chore: 🔖 release new versions

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@redocly/cli@2.40.0

Minor Changes

• Added an --ignore-headers option to the experimental drift and proxy commands.
  It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing * matches by prefix (for example x-consumer-*).
  Use it to silence headers a gateway or proxy adds that are not part of the API contract.
• Added an experimental generate-spec command that infers an OpenAPI description from recorded HTTP traffic.

Patch Changes

• Fixed the drift command's schema-consistency rule reporting false-positive "Undocumented query parameter" findings for deepObject-style query parameters.
  Traffic keys like namespace[id]=...&namespace[name]=... are now matched to the documented namespace parameter, and the reconstructed object is validated against the parameter schema.

• Fixed an issue where the drift command's schema-consistency rule reported false-positive request findings for exchanges the server rejected with a 4xx client error.
  For example: missing required parameter, missing required body, request-body schema mismatch.
  A 4xx response means the server never accepted the request.
  Validating it against the operation's success-path contract flagged the server's own correct rejection as drift.
  Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.

• Fixed an issue where the join command silently dropped path-level x-* extensions with non-string values.

• Updated js-yaml from 4.2.0 to 5.2.1.
  Fixed an issue where strings that look like numbers with underscores (for example '12_34') had quotation marks removed by the bundle command.
  These strings stay quoted in the output.

  Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error.
  Parse errors are reported at the offending token instead of the end of the document.

• Fixed an issue where the drift command's security-baseline rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: localhost, *.localhost, 127.0.0.0/8, [::1].
  Sandboxed recordings no longer produce transport warnings.

• Fixed an issue where the bundle command rewrote internal $refs pointing to other $refs.
  The issue caused AsyncAPI 3 operation messages references to point to components instead of channel messages.

• Updated @redocly/openapi-core to v2.40.0.

@redocly/openapi-core@2.40.0

Minor Changes

• Added linting for the OpenAPI 3.2 Example Object dataValue field.

Patch Changes

• Updated @redocly/config to v0.52.0.

• Updated js-yaml from 4.2.0 to 5.2.1.
  Fixed an issue where strings that look like numbers with underscores (for example '12_34') had quotation marks removed by the bundle command.
  These strings stay quoted in the output.

  Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error.
  Parse errors are reported at the offending token instead of the end of the document.

• Fixed an issue where the bundle command rewrote internal $refs pointing to other $refs.
  The issue caused AsyncAPI 3 operation messages references to point to components instead of channel messages.

@redocly/respect-core@2.40.0

Patch Changes

• Updated @redocly/openapi-core to v2.40.0.

---

Note

Low Risk
No application source changes—only version bumps, lockfile updates, and changelog consolidation; user impact is whatever was already merged and listed in the 2.40.0 release notes (notably stricter js-yaml parsing).

Overview
Release 2.40.0 — this PR finalizes the Changesets release: it removes the consumed .changeset entries, bumps @redocly/cli, @redocly/openapi-core, and @redocly/respect-core to 2.40.0, and rolls their notes into docs/@v2/changelog.md and each package CHANGELOG.md (with matching package-lock.json / package.json version pins).

What ships in 2.40.0 (documented in those changelogs, not implemented in this diff): experimental generate-spec and --ignore-headers on drift/proxy; drift fixes for deepObject query params, 4xx request validation, and loopback transport warnings; join preserving non-string path x-* extensions; js-yaml 5.2.1 (stricter YAML parsing); bundle fixes for chained $refs (AsyncAPI 3 messages); OpenAPI 3.2 Example dataValue linting in core.

^{Reviewed by Cursor Bugbot for commit 029e302. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Redocly Config version mismatch: The latest published version of @redocly/config is 0.52.0, but the current version is 0.51.0. Please consider updating to the latest version.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	71.83% (🎯 69%)	8624 / 12005
🔵	Statements	71.53% (🎯 69%)	8971 / 12541
🔵	Functions	76.47% (🎯 73%)	1707 / 2232
🔵	Branches	63.39% (🎯 61%)	5799 / 9147

File Coverage

No changed files found.

Generated in workflow #10792 for commit 029e302 by the Vitest Coverage Report Action

[github-actions]

Performance Benchmark (Lower is Faster)

CLI Version	Bundle	Lint	Check Config
cli-2.0.0	▓▓▓▓▓▓▓ 1.22x ± 0.02	▓▓▓▓▓▓▓▓ 1.24x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.73x ± 0.01
cli-2.11.1	▓▓▓▓▓▓▓ 1.23x ± 0.01	▓▓▓▓▓▓▓▓▓ 1.29x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.75x ± 0.01
cli-2.13.0	▓▓▓▓▓▓▓▓ 1.25x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.56x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.79x ± 0.02
cli-2.14.2	▓▓▓▓▓▓▓ 1.22x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.52x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.76x ± 0.01
cli-2.27.0	▓▓▓▓▓▓▓▓ 1.25x ± 0.02	▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.44x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.81x ± 0.01
cli-2.30.2	▓▓▓▓▓▓▓▓ 1.27x ± 0.01	▓▓▓▓▓▓ 1.17x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.83x ± 0.02
cli-2.31.0	▓▓▓▓▓▓▓▓ 1.25x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.44x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.82x ± 0.01
cli-2.32.1	▓▓▓▓▓▓▓▓ 1.25x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.46x ± 0.01	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 1.82x ± 0.01
cli-latest	▓ 1.00x (Fastest)	▓ 1.00x (Fastest)	▓ 1.00x (Fastest)
cli-next	▓▓ 1.06x ± 0.01	▓ 1.01x ± 0.01	▓ 1.01x ± 0.01

Warning

This PR may introduce a performance regression vs the latest released version:

• Bundle: 6.2% slower