# Redocly CLI changelog ## 2.71.0 (2026-10-23) ### Minor Changes - Added the early access `project pr create` and `project pr status` commands to open a pull request in Redocly platform for the current branch of a cloned project and to show its status. ### Patch Changes - Updated @redocly/reunite-integration to v2.71.0. ## 2.70.0 (2026-10-23) ### Minor Changes - **Breaking**: Updated the `build-docs` command to Redoc 3 and added support for AsyncAPI descriptions and GraphQL schemas. Added the `--openapi`, `--asyncapi`, `--graphql`, and `--inlineBundle` options. Removed `--theme.openapi` and `--disableGoogleFont`, pass Redoc options with `--openapi` instead. Some Redoc 2 options were renamed or removed, see the [`build-docs` documentation](https://redocly.com/docs/cli/commands/build-docs). The command now applies the [decorators](https://redocly.com/docs/cli/decorators) and [preprocessors](https://redocly.com/docs/cli/configuration/reference/preprocessors) from the configuration file. Pages built with the `build-docs` command now send [Redoc telemetry](https://redocly.com/docs/redoc/telemetry) from readers' browsers by default. ## 2.69.0 (2026-10-22) ### Minor Changes - The `preview` command now runs `@redocly/framework` and accepts the `pro`, `scale` and `enterprise` plans with the `--plan` option. A project whose `package.json` lists `@redocly/realm`, `@redocly/redoc`, `@redocly/revel`, `@redocly/reef` or one of their blends still previews with that package. The `--product` option is deprecated. ## 2.68.0 (2026-10-22) ### Minor Changes - Added support for the `parameters` field of Arazzo 1.1.0 success and failure actions to the `respect` command. When an action references a workflow with `workflowId`, `respect` passes the action's parameters to that workflow as inputs. ### Patch Changes - Fixed an issue where the `struct` rule didn't report Arazzo 1.1.0 success and failure actions that had `parameters` without a `workflowId`, or action parameters with an `in` field. Action parameters are passed as inputs to the target workflow, so they require a `workflowId` and can't have an `in` field. Existing Arazzo descriptions with these actions fail `lint`, and `respect` doesn't run them. - Fixed an issue where `respect` didn't retry a step when its `retry` failure action had no `retryLimit`. **Note:** Previously, a workflow continued with the next step after a step had failed and used up its retries. - Fixed an issue where `respect` skipped a `retry` failure action after an earlier `retry` action of the same step had used up its retries. - Updated @redocly/openapi-core to v2.68.0. - Updated @redocly/respect-core to v2.68.0. ## 2.67.1 (2026-10-21) ### Patch Changes - Fixed an issue where the `respect` command kept the inputs that a step passed to a workflow in the same file. Later runs of that workflow used them instead of their `--input` values or schema defaults. - Updated @redocly/respect-core to v2.67.1. ## 2.67.0 (2026-10-21) ### Minor Changes - Added an `excludedMethods` option to the `operation-4xx-response` rule, which skips operations that use the listed HTTP methods. ### Patch Changes - Updated @redocly/openapi-core to v2.67.0. ## 2.66.1 (2026-10-21) ### Patch Changes - Fixed an issue where the generated PHP and Python clients failed when a discriminator mapping pointed to a schema that is itself a `oneOf`. - Updated @redocly/client-generator to v0.7.5. ## 2.66.0 (2026-10-20) ### Minor Changes - Added the `skills` command that installs the Redocly CLI agent skills for AI coding agents. ### Patch Changes - Updated @redocly/openapi-core to v2.66.0. - Updated @redocly/reunite-integration to v2.66.0. ## 2.65.1 (2026-10-20) ### Patch Changes - Fixed the `no-schema-type-mismatch` rule to report `properties` on any non-`object` type and `items` on any non-`array` type, such as `type: string` with `properties`. Previously, the rule only reported `properties` on `array` and `items` on `object`. **Note:** Because the rule is an error in the `recommended` ruleset, descriptions that passed before may now fail. - Fixed an issue where the `struct` rule incorrectly reported an error for `type: file` in response schemas of OpenAPI 2.0 API descriptions. - Updated @redocly/openapi-core to v2.65.1. ## 2.65.0 (2026-10-19) ### Minor Changes - Added the `--openapi-version` option to the `generate-spec` command to choose between OpenAPI `3.1` and `3.2` (the default) for the generated description. ### Patch Changes - Fixed the message of the `capitalization` assertion in `recheck` rules so that it names the style, such as "sentence case", instead of printing `$sentence`. - Fixed `redocly recheck --fix` so that the report lists only the findings that remain after the fixes, not the findings it just fixed. - Fixed the `redocly recheck --fix` summary so that inserted text with a line break prints as `\n` instead of breaking the output line. - Updated @redocly/recheck to v2.65.0. ## 2.64.1 (2026-10-16) ### Patch Changes - Fixed an issue where the `respect` command altered string values in runtime expressions that contained a dot followed by a digit. For example, a token read through `$response.body#/token` or a quoted value in success criteria. - Fixed an issue where `lint` and `bundle` crashed with `Unknown type name found: string` on OpenAPI 3.2 descriptions that had a `deviceAuthorization` OAuth flow with non-empty `scopes`. - Updated @redocly/openapi-core to v2.64.1. - Updated @redocly/respect-core to v2.64.1. ## 2.64.0 (2026-10-15) ### Minor Changes - Added the `onSettled` middleware hook to the generated TypeScript client. Added the `client.telemetry` option to the `generate-client` command. ### Patch Changes - Updated @redocly/client-generator to v0.7.0. - Updated @redocly/openapi-core to v2.64.0. - Updated @redocly/reunite-integration to v2.64.0. ## 2.63.0 (2026-10-13) ### Minor Changes - Added the `body-link` pagination style to the `generate-client` command. Generated clients use it to follow the next page URL from a field in the response, set with the `nextLink` option. The `tanstack-query` generator also creates infinite query options for these operations. ### Patch Changes - Fixed request timeouts in the generated TypeScript client for older browsers that don't support `AbortSignal.timeout()` or `AbortSignal.any()`. Timed-out requests correctly throw `TimeoutError` instead of `AbortError` in Chrome 103–123. - Fixed an issue where the generated Go client sent duplicate query parameters when it followed a next page link. - Updated @redocly/client-generator to v0.6.0. ## 2.62.2 (2026-10-12) ### Patch Changes - Fixed an issue where the `login` and `push` did not exit after a request through a proxy timed out. - Fixed an issue where the `login`, `push`, and other Reunite commands failed on Node.js 26. Updated `undici` to the `7.30.0` version. - Updated `handlebars` to `4.7.10` to resolve `CVE-2026-106444`, `CVE-2026-106445`, and `CVE-2026-106446`. - Fixed an issue where the `respect` command ignored the `--mtls` certificates when a request went through a proxy. - Updated @redocly/reunite-integration to v2.62.2. ## 2.62.1 (2026-10-09) ### Patch Changes - Fixed the `project clone` command so that Git keeps finding its credential helper after a clone run with `npx` or `pnpm dlx`. ## 2.62.0 (2026-10-09) ### Minor Changes - Added support for `in: querystring` parameters to the experimental `drift` command. The command validates the whole query string against the parameter's schema, instead of reporting every query key as undocumented. In `--coverage`, each key of a form-urlencoded querystring schema counts as a separate parameter. - Added the early access `project clone` command to work with a Redocly-hosted Reunite project as a Git repository. ### Patch Changes - Fixed the `schema-consistency` rule of the `drift` command so that a required `readOnly` property in a parameter schema is no longer reported as missing from the request. - Updated @redocly/reunite-integration to v2.62.0. ## 2.61.0 (2026-10-08) ### Minor Changes - Added pass-through stream request bodies to the generated TypeScript, Python, Go, and PHP clients. A stream body is sent as is in one attempt, and the caller's `Content-Type` wins over the one in the API description. ### Patch