx.md deleted file mode 100644 index 5e8ad60549..0000000000 --- a/.changeset/drift-skip-request-checks-on-4xx.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -'@redocly/cli': patch ---- - -Fixed an issue where the `drift` command's `schema-consistency` rule reported false-positive request findings for exchanges the server rejected with a `4xx` client error. -For example: missing required parameter, missing required body, request-body schema mismatch. -A `4xx` response means the server never accepted the request. -Validating it against the operation's success-path contract flagged the server's own correct rejection as drift. -Response-side validation still runs, so a documented error response whose shape differs from reality is still reported. diff --git a/.changeset/dull-adults-punch.md b/.changeset/dull-adults-punch.md deleted file mode 100644 index 5dd3637b26..0000000000 --- a/.changeset/dull-adults-punch.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@redocly/cli': patch ---- - -Fixed an issue where the `join` command silently dropped path-level `x-*` extensions with non-string values. diff --git a/.changeset/floppy-rats-care.md b/.changeset/floppy-rats-care.md deleted file mode 100644 index 6e87e951f1..0000000000 --- a/.changeset/floppy-rats-care.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@redocly/openapi-core': patch ---- - -Updated @redocly/config to v0.52.0. diff --git a/.changeset/generate-spec-command.md b/.changeset/generate-spec-command.md deleted file mode 100644 index d2cf3c6a4d..0000000000 --- a/.changeset/generate-spec-command.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@redocly/cli': minor ---- - -Added an experimental `generate-spec` command that infers an OpenAPI description from recorded HTTP traffic. diff --git a/.changeset/lazy-trees-cheer.md b/.changeset/lazy-trees-cheer.md deleted file mode 100644 index f7f1f08cd2..0000000000 --- a/.changeset/lazy-trees-cheer.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@redocly/openapi-core': patch -'@redocly/cli': patch ---- - -Updated js-yaml from `4.2.0` to `5.2.1`. -Fixed an issue where strings that look like numbers with underscores (for example `'12_34'`) had quotation marks removed by the `bundle` command. -These strings stay quoted in the output. - -**Note**: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. -Parse errors are reported at the offending token instead of the end of the document. diff --git a/.changeset/loopback-drift-transport.md b/.changeset/loopback-drift-transport.md deleted file mode 100644 index c767f280f4..0000000000 --- a/.changeset/loopback-drift-transport.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@redocly/cli': patch ---- - -Fixed an issue where the `drift` command's `security-baseline` rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: `localhost`, `*.localhost`, `127.0.0.0/8`, `[::1]`. -Sandboxed recordings no longer produce transport warnings. diff --git a/.changeset/moody-radios-serve.md b/.changeset/moody-radios-serve.md deleted file mode 100644 index eb3f2925ff..0000000000 --- a/.changeset/moody-radios-serve.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@redocly/openapi-core': patch -'@redocly/cli': patch ---- - -Fixed an issue where the `bundle` command rewrote internal `$ref`s pointing to other `$ref`s. -The issue caused AsyncAPI 3 operation `messages` references to point to `components` instead of channel messages. diff --git a/.changeset/public-ravens-taste.md b/.changeset/public-ravens-taste.md deleted file mode 100644 index 7875d24b7c..0000000000 --- a/.changeset/public-ravens-taste.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@redocly/openapi-core': minor ---- - -Added linting for the OpenAPI 3.2 Example Object `dataValue` field. diff --git a/docs/@v2/changelog.md b/docs/@v2/changelog.md index c5810ce25d..632838dd71 100644 --- a/docs/@v2/changelog.md +++ b/docs/@v2/changelog.md @@ -7,6 +7,38 @@ toc: +## 2.40.0 (2026-07-21) + +### Minor Changes + +- Added an `--ignore-headers` option to the experimental `drift` and `proxy` commands. + It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing `*` matches by prefix (for example `x-consumer-*`). + Use it to silence headers a gateway or proxy adds that are not part of the API contract. +- Added an experimental `generate-spec` command that infers an OpenAPI description from recorded HTTP traffic. + +### Patch Changes + +- Fixed the `drift` command's `schema-consistency` rule reporting false-positive "Undocumented query parameter" findings for `deepObject`-style query parameters. + Traffic keys like `namespace[id]=...