chore: 🔖 release new versions

docs/@v2/changelog.md

@@ -7,6 +7,29 @@ toc:
 
 <!-- do-not-remove -->
 
+## 2.40.0 (2026-07-20)
+
+### Minor Changes
+
+- Added an `--ignore-headers` option to the experimental `drift` and `proxy` commands.
+  It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing `*` matches by prefix (for example `x-consumer-*`).
+  Use it to silence headers a gateway or proxy adds that are not part of the API contract.
+
+### Patch Changes
+
+- Fixed the `drift` command's `schema-consistency` rule reporting false-positive "Undocumented query parameter" findings for `deepObject`-style query parameters.
+  Traffic keys like `namespace[id]=...&namespace[name]=...` are now matched to the documented `namespace` parameter, and the reconstructed object is validated against the parameter schema.
+- Fixed an issue where the `drift` command's `schema-consistency` rule reported false-positive request findings for exchanges the server rejected with a `4xx` client error.
+  For example: missing required parameter, missing required body, request-body schema mismatch.
+  A `4xx` response means the server never accepted the request.
+  Validating it against the operation's success-path contract flagged the server's own correct rejection as drift.
+  Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.
+- Fixed an issue where the `drift` command's `security-baseline` rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: `localhost`, `*.localhost`, `127.0.0.0/8`, `[::1]`.
+  Sandboxed recordings no longer produce transport warnings.
+- Fixed an issue where the `bundle` command rewrote internal `$ref`s pointing to other `$ref`s.
+  The issue caused AsyncAPI 3 operation `messages` references to point to `components` instead of channel messages.
+- Updated @redocly/openapi-core to v2.40.0.
+
 ## 2.39.0 (2026-07-13)
 
 ### Minor Changes

packages/cli/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @redocly/cli
 
+## 2.40.0
+
+### Minor Changes
+
+- Added an `--ignore-headers` option to the experimental `drift` and `proxy` commands.
+  It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing `*` matches by prefix (for example `x-consumer-*`).
+  Use it to silence headers a gateway or proxy adds that are not part of the API contract.
+
+### Patch Changes
+
+- Fixed the `drift` command's `schema-consistency` rule reporting false-positive "Undocumented query parameter" findings for `deepObject`-style query parameters.
+  Traffic keys like `namespace[id]=...&namespace[name]=...` are now matched to the documented `namespace` parameter, and the reconstructed object is validated against the parameter schema.
+- Fixed an issue where the `drift` command's `schema-consistency` rule reported false-positive request findings for exchanges the server rejected with a `4xx` client error.
+  For example: missing required parameter, missing required body, request-body schema mismatch.
+  A `4xx` response means the server never accepted the request.
+  Validating it against the operation's success-path contract flagged the server's own correct rejection as drift.
+  Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.
+- Fixed an issue where the `drift` command's `security-baseline` rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: `localhost`, `*.localhost`, `127.0.0.0/8`, `[::1]`.
+  Sandboxed recordings no longer produce transport warnings.
+- Fixed an issue where the `bundle` command rewrote internal `$ref`s pointing to other `$ref`s.
+  The issue caused AsyncAPI 3 operation `messages` references to point to `components` instead of channel messages.
+- Updated @redocly/openapi-core to v2.40.0.
+
 ## 2.39.0
 
 ### Minor Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redocly/cli",
-  "version": "2.39.0",
+  "version": "2.40.0",
   "description": "",
   "license": "MIT",
   "bin": {
@@ -45,8 +45,8 @@
     "@opentelemetry/sdk-trace-node": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.41.1",
     "@redocly/cli-otel": "0.3.4",
-    "@redocly/openapi-core": "2.39.0",
-    "@redocly/respect-core": "2.39.0",
+    "@redocly/openapi-core": "2.40.0",
+    "@redocly/respect-core": "2.40.0",
     "@types/cookie": "0.6.0",
     "@types/har-format": "^1.2.16",
     "@types/react": "^17.0.0 || ^18.2.21 || ^19.2.16",

packages/core/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @redocly/openapi-core
 
+## 2.40.0
+
+### Minor Changes
+
+- Added linting for the OpenAPI 3.2 Example Object `dataValue` field.
+
+### Patch Changes
+
+- Fixed an issue where the `bundle` command rewrote internal `$ref`s pointing to other `$ref`s.
+  The issue caused AsyncAPI 3 operation `messages` references to point to `components` instead of channel messages.
+
 ## 2.39.0
 
 ### Minor Changes

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redocly/openapi-core",
-  "version": "2.39.0",
+  "version": "2.40.0",
   "description": "",
   "type": "module",
   "types": "lib/index.d.ts",

packages/respect-core/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @redocly/respect-core
 
+## 2.40.0
+
+### Patch Changes
+
+- Updated @redocly/openapi-core to v2.40.0.
+
 ## 2.39.0
 
 ### Patch Changes

packages/respect-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redocly/respect-core",
-  "version": "2.39.0",
+  "version": "2.40.0",
   "description": "API testing framework core",
   "type": "module",
   "types": "lib/index.d.ts",
@@ -48,7 +48,7 @@
     "@faker-js/faker": "^7.6.0",
     "@noble/hashes": "^1.8.0",
     "@redocly/ajv": "^8.18.1",
-    "@redocly/openapi-core": "2.39.0",
+    "@redocly/openapi-core": "2.40.0",
     "ajv": "npm:@redocly/ajv@8.18.1",
     "better-ajv-errors": "^2.0.3",
     "colorette": "^2.0.20",