Changes - Added a deprecation warning for Node.js 20.x. Update to Node.js 22.12.0 or higher. - Updated `@modelcontextprotocol/sdk` to `1.32.1` to resolve `GHSA-6qxp-vccf-f47h`. - Updated @redocly/client-generator to v0.5.0. - Updated @redocly/openapi-core to v2.61.0. - Updated @redocly/reunite-integration to v2.61.0. ## 2.60.0 (2026-10-07) ### Minor Changes - Added the `--file-name-conflicts-severity` option for the `split` command to control how file name conflicts are reported. ### Patch Changes - Fixed an issue where `split` lost content when two components, paths, webhooks, channels, operations, or code samples got the same file name. **Warning:** `split` output may differ from older releases: when several names would share one file, each later file now gets a `-n` suffix, where `n` is its order, for example `user-2.yaml` next to `User.yaml`. ## 2.59.0 (2026-10-06) ### Minor Changes - Improved `redocly recheck` to lint the `description` fields of API descriptions. Findings report the source line and column. You can suppress the findings by file, rule, and pointer, or adjust rules for descriptions only. **Note:** `ResolvedRecheckConfig` gains a required `descriptionRules` field. Library code that builds that object by hand must set it. ### Patch Changes - Updated `brace-expansion` to `2.1.7` and `5.0.12`, `dompurify` to `3.4.16`, `fast-uri` to `3.1.8`, and `js-yaml` to `5.4.3` to resolve `CVE-2026-102276`, `CVE-2026-102277`, `CVE-2026-102278`, `CVE-2026-86472`, `GHSA-p98j-92pf-mc4p`, and `GHSA-r3ph-w7gj-g6xm`. - Updated `oxfmt` to `0.72.0` and `tinypool` to `2.2.0` to resolve `CVE-2026-104848` and `CVE-2026-104849`. - Updated `proxy-addr` to `2.0.8` and `source-map-js` to `1.2.2` to resolve `CVE-2026-90711` and `CVE-2026-93749`. - Updated @redocly/openapi-core to v2.59.0. - Updated @redocly/recheck to v2.59.0. - Updated @redocly/reunite-integration to v2.59.0. ## 2.58.2 (2026-10-06) ### Patch Changes - Fixed an issue where the generated PHP client failed with `Undefined constant "OPERATIONS"` when OPcache preload was enabled. - Updated @redocly/client-generator to v0.4.23. ## 2.58.1 (2026-10-05) ### Patch Changes - Improved performance of the `no-invalid-media-type-examples`, `no-invalid-schema-examples`, and `no-invalid-parameter-examples` rules by reusing validators for schemas that are referenced or repeated. - Updated @redocly/openapi-core to v2.58.1. - Updated @redocly/reunite-integration to v2.58.1. ## 2.58.0 (2026-10-05) ### Minor Changes - Added the `--coverage` and `--coverage-output` options to the experimental `drift` command. `--coverage` prints how much of the OpenAPI description the recorded traffic exercised. `--coverage-output` lists the covered and missing items of every operation in a JSON file. Fixed the `schema-consistency` rule of the `drift` command so that a required property marked `readOnly` or `writeOnly` through `allOf` is no longer reported as missing. Fixed the `schema-consistency` rule of the `drift` command so that a response body is validated against the response documented for its status code: an exact status match without `content` is no longer validated against the `default` (or `2XX`-style) response schema. - Added the `redocly recheck` command. It lints Markdown prose and structure from the `recheck` block in `redocly.yaml`, with presets named in the root `extends` (for example `recheck/markdown`). Presets merge with the `recheck` blocks in `extends` order, like other presets. The engine's actions return data. The CLI prints it. Two agent skills ship in the package under `skills/` and with the repository's other skills: `recheck-lint` runs the command on touched Markdown, and `recheck-config` tunes the `recheck` block. - Resolved organization and project slugs to IDs in the `push` and `push-status` commands before calling the Reunite API, with a deprecation notice that shows the IDs to use. The `--organization` and `--project` options now expect the IDs from the organization and project settings pages in Reunite; slugs are still accepted but deprecated. ### Patch Changes - Improved the consistency of how configuration file problems are reported. Commands with machine-readable output formats, such as `json`, `junit`, `checkstyle`, and `sarif` also report configuration file problems instead of hiding them. A configuration file that fails to load displays a specific error message instead of a generic one. **Note**: Configuration file problems are printed to `stderr` in the `codeframe` format for every command, regardless of the `--format` option. - Updated @redocly/openapi-core to v2.58.0. - Updated @redocly/recheck to v2.58.0. - Updated @redocly/reunite-integration to v2.58.0. ## 2.57.0 (2026-09-30) ### Minor Changes - Added `const` checking to the `no-enum-type-mismatch` rule: a `const` value must conform to the schema's `type`, the same way every `enum` value does. **Note**: linting output may include new errors for schemas whose `const` value doesn't match their `type`. ### Patch Changes - Fixed an issue where `no-enum-type-mismatch` dropped violations and reported a wrong location when `type` was written as an array. - Updated @redocly/openapi-core to v2.57.0. ## 2.56.1 (2026-09-30) ### Patch Changes - Improved overall startup performance. - Updated @redocly/openapi-core to v2.56.1. ## 2.56.0 (2026-09-30) ### Minor Changes - Added support for applying Overlay documents to the `bundle` command output. Pass overlays with the new `--overlay` option or list them under `overlays` for an API in `redocly.yaml`. - Added support for linting Overlay 1.1 and 1.2 documents, including the `copy` action field, the `$self` field, and reusable actions in `components.actions`. The `spec-ref-siblings` rule now checks the fields next to a reusable action `$ref` in Overlay documents. ### Patch Changes - Fixed an issue where `respect` failed with an unexpected error when a step used an `operationId` without the `$sourceDescriptions..` prefix and the Arazzo file also listed an `arazzo` source description. Such `operationId`s are looked up in the `openapi` source descriptions only. - Updated `undici` to the `6.29.0` version. - Updated @redocly/client-generator to v0.4.18. - Updated @redocly/openapi-core to v2.56.0. - Updated @redocly/respect-core to v2.56.0. - Updated @redocly/reunite-integration to v2.56.0. ## 2.55.0 (2026-09-28) ### Minor Changes - Added the `--replace` option to the `push` command. `--replace` removes the files under the mount path that are not part of the push. ### Patch Changes - Fixed `respect` so known secrets are masked in non-JSON request bodies, such as `application/x-www-form-urlencoded` token requests. - Fixed `respect` so a step fails with a clear error when a runtime expression embedded in a string has no value, such as `Bearer {$outputs.accessToken}`. - Updated @redocly/openapi-core to v2.55.0. - Updated @redocly/respect-core to v2.55.0. - Updated @redocly/reunite-integration to v2.55.0. - Fixed an issue where the `workflow-dependsOn` rule reported a duplicate when different workflows listed the same workflow in `dependsOn`. ## 2.54.3 (2026-09-25) ### Patch Changes - Fixed an issue where generated clients attempted to parse compressed archives (`application/gzip`, `application/x-tar`), PDF files, Office documents, audio, video and font responses as JSON instead of decoding them as binary. - Added the value of the `REDOCLY_ENVIRONMENT` environment variable to the `user-agent` header of the `login`, `push`, and `push-status` requests. - Updated @redocly/client-generator to v0.4.16. - Updated @redocly/reunite-integration to v2.54.3. ## 2.54.2 (2026-09-22) ### Patch Changes - Updated @redocly/openapi-core to v2.54.2. - Updated @redocly/reunite-integration to v2.54.2. ## 2.54.1 (2026-09-22) ### Patch Changes - Updated @redocly/reunite-integration to v2.54.1. ## 2.54.0 (2026-09-22) ### Patch Changes - Updated the `login` command to prevent it from passing the authorization URL through a shell. The `login` command no longer waits for the browser launcher to exit. - Fixed the `push --wait-for-deployment` error message, which reported a failed or timed-out deployment as a file upload failure. - Fixed the `push-status --wait` command printing the Reunite API