&namespace[name]=...` are now matched to the documented `namespace` parameter, and the reconstructed object is validated against the parameter schema. +- Fixed an issue where the `drift` command's `schema-consistency` rule reported false-positive request findings for exchanges the server rejected with a `4xx` client error. + For example: missing required parameter, missing required body, request-body schema mismatch. + A `4xx` response means the server never accepted the request. + Validating it against the operation's success-path contract flagged the server's own correct rejection as drift. + Response-side validation still runs, so a documented error response whose shape differs from reality is still reported. +- Fixed an issue where the `join` command silently dropped path-level `x-*` extensions with non-string values. +- Updated js-yaml from `4.2.0` to `5.2.1`. + Fixed an issue where strings that look like numbers with underscores (for example `'12_34'`) had quotation marks removed by the `bundle` command. + These strings stay quoted in the output. + + **Note**: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. + Parse errors are reported at the offending token instead of the end of the document. + +- Fixed an issue where the `drift` command's `security-baseline` rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: `localhost`, `*.localhost`, `127.0.0.0/8`, `[::1]`. + Sandboxed recordings no longer produce transport warnings. +- Fixed an issue where the `bundle` command rewrote internal `$ref`s pointing to other `$ref`s. + The issue caused AsyncAPI 3 operation `messages` references to point to `components` instead of channel messages. +- Updated @redocly/openapi-core to v2.40.0. + ## 2.39.0 (2026-07-13) ### Minor Changes diff --git a/package-lock.json b/package-lock.json index 16fa4921bd..6833edbfa9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8860,7 +8860,7 @@ }, "packages/cli": { "name": "@redocly/cli", - "version": "2.39.0", + "version": "2.40.0", "license": "MIT", "bin": { "openapi": "bin/cli.js", @@ -8872,8 +8872,8 @@ "@opentelemetry/sdk-trace-node": "2.8.0", "@opentelemetry/semantic-conventions": "1.41.1", "@redocly/cli-otel": "0.3.4", - "@redocly/openapi-core": "2.39.0", - "@redocly/respect-core": "2.39.0", + "@redocly/openapi-core": "2.40.0", + "@redocly/respect-core": "2.40.0", "@types/cookie": "0.6.0", "@types/har-format": "^1.2.16", "@types/react": "^17.0.0 || ^18.2.21 || ^19.2.16", @@ -8906,7 +8906,7 @@ }, "packages/core": { "name": "@redocly/openapi-core", - "version": "2.39.0", + "version": "2.40.0", "license": "MIT", "dependencies": { "@redocly/ajv": "^8.18.1", @@ -8986,13 +8986,13 @@ }, "packages/respect-core": { "name": "@redocly/respect-core", - "version": "2.39.0", + "version": "2.40.0", "license": "MIT", "dependencies": { "@faker-js/faker": "^7.6.0", "@noble/hashes": "^1.8.0", "@redocly/ajv": "^8.18.1", - "@redocly/openapi-core": "2.39.0", + "@redocly/openapi-core": "2.40.0", "ajv": "npm:@redocly/ajv@8.18.1", "better-ajv-errors": "^2.0.3", "colorette": "^2.0.20", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 252b23df47..8054997155 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,37 @@ # @redocly/cli +## 2.40.0 + +### Minor Changes + +- Added an `--ignore-headers` option to the experimental `drift` and `proxy` commands. + It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing `*` matches by prefix (for example `x-consumer-*`). + Use it to silence headers a gateway or proxy adds that are not part of the API contract. +- Added an experimental `generate-spec` command that infers an OpenAPI description from recorded HTTP traffic. + +### Patch Changes + +- Fixed the `drift` command's `schema-consistency` rule reporting false-positive "Undocumented query parameter" findings for `deepObject`-style query parameters. + Traffic keys like `namespace[id]=...&namespace[name]=...