sunset warning twice for pushes to the main branch, and the `push` and `push-status` commands dropping the warning when the deployment or the request failed. - Updated @redocly/reunite-integration to v2.54.0. ## 2.53.3 (2026-09-17) ### Patch Changes - Fixed `respect` so a same-workflow `goto` no longer cleared `$steps` outputs from steps that already ran. Previously, this broke $steps expressions in the target step. - Updated @redocly/respect-core to v2.53.3. ## 2.53.2 (2026-09-15) ### Patch Changes - Added `start` and `end` line and column positions to each problem location in the `--format=json` lint output. - Updated @redocly/openapi-core to v2.53.2. ## 2.53.1 (2026-09-15) ### Patch Changes - Added a deprecation warning to the `build-docs` command about the upcoming switch to Redoc 3. ## 2.53.0 (2026-09-14) ### Minor Changes - Added a `disallowDefault` option to the `operation-2xx-response` rule, which requires an explicit 2xx response when enabled. There is no change in current behavior. ### Patch Changes - Updated @redocly/openapi-core to v2.53.0. ## 2.52.1 (2026-09-11) ### Patch Changes - Updated `redoc` to the `2.5.4` version to fix accessibility problems in the HTML produced by `build-docs`. Added the `lang` attribute to the default `build-docs` template. ## 2.52.0 (2026-09-10) ### Minor Changes - Added agent skills for AI coding assistants: `redocly-cli` for everyday CLI usage, `redocly-lint-rules` for writing configurable rules and custom plugins. Install them with `npx skills add https://redocly.com`. - Added an experimental `inspect-node-types` command to navigate the Redocly's node type tree of an API description. `inspect-node-types` helps pick the correct `subject` types for a configurable rule or the correct visitor for a custom plugin. - Added a `strategy` option to the `component-name-unique` rule, matching the `--component-names-strategy` option of the `bundle` command. - Added an experimental `introspect-mcp` command that analyzes a running MCP server and records its tools, prompts, resources, and capabilities. `introspect-mcp` records its findings in the `x-mcp` extension of an OpenAPI description. ### Patch Changes - Updated @redocly/openapi-core to v2.52.0. ## 2.51.2 (2026-09-04) ### Patch Changes - Updated `fast-uri` to the `3.1.7` version to resolve `CVE-2026-75931`, `CVE-2026-75975`, `CVE-2026-75899`, and `CVE-2026-76172`. - Fixed `drift` and `coverage` failing to match a path template whose segment mixes literal text with parameters, such as `/instances/{worldId}:{instanceId}`. - Fixed an issue where Redocly config resolution failed when plugins used ESM syntax. - Updated @redocly/openapi-core to v2.51.2. ## 2.51.1 (2026-09-02) ### Patch Changes - Fixed an issue where `generate-arazzo` produced a malformed remote description URL in `sourceDescriptions` (`https://` collapsed to `https:/`) when `--output-file` was provided. - Fixed an issue where `$faker.string.email()` used without options generated addresses at the `undefined.com` domain. - Updated @redocly/respect-core to v2.51.1. - Updated `@faker-js/faker` to the `10.6.0` version to resolve the high severity advisory `GHSA-qxc2-j82w-r537`. ## 2.51.0 (2026-09-02) ### Minor Changes - Enhanced the `generate-arazzo` command to print a ready-to-run `respect` command after generation, including an `--input` placeholder for every workflow input. - Added `--with-ai`, `--ai-provider`, `--ai-model`, `--ai-concurrency`, and `--max-workflows` options to the `generate-arazzo` command. `--with-ai` uses a local AI CLI (`claude`, `codex`, or `cursor`) and OpenAPI descriptions to redesign the generated one-workflow-per-operation skeleton into multi-step workflows. The AI designs at most `--max-workflows` workflows (default 10), and the generated file is marked as AI-inferred. For descriptions that don't fit a single prompt, the AI first selects scenarios from a compact operation index, then it designs each workflow separately. ### Patch Changes - Fixed an issue where `respect` and the `x-security-scheme-required-values` rule incorrectly rejected `x-security` HTTP schemes written with non-lowercase casing (such as `Basic`, `Bearer`, or `Digest`). RFC 7235 scheme names are case-insensitive. - Updated @redocly/openapi-core to v2.51.0. - Updated @redocly/respect-core to v2.51.0. ## 2.50.0 (2026-09-01) ### Minor Changes - Added a new `schema` assertion for configurable rules. The assertion validates a property value against a JSON Schema. ### Patch Changes - Updated @redocly/openapi-core to v2.50.0. ## 2.49.1 (2026-09-01) ### Patch Changes - Fixed an issue where rule incorrectly reported a duplicate parameter when two or more `$ref`s pointed to the same path item. - Updated @redocly/openapi-core to v2.49.1. ## 2.49.0 (2026-08-27) ### Minor Changes - Added the `no-illogical-composition-keywords` rule. **Note**: the rule is set to `warn` in the `recommended` ruleset and to `error` in `recommended-strict`. Existing API descriptions may report new problems. ### Patch Changes - Fixed an issue where telemetry silently failed to send when `npm` was not available. - Updated @redocly/openapi-core to v2.49.0. ## 2.48.0 (2026-08-25) ### Minor Changes - Added agent-friendly client generation: `python`, `go`, `php`, and `cli` generators beside the TypeScript client, each self-documenting with `--docs`, configurable per generator, and available as source in your own repository through `eject-generator`. ### Patch Changes - Fixed an issue where the `bundle` command didn't resolve `$ref`s inside an AsyncAPI 3 Multi Format Schema Object. - Fixed an issue where `respect --har-output` recorded an empty `postData` for every request. Request bodies are written to the HAR. Captures replayed through `drift` can have their request bodies validated instead of silently passing. - Updated @redocly/client-generator to v0.4.0. - Updated @redocly/openapi-core to v2.48.0. ## 2.47.0 (2026-08-21) ### Minor Changes - Added a Vendor Extensions metric to the `stats` command that reports how many distinct `x-` extensions a description file uses and how often each one occurs. ### Patch Changes - Fixed the `stats` command reporting wrong parameter count for AsyncAPI descriptions. - Updated @redocly/openapi-core to v2.47.0. ## 2.46.2 (2026-08-19) ### Patch Changes - Updated @redocly/openapi-core to v2.46.2. ## 2.46.1 (2026-08-11) ### Patch Changes - Updated `@redocly/ajv` to `^8.18.3`. - Updated @redocly/openapi-core to v2.46.1. - Updated @redocly/respect-core to v2.46.1. ## 2.46.0 (2026-08-07) ### Minor Changes - Added the `spec-ref-siblings` rule that reports properties placed next to a `$ref` which the specification does not allow. ### Patch Changes - Fixed the `struct` rule to report unexpected fields on AsyncAPI 3 messages and message traits. - Reduced CLI startup time on Node 22.8 and later reusing Node's on-disk compile cache. Set `NODE_DISABLE_COMPILE_CACHE=1` to turn it off. - Fixed an issue where remote `$ref`s with query parameters in the URL were not resolved. - Updated @redocly/openapi-core to v2.46.0. ## 2.45.0 (2026-08-06) ### Minor Changes - Fixed the `bundle` command losing schema keywords (such as `title`, `properties`, or `required`) written next to a `$ref` when the referenced schemas started with their own `$ref`. ### Patch Changes - Updated @redocly/openapi-core to v2.45.0. ## 2.44.2 (2026-08-05) ### Patch Changes - Changed the severity of the `security-defined` rule for AsyncAPI 2.x and 3.x in the `recommended` ruleset from `error` to `warn`. AsyncAPI descriptions with undefined or unresolved security no longer fail linting by default. - Updated @redocly/openapi-core to v2.44.2. ## 2.44.1 (2026-08-04) ### Patch Changes - Updated `undici` to the `6.28.0` version. - Fixed an issue where the `operation-4xx-problem-details-rfc7807` rule incorrectly reported the `type` and `title` properties inherited through `allOf` as missing. - Updated @redocly/openapi-core to v2.44.1. ## 2.44.0 (2026-08-04) ### Minor Changes - Added the `no-duplicated-enum-values` rule that requires all values in an `enum` to be unique. The rule is enabled at the `warn` level in the `recommended` ruleset. **Note**: linting output may include new warnings for API descriptions that contain duplicated enum values. - Added the `no-unsafe-markdown` rule that disallows potentially executable content in `description` fields. The rule is enabled at the `warn` level in the `recommended` ruleset. **Note**: linting output may include new warnings for `description` fields that contain potentially executable content. ### Patch Changes - Updated @redocly/client-generator to v0.3.0. - Updated @redocly/openapi-core to v2.44.0. ## 2.43.3 (2026-08-03) ### Patch Changes - Updated @redocly/respect-core to v2.43.3. ## 2.43.2 (2026-07-31) ### Patch Changes - Updated @redocly/client-generator to v0.2.0. - Updated @redocly/openapi-core to v2.43.2. ## 2.43.1 (2026-07-30) ### Patch Changes - Updated @redocly/openapi-core to v2.43.1. ## 2.43.0 (2026-07-30) ### Patch Changes - Updated @redocly/openapi-core to v2.43.0. ## 2.42.0 (2026-07-30) ### Minor Changes - Added an experimental `generate-client` command that generates a typed, zero-dependency TypeScript client from an OpenAPI description — auth, retries, middleware, typed SSE streaming, pagination, and multipart included — plus optional companion generators for Zod validation, TanStack Query and SWR hooks, MSW mocks, and date transformers. See the [`generate-client` command reference](https://redocly.com/docs/cli/commands/generate-client) and the [Use the generated client](https://redocly.com/docs/cli/guides/use-generated-client) guide. ### Patch Changes - Updated @redocly/client-generator to v0.1.0. - Updated @redocly/openapi-core to v2.42.0. ## 2.41.2 (2026-07-29) ### Patch Changes - Updated js-yaml from `5.2.1` to `5.2.2` to resolve a vulnerability in YAML parsing. - Added support for the Arazzo spec-compliant workflow reference form `$sourceDescriptions..` in `dependsOn`, step `workflowId`, and success/failure action `workflowId`. Unresolvable workflow references fail only the affected workflow with a clear error message, and no longer abort the whole run or pass unnoticed. - Updated @redocly/openapi-core to v2.41.2. - Updated @redocly/respect-core to v2.41.2. ## 2.41.1 (2026-07-28) ### Patch Changes - Fixed an issue where the `drift` command's `schema-consistency` rule reported false-positive findings for `oneOf` schemas with a `discriminator`. Payloads are validated only against the branch selected by the discriminator value instead of every `oneOf` branch. Schemas whose discriminator does not meet Ajv's structural requirements keep the previous behavior. - Extended the `drift` command's built-in undocumented-header ignore list with `x-amz-`, `x-amzn-` and `x-github-` prefixes, and the `x-hub-signature` / `x-hub-signature-256` webhook signature headers. ## 2.41.0 (2026-07-27) ### Minor Changes - Added a new built-in rule `security-scopes-defined` that requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme. The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in `requireScopes` option that requires OAuth2 security requirements to list at least one scope. ### Patch Changes - Fixed an issue in `respect` where the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed. - Fixed an issue where the `cursor` AI provider of the `generate-spec` command sent only the instructions to the model and the operation to refine never reached it. - Updated @redocly/openapi-core to v2.41.0. - Updated @redocly/respect-core to v2.41.0. ## 2.40.0 (2026-07-21) ### Minor Changes - Added an `--ignore-headers` option to the experimental `drift` and `proxy` commands. It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing `*` matches by prefix (for example `x-consumer-*`). Use it to silence headers a gateway or proxy adds that are not part of the API contract. - Added an experimental `generate-spec` command that infers an OpenAPI description from recorded HTTP traffic. ### Patch Changes - Fixed the `drift` command's `schema-consistency` rule reporting false-positive "Undocumented query parameter" findings for `deepObject`-style query parameters. Traffic keys like `namespace[id]=...&namespace[name]=...` are now matched to the documented `namespace` parameter, and the reconstructed object is validated against the parameter schema. - Fixed an issue where the `drift` command's `schema-consistency` rule reported false-positive request findings for exchanges the server rejected with a `4xx` client error. For example: missing required parameter, missing required body, request-body schema mismatch. A `4xx` response means the server never accepted the request. Validating it against the operation's success-path contract flagged the server's own correct rejection as drift. Response-side validation still runs, so a documented error response whose shape differs from reality is still reported. - Fixed an issue where the `join` command silently dropped path-level `x-*` extensions with non-string values. - Updated js-yaml from `4.2.0` to `5.2.1`. Fixed an issue where strings that look like numbers with underscores (for example `'12_34'`) had quotation marks removed by the `bundle` command. These strings stay quoted in the output. **Note**: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. Parse errors are reported at the offending token instead of the end of the document. - Fixed an issue where the `drift` command's `security-baseline` rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: `localhost`, `*.localhost`, `127.0.0.0/8`, `[::1]`. Sandboxed recordings no longer produce transport warnings. - Fixed an issue where the `bundle` command rewrote internal `$ref`s pointing to other `$ref`s. The issue caused AsyncAPI 3 operation `messages` references to point to `components` instead of channel messages. - Updated @redocly/openapi-core to v2.40.0. ## 2.39.0 (2026-07-13) ### Minor Changes - Added support for AsyncAPI 3.1.0 descriptions. - Fixed the `struct` rule to validate the contents of AsyncAPI protocol-specific bindings. Added typed definitions for the `sns`, `sqs`, `ibmmq`, `googlepubsub`, `pulsar` and `ros2` bindings. ### Patch Changes - Updated @redocly/openapi-core to v2.39.0. ## 2.38.0 (2026-07-08) ### Minor Changes - Added an experimental `drift` command that compares recorded HTTP traffic (HAR, Kong, Nginx/Apache JSON, NDJSON) against an OpenAPI description and reports undocumented endpoints, schema mismatches, and security findings. - Added an experimental `proxy` command that captures live HTTP traffic through a reverse proxy into a HAR file and optionally validates it against an OpenAPI description in real time. ### Patch Changes - Updated @redocly/openapi-core to v2.38.0. ## 2.37.0 (2026-07-03) ### Minor Changes - Added experimental support for linting GraphQL SDL schema files (`.graphql` / `.gql`). ### Patch Changes - Updated @redocly/openapi-core to v2.37.0. ## 2.36.0 (2026-06-30) ### Minor Changes - Added a Subresource Integrity (SRI) hash to the Redoc standalone script tag in the HTML produced by `build-docs`, ensuring the script's integrity. ## 2.35.1 (2026-06-25) ### Patch Changes - Updated `undici` to the `6.27.0` version. ## 2.35.0 (2026-06-24) ### Minor Changes - Added support for validating Arazzo 1.1.0 descriptions syntax in the `lint` command. - Added the `spec-step-mutually-exclusive-fields` Arazzo rule to flag steps that use more than one mutually exclusive operation field (`operationId`, `operationPath`, `workflowId`, `channelPath`, or `x-operation`). ## 2.34.0 (2026-06-17) ### Minor Changes - Improved CLI install speed by bundling the CLI into a dependency-free package. **Warning:** The published package no longer ships runtime dependencies in `node_modules`. Plugins that relied on importing packages hoisted from the CLI (such as `@redocly/openapi-core`) must now declare those packages as their own dependencies. ## 2.33.2 (2026-06-16) ### Patch Changes - Fixed a path traversal in the `split` command that might have written files outside the chosen `--outDir`. - Updated @redocly/openapi-core to v2.33.2. - Updated @redocly/respect-core to v2.33.2. ## 2.33.1 (2026-06-16) ### Patch Changes - Updated @redocly/openapi-core to v2.33.1. ## 2.33.0 (2026-06-16) ### Minor Changes - Added the `--component-names-strategy` option to the `bundle` command. This option allows a choice of how inline Schema components are named: `basename` (default) or `title` (from each schema's `title` field). ### Patch