` are now matched to the documented `namespace` parameter, and the reconstructed object is validated against the parameter schema. +- Fixed an issue where the `drift` command's `schema-consistency` rule reported false-positive request findings for exchanges the server rejected with a `4xx` client error. + For example: missing required parameter, missing required body, request-body schema mismatch. + A `4xx` response means the server never accepted the request. + Validating it against the operation's success-path contract flagged the server's own correct rejection as drift. + Response-side validation still runs, so a documented error response whose shape differs from reality is still reported. +- Fixed an issue where the `join` command silently dropped path-level `x-*` extensions with non-string values. +- Updated js-yaml from `4.2.0` to `5.2.1`. + Fixed an issue where strings that look like numbers with underscores (for example `'12_34'`) had quotation marks removed by the `bundle` command. + These strings stay quoted in the output. + + **Note**: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. + Parse errors are reported at the offending token instead of the end of the document. + +- Fixed an issue where the `drift` command's `security-baseline` rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: `localhost`, `*.localhost`, `127.0.0.0/8`, `[::1]`. + Sandboxed recordings no longer produce transport warnings. +- Fixed an issue where the `bundle` command rewrote internal `$ref`s pointing to other `$ref`s. + The issue caused AsyncAPI 3 operation `messages` references to point to `components` instead of channel messages. +- Updated @redocly/openapi-core to v2.40.0. + ## 2.39.0 ### Minor Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 144e44a6ea..0c8a3f6c27 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@redocly/cli", - "version": "2.39.0", + "version": "2.40.0", "description": "", "license": "MIT", "bin": { @@ -45,8 +45,8 @@ "@opentelemetry/sdk-trace-node": "2.8.0", "@opentelemetry/semantic-conventions": "1.41.1", "@redocly/cli-otel": "0.3.4", - "@redocly/openapi-core": "2.39.0", - "@redocly/respect-core": "2.39.0", + "@redocly/openapi-core": "2.40.0", + "@redocly/respect-core": "2.40.0", "@types/cookie": "0.6.0", "@types/har-format": "^1.2.16", "@types/react": "^17.0.0 || ^18.2.21 || ^19.2.16", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index f0855df0c7..ece5dc14b4 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,24 @@ # @redocly/openapi-core +## 2.40.0 + +### Minor Changes + +- Added linting for the OpenAPI 3.2 Example Object `dataValue` field. + +### Patch Changes + +- Updated @redocly/config to v0.52.0. +- Updated js-yaml from `4.2.0` to `5.2.1`. + Fixed an issue where strings that look like numbers with underscores (for example `'12_34'`) had quotation marks removed by the `bundle` command. + These strings stay quoted in the output. + + **Note**: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. + Parse errors are reported at the offending token instead of the end of the document. + +- Fixed an issue where the `bundle` command rewrote internal `$ref`s pointing to other `$ref`s. + The issue caused AsyncAPI 3 operation `messages` references to point to `components` instead of channel messages. + ## 2.39.0 ### Minor Changes diff --git a/packages/core/package.json b/packages/core/package.json index a38c7d10f7..9586aa8589 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@redocly/openapi-core", - "version": "2.39.0", + "version": "2.40.0", "description": "", "type": "module", "types": "lib/index.d.ts", diff --git a/packages/respect-core/CHANGELOG.md b/packages/respect-core/CHANGELOG.md index de75ef67da..b243d40eb9 100644 --- a/packages/respect-core/CHANGELOG.md +++ b/packages/respect-core/CHANGELOG.md @@ -1,5 +1,11 @@ # @redocly/respect-core +## 2.40.0 + +### Patch Changes + +- Updated @redocly/openapi-core to v2.40.0. + ## 2.39.0 ### Patch Changes diff --git a/packages/respect-core/package.json b/packages/respect-core/package.json index 5998cd0dd5..929b339643 100644 --- a/packages/respect-core/package.json +++ b/packages/respect-core/package.json @@ -1,6 +1,6 @@ { "name": "@redocly/respect-core", - "version": "2.39.0", + "version": "2.40.0", "description": "API testing framework core", "type": "module", "types": "lib/index.d.ts", @@ -48,7 +48,7 @@ "@faker-js/faker": "^7.6.0", "@noble/hashes": "^1.8.0", "@redocly/ajv": "^8.18.1", - "@redocly/openapi-core": "2.39.0", + "@redocly/openapi-core": "2.40.0", "ajv": "npm:@redocly/ajv@8.18.1", "better-ajv-errors": "^2.0.3", "colorette": "^2.0.20",