Changes - Updated @redocly/openapi-core to v2.33.0. - Updated @redocly/respect-core to v2.33.0. ## 2.32.2 (2026-06-11) ### Patch Changes - Updated @redocly/respect-core to v2.32.2. ## 2.32.1 (2026-06-11) ### Patch Changes - Updated @redocly/openapi-core to v2.32.1. ## 2.32.0 (2026-06-08) ### Minor Changes - Added support for `junit` output in the `lint` command. ### Patch Changes - Updated @redocly/openapi-core to v2.32.0. ## 2.31.6 (2026-06-03) ### Patch Changes - Fixed `lint --format=checkstyle` to produce a single combined XML document when multiple APIs are passed to the command, instead of concatenated per-file documents. - Updated redoc to v2.5.3, styled-components to v6.4.2, and react to v19.2.7. - Updated @redocly/openapi-core to v2.31.6. ## 2.31.5 (2026-05-27) ### Patch Changes - Updated the `no-unused-components` rule to validate unused security schemes. - Pinned the official Docker image base to `node:24-alpine`. - Fixed the `remove-unused-components` decorator to remove unused security schemes. **Warning:** The bundler may now remove more unused components than before. - Updated @redocly/openapi-core to v2.31.5. ## 2.31.4 (2026-05-22) ### Patch Changes - Updated @redocly/openapi-core to v2.31.4. ## 2.31.3 (2026-05-21) ### Patch Changes - Fixed an issue where the Respect command did not honor the `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables when loading remote source descriptions or resolving external `$ref`s. Proxy settings are consistently applied during reference resolution as well. - Updated @redocly/openapi-core to v2.31.3. ## 2.31.2 (2026-05-19) ### Patch Changes - Fixed the `remove-unused-components` decorator to remove unused components containing `allOf` keyword. **Warning:** The bundler may now remove more unused components than before. - Fixed the `no-unused-components` rule to highlight unused schemas containing `allOf` keyword. - Updated @redocly/openapi-core to v2.31.2. ## 2.31.1 (2026-05-18) ### Patch Changes - Updated @redocly/openapi-core to v2.31.1. ## 2.31.0 (2026-05-18) ### Patch Changes - Updated @redocly/openapi-core to v2.31.0. ## 2.30.6 (2026-05-14) ### Patch Changes - Fixed hard crash that happened when no API was provided either via the command argument or in the config. - Updated @redocly/openapi-core to v2.30.6. ## 2.30.5 (2026-05-12) ### Patch Changes - Fixed a status code mismatch that occurred when using the `--har-output` option in the `respect` command. - Updated @redocly/openapi-core to v2.30.5. ## 2.30.4 (2026-05-06) ### Patch Changes - Updated `styled-components` dependency to `6.4.1`. - Updated @redocly/openapi-core to v2.30.4. ## 2.30.3 (2026-04-29) ### Patch Changes - Updated `@redocly/ajv` to `v8.18.1` - Updated @redocly/respect-core to v2.30.3. ## 2.30.2 (2026-04-29) ### Patch Changes - Improved Redocly config validation: now the config checks for typos in built-in decorator names. - Updated @redocly/openapi-core to v2.30.2. ## 2.30.1 (2026-04-27) ### Patch Changes - Increased the default fetch timeout used by the `push` command to better support slower uploads. - Updated @redocly/openapi-core to v2.30.1. ## 2.30.0 (2026-04-24) ### Patch Changes - Updated @redocly/openapi-core to v2.30.0. ## 2.29.2 (2026-04-23) ### Patch Changes - Resolved `GHSA-xq3m-2v4x-88gg` vulnerabilitiy by updating dependency versions. - Updated @redocly/openapi-core to v2.29.2. ## 2.29.1 (2026-04-22) ### Patch Changes - Made Respect's JSONPath criteria compliant with RFC 9535. **Warning:** This update may affect existing workflows. Please review your usage for compatibility. - Fixed an issue where discriminator's `mapping` values written as bare local file names were not resolved during build. - Updated @redocly/openapi-core to v2.29.1. ## 2.29.0 (2026-04-20) ### Minor Changes - Added new `score` command that analyzes OpenAPI 3.x descriptions and produces an AI Agent Readiness score (0-100). Reports normalized subscores, raw per-operation metrics, and top hotspot operations with human-readable explanations. Supports `--format=stylish` (default) and `--format=json` output. ### Patch Changes - Improved the stability of the `push` command. - Updated @redocly/openapi-core to v2.29.0. ## 2.28.1 (2026-04-16) ### Patch Changes - Ordered top-level keys in AsyncAPI documents during bundling for improved consistency and readability. - Updated @redocly/openapi-core to v2.28.1. ## 2.28.0 (2026-04-15) ### Minor Changes - Moved the `remove-unused-components` decorator to the post-bundle phase so that components that become unused only after `$ref` resolution are correctly removed. ### Patch Changes - Fixed an issue where the discriminator's `defaultMapping` property was not resolved when bundling. - Updated @redocly/openapi-core to v2.28.0. ## 2.27.1 (2026-04-14) ### Patch Changes - Fixed an issue where `--component-renaming-conflicts-severity` ignored conflicts when different files had components with the same name but different content. **Warning:** Autogenrated component names and `$ref` paths in bundled documents may differ from older releases. - Updated @redocly/openapi-core to v2.27.1. ## 2.27.0 (2026-04-14) ### Minor Changes - Added support for `junit` output in the `scorecard-classic` command. - Changed `lint` behavior with the `--generate-ignore-file` option. Now `lint` updates only the entries related to the file being linted. Other files' entries are unchanged. ### Patch Changes - Updated @redocly/openapi-core to v2.27.0. ## 2.26.0 (2026-04-08) ### Minor Changes - Added support for AsyncAPI v2 and v3 in the split command. - Added `excludedPaths` option to the `no-http-verbs-in-paths` rule, allowing specific paths to be excluded from evaluation. ### Patch Changes - Fixed the `no-required-schema-properties-undefined` rule to report when a required property is not defined in every `oneOf`/`anyOf` branch. - Updated @redocly/openapi-core to v2.26.0. ## 2.25.4 (2026-04-02) ### Patch Changes - Updated handlebars to v4.7.9. - Updated @redocly/openapi-core to v2.25.4. ## 2.25.3 (2026-03-30) ### Patch Changes - Fixed multiple issues in the `spec-discriminator-defaultMapping` rule that could cause crashes or incorrect validation results. The rule now correctly resolves existing schema names, traverses composite schemas (`allOf`, `anyOf`, `oneOf`) to find required properties, treats `defaultMapping` values as `$ref`s to schemas, resolves `$ref`s correctly across files, and handles cyclic schema dependencies. - Updated @redocly/respect-core to v2.25.3. ## 2.25.2 (2026-03-27) ### Patch Changes - Updated `picomatch` dependency to `^4.0.4`. - Updated @redocly/openapi-core to v2.25.2. ## 2.25.1 (2026-03-24) ### Patch Changes - Fixed an issue where a message about a missing configuration was shown even though the `--extends` option was provided. - Updated @redocly/openapi-core to v2.25.1. ## 2.25.0 (2026-03-24) ### Minor Changes - Added `no-mixed-number-range-constraints` rule for OpenAPI `3.1+`, as well as for AsyncAPI and Arazzo. This rule warns when schemas use both `maximum` and `exclusiveMaximum` or both `minimum` and `exclusiveMinimum` keywords. ### Patch Changes - Fixed an issue where invalid discriminator mapping values could cause linting to fail. - Resolved high severity audit vulnerabilities by updating dependency versions. - Updated @redocly/openapi-core to v2.25.0. ## 2.24.1 (2026-03-20) ### Patch Changes - Downgraded `undici` to resolve an issue where `formData` was being submitted empty. - Updated @redocly/openapi-core to v2.24.1. ## 2.24.0 (2026-03-18) ### Patch Changes - Updated @redocly/openapi-core to v2.24.0. ## 2.23.0 (2026-03-18) ### Minor Changes - Added support of `targets` property in `scorecardClassic`. Use this property to override `scorecardClassic` rules for a specific API. ### Patch Changes - Updated @redocly/openapi-core to v2.23.0. ## 2.22.1 (2026-03-16) ### Patch Changes - Updated `undici` to the `6.24.1` version to ensure improved performance, security, and compatibility. - Updated @redocly/openapi-core to v2.22.1. ## 2.22.0 (2026-03-16) ### Minor Changes - Added support of `checkstyle` format for `scorecard-classic` command. ### Patch Changes - Extended the `nonEmpty` assertion to support arrays. An empty array is now treated as empty during linting. - Updated @redocly/openapi-core to v2.22.0. ## 2.21.1 (2026-03-12) ### Patch Changes - Restricted scorecard-classic project URL to the `.redocly.com` domain only. - Fixed an issue where `join --prefix-components-with-info-prop` would incorrectly rewrite discriminator mapping refs. This issue occurred when schema names contained the same substring as the prefix. - Updated @redocly/openapi-core to v2.21.1. ## 2.21.0 (2026-03-11) ### Minor Changes - Added a new option to the `filter-in` decorator, allowing to filter through specific target nodes (`PathItem` or `Operation`). - Added a new option to the `filter-out` decorator, allowing to filter through specific target nodes (`PathItem` or `Operation`). - Added support for the `NO_PROXY` environment variable. ### Patch Changes - Updated @redocly/openapi-core to v2.21.0. ## 2.20.5 (2026-03-11) ### Patch Changes - Updated @redocly/openapi-core to v2.20.5. ## 2.20.4 (2026-03-04) ### Patch Changes - Improved error messaging when a path parameter referenced via `$ref` is not used in the path. - Updated @redocly/openapi-core to v2.20.4. ## 2.20.3 (2026-03-03) ### Patch Changes - Updated @redocly/respect-core to v2.20.3. ## 2.20.2 (2026-03-02) ### Patch Changes - Add support for data: URLs (RFC 2397) in references. The resolver now handles inline base64-encoded and URL-encoded data in $ref fields, allowing schemas and other content to be embedded directly as data URLs. - Updated @redocly/openapi-core to v2.20.2. ## 2.20.1 (2026-03-02) ### Patch Changes - Updated `@redocly/ajv` to `v8.18.0` - Updated @redocly/respect-core to v2.20.1. ## 2.20.0 (2026-02-27) ### Patch Changes - Updated @redocly/openapi-core to v2.20.0. ## 2.19.2 (2026-02-24) ### Patch Changes - Fixed an issue where `scorecardClassic` configurations were not resolved. - Updated @redocly/openapi-core to v2.19.2. ## 2.19.1 (2026-02-19) ### Patch Changes - Updated @redocly/respect-core to v2.19.1. ## 2.19.0 (2026-02-18) ### Minor Changes - Added the `spec-querystring-parameters` rule (OpenAPI 3.2). This rule enforces that `query` and `querystring` are not mixed in the same operation/path parameter set, and that at most one `querystring` parameter is declared per operation or path. ### Patch Changes - Fixed an issue where running CLI commands would result in "ReferenceError: React is not defined" message. - Updated @redocly/respect-core to v2.19.0. ## 2.18.2 (2026-02-16) ### Patch Changes - Fixed false positive errors in example validation for OpenAPI 3.0.x and OpenAPI 2.x. - Updated @redocly/openapi-core to v2.18.2. ## 2.18.1 (2026-02-13) ### Patch Changes - Fixed validation of examples where combining `required` with `readOnly` or `writeOnly` properties would incorrectly generate warnings. - Updated @redocly/respect-core to v2.18.1. ## 2.18.0 (2026-02-11) ### Patch Changes - Updated @redocly/openapi-core to v2.18.0. ## 2.17.0 (2026-02-09) ### Minor Changes - Added support for Media Types in the Components model. ### Patch Changes - Updated @redocly/openapi-core to v2.17.0. ## 2.16.0 (2026-02-06) ### Minor Changes - Added a new `--component-renaming-conflicts-severity` option for the `bundle` command to control how naming conflicts are reported when bundling API descriptions with external references. ### Patch Changes - Redirected bundling problems (such as lint errors and warnings) to `stderr` instead of `stdout` to avoid interfering with the bundled output. - Updated @redocly/openapi-core to v2.16.0. ## 2.15.2 (2026-02-05) ### Patch Changes - Fixed an issue where improperly structured OpenAPI examples caused the linter to fail. - Updated @redocly/openapi-core to v2.15.2. ## 2.15.1 (2026-02-02) ### Patch Changes - Updated @redocly/openapi-core to v2.15.1. ## 2.15.0 (2026-01-27) ### Patch Changes - Removed unused `chokidar` dependency. - Updated @redocly/openapi-core to v2.15.0. ## 2.14.9 (2026-01-23) ### Patch Changes - Updated @redocly/openapi-core to v2.14.9. ## 2.14.8 (2026-01-23) ### Patch Changes - Fixed an issue where multi-line lint error messages could break Markdown formatting. - Updated @redocly/openapi-core to v2.14.8. ## 2.14.7 (2026-01-22) ### Patch Changes - Updated @redocly/openapi-core to v2.14.7. ## 2.14.6 (2026-01-21) ### Patch Changes - Updated @redocly/openapi-core to v2.14.6. ## 2.14.5 (2026-01-12) ### Patch Changes - Added an `ajv` npm alias dependency to satisfy peer dependency requirements and prevent installation warnings. - Updated @redocly/openapi-core to v2.14.5. ## 2.14.4 (2026-01-08) ### Patch Changes - Corrected an issue where `Respect` did not properly JSON-encode request bodies for custom content-types containing numbers. - Updated @redocly/respect-core to v2.14.4. ## 2.14.3 (2026-01-02) ### Patch Changes - Fixed the `split` command to properly handle root-level paths. Previously, the root path `/` was converted to an empty string as a filename, leading to incorrect file structure and broken links. Now, it correctly maps to the specified path separator. - Updated @redocly/openapi-core to v2.14.3. ## 2.14.2 (2025-12-30) ### Patch Changes - Updated @redocly/openapi-core to v2.14.2. ## 2.14.1 (2025-12-24) ### Patch Changes - Updated @redocly/openapi-core to v2.14.1. ## 2.14.0 (2025-12-19) ### Patch Changes - Updated @redocly/respect-core to v2.14.0. ## 2.13.0 (2025-12-17) ### Minor Changes - Implemented basic support for OpenRPC specification. ### Patch Changes - Updated @redocly/openapi-core to v2.13.0. ## 2.12.7 (2025-12-15) ### Patch Changes - Added `scorecard-classic` command to evaluate API descriptions against project scorecard configurations. - Updated @redocly/openapi-core to v2.12.7. ## 2.12.6 (2025-12-10) ### Patch Changes - Updated @redocly/openapi-core to v2.12.6. ## 2.12.5 (2025-12-09) ### Patch Changes - Updated React dependency to avoid vulnerable React version (19.0.0) affected by CVE-2025-55182. - Updated @redocly/openapi-core to v2.12.5. ## 2.12.4 (2025-12-08) ### Patch Changes - Fixed a compatibility issue with `HTTP_PROXY` environment variable for the `push` command. - Updated @redocly/openapi-core to v2.12.4. ## 2.12.3 (2025-12-05) ### Patch Changes - Updated telemetry implementation to use standardized OpenTelemetry format. - Updated @redocly/openapi-core to v2.12.3. ## 2.12.2 (2025-12-02) ### Patch Changes - Fixed an issue where credentials created by Redocly CLI `login` command were deleted by Redocly VS Code extension when opening VS Code. - Updated @redocly/openapi-core to v2.12.2. ## 2.12.1 (2025-11-28) ### Patch Changes - Fixed an issue where multiple `--mtls` options in the Respect command did not merge as expected. - Updated @redocly/openapi-core to v2.12.1. ## 2.12.0 (2025-11-25) ### Minor Changes - Added OpenAPI 3.2 XML modeling support. ### Patch Changes - Fixed an issue where the `no-required-schema-properties-undefined` caused a crash when encountering unresolved `$ref`s. - Updated @redocly/openapi-core to v2.12.0. ## 2.11.1 (2025-11-10) ### Patch Changes - Fixed an issue where the content of `$ref`s inside example values was erroneously resolved during bundling and linting. - Fixed `no-invalid-media-type-examples` for schemas using `anyOf`/`oneOf`. - Updated @redocly/openapi-core to v2.11.1. ## 2.11.0 (2025-11-04) ### Patch Changes - Updated @redocly/openapi-core to v2.11.0. ## 2.10.0 (2025-10-31) ### Patch Changes - Updated @redocly/openapi-core to v2.10.0. ## 2.9.0 (2025-10-30) ### Patch Changes - Fixed an issue where the `mount-path` option was not validated, leading to errors when used with an empty path or a path identical to the project path. - Updated @redocly/openapi-core to v2.9.0. ## 2.8.0 (2025-10-23) ### Minor Changes - Added the `no-invalid-schema-examples` and `no-invalid-parameter-examples` to the `recommended` ruleset. Added the `no-duplicated-tag-names` to the `spec` ruleset. - Added configuration of Respect mTLS certificates on a per-domain basis. ### Patch Changes - Updated @redocly/openapi-core to v2.8.0. ## 2.7.1 (2025-10-23) ### Patch Changes - Applied proxy settings during Respect execution. - Updated @redocly/openapi-core to v2.7.1. ## 2.7.0 (2025-10-17) ### Patch Changes - Updated @redocly/openapi-core to v2.7.0. ## 2.6.0 (2025-10-16) ### Minor Changes - Added new rules for validating OpenAPI 3.2 description files: `spec-no-invalid-tag-parents`, `spec-example-values`, `spec-discriminator-defaultMapping`, and `spec-no-invalid-encoding-combinations`. Deprecated the `no-example-value-and-externalValue` rule in favor of `spec-example-values`. ### Patch Changes - Updated @redocly/openapi-core to v2.6.0. ## 2.5.1 (2025-10-13) ### Patch Changes - Fixed an issue where the `no-http-verbs-in-paths` rule was incorrectly flagging path names containing the verb `query`. - Updated @redocly/openapi-core to v2.5.1. ## 2.5.0 (2025-10-09) ### Minor Changes - Added response size to the `Respect` terminal and JSON file outputs. ### Patch Changes - Updated @redocly/respect-core to v2.5.0. ## 2.4.0 (2025-10-08) ### Minor Changes - Added the `no-secrets-masking` option to the respect command, allowing raw (unmasked) output to be generated. ### Patch Changes - Updated @redocly/respect-core to v2.4.0. ## 2.3.1 (2025-10-06) ### Patch Changes - Fixed an issue where JSONPath-based success criteria did not support property names with hyphens in `Respect`. - Updated @redocly/openapi-core to v2.3.1. ## 2.3.0 (2025-10-03) ### Minor Changes - Added basic support for **OpenAPI 3.2** specification. ### Patch Changes - Updated @redocly/openapi-core to v2.3.0. ## 2.2.3 (2025-10-02) ### Patch Changes - Fixed an issue where the Respect workflow separator did not render correctly in GitHub CI environments. - Added support for the `verbose` option in the `login` command to provide additional output during authentication. - Updated @redocly/respect-core to v2.2.3. ## 2.2.2 (2025-09-26) ### Patch Changes - Resolved an issue with CLI dependencies to ensure proper package resolution. - Updated @redocly/openapi-core to v2.2.2. ## 2.2.1 (2025-09-25) ### Patch Changes - Fixed an issue where the `remove-unused-components` decorator was not functioning when configured at the API level. - Updated @redocly/openapi-core to v2.2.1. ## 2.2.0 (2025-09-23) ### Minor Changes - Adjusted the calculation of Respect's workflow-level `totalTimeMs` to sum the network request times of all steps. ### Patch Changes - Updated @redocly/respect-core to v2.2.0. ## 2.1.5 (2025-09-19) ### Patch Changes - Improved the message format for Respect's `status code check`. - Fixed handling of input parameters when invoking step target workflows in Respect. - Updated @redocly/respect-core to v2.1.5. ## 2.1.4 (2025-09-17) ### Patch Changes - Fixed undefined variable used in the `remove-unused-components` decorator, which prevented an invalid reference error from being reported. - Updated @redocly/openapi-core to v2.1.4. ## 2.1.3 (2025-09-15) ### Patch Changes - Updated authentication logic to get the residency from `scorecard.fromProjectUrl`. - Updated @redocly/openapi-core to v2.1.3. ## 2.1.2 (2025-09-13) ### Patch Changes - Updated @redocly/openapi-core to v2.1.2. ## 2.1.1 (2025-09-12) ### Patch Changes - Updated @redocly/openapi-core to v2.1.1. ## 2.1.0 (2025-09-10) ### Minor Changes - Updated authentication logic to ensure consistency with the VS Code extension's behavior. ### Patch Changes - Improved error reporting and handling for Digest authentication failures in Respect. Now users receive clearer feedback when required headers or status codes are missing. - Fixed `push` and `push-status` commands mistakenly requiring the `--max-execution-time` option. - Fixed an issue where wildcard file patterns were not recognized in the Docker image. - Updated @redocly/respect-core to v2.1.0. ## 2.0.8 (2025-08-27) ### Patch Changes - Updated @redocly/openapi-core to v2.0.8. ## 2.0.7 (2025-08-22) ### Patch Changes - Improved Respect verbose logs to display response headers. - Updated @redocly/respect-core to v2.0.7. ## 2.0.6 (2025-08-19) ### Patch Changes - Fixed an issue where files specified in decorators parameters were not always resolved correctly. The resolution logic now properly locates the specified files relative to the config file for `info-description-override`, `media-type-examples-override`, `operation-description-override`, and `tag-description-override` decorators. - Improved messaging to clarify when API alias configuration is implicitly applied during linting or bundling by filename. - Updated the `retryAfter` property in Respect to use seconds (instead of milliseconds) for consistency with the Arazzo specification. - Updated @redocly/openapi-core to v2.0.6. ## 2.0.5 (2025-08-13) ### Patch Changes - Fixed an issue where the root config was not properly merged with the `apis` config. - Resolved an issue that caused configuration parsing to fail when the config value was set to `null`. - Improved `join` command server handling for specifications with differing servers. **Warning**: this change may break workflows that relied on root-level server inheritance. - Updated @redocly/respect-core to v2.0.5. ## 2.0.4 (2025-08-12) ### Patch Changes - Fixed an issue where the `openapi` config options were ignored when running the `build-docs` command. - Ensure `externalRefResolver` option is correctly passed to nested workflow contexts. - Updated @redocly/respect-core to v2.0.4. ## 2.0.3 (2025-08-11) ### Patch Changes - Fixed type definitions for Respect `input` and `server` options to support both string and string[] values. - Fixed binary response data in `Respect` results by properly encoding it as base64. - Updated @redocly/respect-core to v2.0.3. ## 2.0.2 (2025-07-29) ### Patch Changes - Made `executionTimeout` parameter optional in the `run` function exported from `respect-core`. - Updated @redocly/respect-core to v2.0.2. ## 2.0.1 (2025-07-25) ### Patch Changes - Fixed an issue where the `no-required-schema-properties-undefined` rule incorrectly resolved nested `$ref`s relative to the file in which they were defined. - Fixed an issue where multipart form-data parameters were not properly resolved and evaluated before sending requests. - Updated @redocly/openapi-core to v2.0.1. ## 2.0.0 (2025-07-24) ### Major Changes - Removed backward compatibility for the `spec` rule. Use `struct` instead. - Removed support for the deprecated `apiDefinitions` option in the Redocly config. Use `apis` instead. Removed the `labels` field within the `apis` section, which was associated with the legacy Redocly API Registry product. - Removed support for default config file names other than `redocly.yaml`. - Removed support for the deprecated `features.openapi` and `features.mockServer` configuration options. Use `openapi` and `mockServer` directly instead. - Removed backward compatibility for the deprecated `lint` and `styleguide` options in the Redocly config. Use `rules`, `decorators` and other related options on the root level instead. - Removed the deprecated `disallowAdditionalProperties` option support in rules. Use `allowAdditionalProperties` instead. - Removed support for the deprecated `theme` property of Redocly config. All the properties of `theme` are now available in the config root. - Removed the deprecated `path-excludes-patterns` and `info-license-url` rules. - Removed the deprecated `undefined` assertion. Use `defined` instead. - Removed support for the legacy Redocly API Registry in favor of the new Reunite platform. Reunite provides improved API management capabilities and better integration with Redocly's tooling ecosystem. Migrated the `login` and `push` commands to work exclusively with Reunite. Removed the `preview-docs` command as part of platform modernization. Use the `preview` command instead. - Removed support for the deprecated `referenceDocs` option, which was related to the legacy Reference docs product. - Removed support for the deprecated `assert/` prefix in configurable rules. Use `rule/` prefix instead. - Migrated the codebase to ES Modules from CommonJS, bringing improved code organization and better support for modern JavaScript features. Update to Node.js version 20.19.0+, 22.12.0+, or 23+. ### Minor Changes - Added `x-security` extension for Respect that enables secure handling of authentication in Arazzo workflows. Use this extension to: - Define security schemes at the step level using either predefined schemes or inline definitions - Pass values of secrets (passwords, tokens, API keys) - Support multiple authentication types including API Key (query, header, or cookie), Basic Authentication, Bearer Token, Digest Authentication, OAuth2, and OpenID Connect - Automatically transform security parameters into appropriate HTTP headers or query parameters - Added environment variable support for CLI arguments using Yargs `.env()` method to parse environment variables with matching prefixes. - Added validation for JSON Schema format. - Extracted `nullable` validation from the `struct` rule into a new `nullable-type-sibling` rule for OpenAPI 3.0. This allows users to disable `nullable` validation separately from other structural checks. - Configured the `spec` ruleset for OpenAPI, AsyncAPI, Arazzo, and Overlay specifications. This ruleset is designed to strictly follow the specifications. - Added the `no-duplicated-tag-names` rule to check for duplications in the `tags` field in API descriptions. - Enabled `no-required-schema-properties-undefined`, `no-schema-type-mismatch`, and `no-enum-type-mismatch` rules for **AsyncAPI** and **Arazzo** specifications. Adjusted the rules' severities in the `recommended` and `minimal` rulesets. Refer to the following table: | Rule \ Ruleset | recommended | minimal | | --- | --- | --- | | no-required-schema-properties-undefined | `off` -> `warn` | `off` -> `warn` | | no-enum-type-mismatch | `error` | `warn` | | no-schema-type-mismatch | `warn` -> `error` | `off` -> `warn` | - Implemented automatic masking of sensitive fields (such as tokens and passwords) in response bodies to enhance security and prevent accidental exposure of secrets in logs and outputs. - Added new CLI options for the `respect` command to improve test execution control. ### Patch Changes - Fixed plugins validation in config files referenced in the `extends` section. - Fixed `no-undefined-server-variable` crash when encountering `null` values in the server list. - Refactored `@redocly/respect-core` to eliminate Node.js-specific dependencies, improving cross-platform compatibility. - Updated Redoc to v2.5.0. - Fixed alias detection when using `--config` from a different folder than the current working directory. - Resolved an issue where `dotenv@16.6.0` injected an unintended message into the output. - Fixed Redocly CLI to correctly read `residency` from the Redocly configuration file. - Improved Respect's error handling when server URLs are missing from both OpenAPI descriptions and CLI options. - Updated @redocly/respect-core to v2.0.0. ## 2.0.0-next.10 (2025-07-24) ### Major Changes - Removed support for the deprecated `theme` property of Redocly config. All the properties of `theme` are now available in the config root. ### Patch Changes - Updated @redocly/openapi-core to v2.0.0-next.10. ## 2.0.0-next.9 (2025-07-24) ### Patch Changes - Refactored `@redocly/respect-core` to eliminate Node.js-specific dependencies, improving cross-platform compatibility. - Updated @redocly/openapi-core to v2.0.0-next.9. ## 2.0.0-next.8 (2025-07-23) ### Major Changes - Removed support for default config file names other than `redocly.yaml`. ### Minor Changes - Enabled `no-required-schema-properties-undefined`, `no-schema-type-mismatch`, and `no-enum-type-mismatch` rules for **AsyncAPI** and **Arazzo** specifications. Adjusted the rules' severities in the `recommended` and `minimal` rulesets. Refer to the following table: | Rule \ Ruleset | recommended | minimal | | --- | --- | --- | | no-required-schema-properties-undefined | `off` -> `warn` | `off` -> `warn` | | no-enum-type-mismatch | `error` | `warn` | | no-schema-type-mismatch | `warn` -> `error` | `off` -> `warn` | ### Patch Changes - Fixed plugins validation in config files referenced in the `extends` section. - Updated @redocly/openapi-core to v2.0.0-next.8. ## 2.0.0-next.7 (2025-07-21) ### Patch Changes - Updated @redocly/openapi-core to v2.0.0-next.7. ## 2.0.0-next.6 (2025-07-21) ### Patch Changes - Updated @redocly/openapi-core to v2.0.0-next.6. ## 2.0.0-next.5 (2025-07-17) ### Major Changes - Removed the deprecated `path-excludes-patterns` and `info-license-url` rules. ### Patch Changes - Updated @redocly/openapi-core to v2.0.0-next.5. ## 2.0.0-next.4 (2025-07-16) ### Minor Changes - Added validation for JSON Schema format. ### Patch Changes - Updated @redocly/openapi-core to v2.0.0-next.4. ## 2.0.0-next.3 (2025-07-14) ### Minor Changes - Configured the `spec` ruleset for OpenAPI, AsyncAPI, Arazzo, and Overlay specifications. This ruleset is designed to strictly follow the specifications. ### Patch Changes - Updated @redocly/openapi-core to v2.0.0-next.3. ## 2.0.0-next.2 (2025-07-10) ### Patch Changes - Resolved an issue where `dotenv@16.6.0` injected an unintended message into the output. - Updated @redocly/openapi-core to v2.0.0-next.2. ## 2.0.0-next.1 (2025-07-09) ### Minor Changes - Extracted `nullable` validation from the `struct` rule into a new `nullable-type-sibling` rule for OpenAPI 3.0. This allows users to disable `nullable` validation separately from other structural checks. - Added the `no-duplicated-tag-names` rule to check for duplications in the `tags` field in API descriptions. - Implemented automatic masking of sensitive fields (such as tokens and passwords) in response bodies to enhance security and prevent accidental exposure of secrets in logs and outputs. ### Patch Changes - Updated @redocly/openapi-core to v2.0.0-next.1. ## 2.0.0-next.0 (2025-07-09) ### Major Changes - Removed backward compatibility for the `spec` rule. Use `struct` instead. - Removed support for the deprecated `apiDefinitions` option in the Redocly config. Use `apis` instead. Removed the `labels` field within the `apis` section, which was associated with the legacy Redocly API Registry product. - Removed support for the deprecated `features.openapi` and `features.mockServer` configuration options. Use `openapi` and `mockServer` directly instead. - Removed backward compatibility for the deprecated `lint` and `styleguide` options in the Redocly config. Use `rules`, `decorators` and other related options on the root level instead. - Removed the deprecated `disallowAdditionalProperties` option support in rules. Use `allowAdditionalProperties` instead. - Removed the deprecated `undefined` assertion. Use `defined` instead. - Removed support for the legacy Redocly API Registry in favor of the new Reunite platform. Reunite provides improved API management capabilities and better integration with Redocly's tooling ecosystem. Migrated the `login` and `push` commands to work exclusively with Reunite. Removed the `preview-docs` command as part of platform modernization. Use the `preview` command instead. - Removed support for the deprecated `referenceDocs` option, which was related to the legacy Reference docs product. - Removed support for the deprecated `assert/` prefix in configurable rules. Use `rule/` prefix instead. - Migrated the codebase to ES Modules from CommonJS, bringing improved code organization and better support for modern JavaScript features. Update to Node.js version 20.19.0+, 22.12.0+, or 23+. ### Minor Changes - Added `x-security` extension for Respect that enables secure handling of authentication in Arazzo workflows. Use this extension to: - Define security schemes at the step level using either predefined schemes or inline definitions - Pass values of secrets (passwords, tokens, API keys) - Support multiple authentication types including API Key (query, header, or cookie), Basic Authentication, Bearer Token, Digest Authentication, OAuth2, and OpenID Connect - Automatically transform security parameters into appropriate HTTP headers or query parameters - Added environment variable support for CLI arguments using Yargs `.env()` method to parse environment variables with matching prefixes. - Added new CLI options for the `respect` command to improve test execution control. ### Patch Changes - Fixed `no-undefined-server-variable` crash when encountering `null` values in the server list. - Updated Redoc to v2.5.0. - Fixed alias detection when using `--config` from a different folder than the current working directory. - Fixed Redocly CLI to correctly read `residency` from the Redocly configuration file. - Improved Respect's error handling when server URLs are missing from both OpenAPI descriptions and CLI options. - Updated @redocly/respect-core to v2.0.0-next.0.