chore(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@redocly/cli	2.32.2 → 2.39.0
lint-staged	17.0.7 → 17.1.0
semantic-release	25.0.5 → 25.0.8
sinon (source)	22.0.0 → 22.1.0

---

Release Notes

Redocly/redocly-cli (@​redocly/cli)

v2.39.0

Compare Source

Minor Changes

• Added support for AsyncAPI 3.1.0 descriptions.
• Fixed the struct rule to validate the contents of AsyncAPI protocol-specific bindings.
  Added typed definitions for the sns, sqs, ibmmq, googlepubsub, pulsar and ros2 bindings.

Patch Changes

• Updated @​redocly/openapi-core to v2.39.0.

v2.38.0

Compare Source

Minor Changes

• Added an experimental drift command that compares recorded HTTP traffic (HAR, Kong, Nginx/Apache JSON, NDJSON) against an OpenAPI description and reports undocumented endpoints, schema mismatches, and security findings.
• Added an experimental proxy command that captures live HTTP traffic through a reverse proxy into a HAR file and optionally validates it against an OpenAPI description in real time.

Patch Changes

• Updated @​redocly/openapi-core to v2.38.0.

v2.37.0

Compare Source

Minor Changes

• Added experimental support for linting GraphQL SDL schema files (.graphql / .gql).

Patch Changes

• Updated @​redocly/openapi-core to v2.37.0.

v2.36.0

Compare Source

Minor Changes

• Added a Subresource Integrity (SRI) hash to the Redoc standalone script tag in the HTML produced by build-docs, ensuring the script's integrity.

v2.35.1

Compare Source

Patch Changes

• Updated undici to the 6.27.0 version.

v2.35.0

Compare Source

Minor Changes

• Added support for validating Arazzo 1.1.0 descriptions syntax in the lint command.
• Added the spec-step-mutually-exclusive-fields Arazzo rule to flag steps that use more than one mutually exclusive operation field (operationId, operationPath, workflowId, channelPath, or x-operation).

v2.34.0

Compare Source

v2.33.2

Compare Source

Patch Changes

• Fixed a path traversal in the split command that might have written files outside the chosen --outDir.
• Updated @​redocly/openapi-core to v2.33.2.

v2.33.1

Compare Source

Patch Changes

• Updated @​redocly/openapi-core to v2.33.1.

v2.33.0

Compare Source

Minor Changes

• Added the --component-names-strategy option to the bundle command.
  This option allows a choice of how inline Schema components are named: basename (default) or title (from each schema's title field).

Patch Changes

• Updated @​redocly/openapi-core to v2.33.0.

lint-staged/lint-staged (lint-staged)

v17.1.0

Compare Source

Minor Changes

• #​1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

  Before:

  Size of node_modules/ after installing: 1561.7 kB with 29 packages.

  Fancy interactive spinners, but output dynamically changes:

  ✔ Backed up original state in git stash (0b191303)
  ✔ Running tasks for staged files...
  ✔ Staging changes from tasks...
  ✔ Cleaning up temporary files...

  After:

  Size of node_modules/ after installing: 974.0 kB with 5 packages (37.6 % smaller, 82.7 % less transitive dependencies).

  Simpler but more explicit output:

  ⋯ Backing up original state…
  ✔ Done backing up original state (35b38ed1)!
  ⋯ Running tasks for staged files…
      *.js — 1 file
        ⋯ oxlint --fix
      *.{json,md} — 1 file
        ⋯ oxfmt --write
  
  ✔ oxfmt --write
  ✔ oxlint --fix
  
  ✔ Done running tasks for staged files!
  ⋯ Staging changes from tasks…
  ✔ Done staging changes from tasks!
  ⋯ Cleaning up temporary files…
  ✔ Done cleaning up temporary files!

Patch Changes

• #​1816 c19079d - Try to restore hidden unstaged changes when using --no-revert.

• #​1818 efb23a2 - Console output colors are enabled/disabled more consistently.

• #​1818 26112a1 - Failed JS function tasks now properly kill other tasks, unless --continue-on-error is used. Previously their failure didn't affect other tasks.

v17.0.8

Compare Source

Patch Changes

• #​1809 179b437 - Fix lint-staged discarding the ongoing merge conflict status (.git/MERGE_HEAD) when using the --hide-unstaged or --hide-all options.

• #​1811 3d0b2c0 - Fix issues with Git commands that are successful but also emit warnings to stderr, by ignoring the stderr output completely when the process exits with code 0. This was the behavior when using nano-spawn and execa, but when switching to tinyexec in 16.3.0 both stdout and stderr were used as interleaved output.

semantic-release/semantic-release (semantic-release)

v25.0.8

Compare Source

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#​4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

Compare Source

Bug Fixes

• argument Injection via repositoryUrl in package.json (#​4245) (c46dbda)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

sinonjs/sinon (sinon)

v22.1.0

Compare Source

• d36e921b
  fix: let returns override returnsArg (王胜)

  Signed-off-by: 王胜 <2318857637@​qq.com>

• 40c4caa0
  fix: align restoreObject docs test with idempotent behavior (#​2745) (Julia Miller)

  restoreObject was made idempotent in #​2737 — it no longer throws
  for objects with no restorable methods. Updates the docs page
  and its corresponding test to reflect this.

• a68dac19
  fix: throw a clear error when throwArg index equals the argument count (#​2743) (spokodev)

  • fix: throw a clear error when throwArg index equals the argument count

  spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it
  with pos equal to the number of recorded arguments slipped past the guard
  and reached throw this.args[pos], throwing undefined instead of the
  intended TypeError. A thrown undefined cannot be inspected as an Error and
  is reported by test frameworks as no exception thrown.

  Use >= to match ensureArgs in behavior.js and the sibling callArg helpers,
  which already reject an out-of-range index with a clear error.

• 9ea504e3
  feat: make sinon.restoreObject idempotent (#​2737) (Ilia Choly)

  Passing an object with no live fakes to restoreObject now restores
  nothing instead of throwing, giving it symmetry with sinon.restore()
  and sandbox.restore(). The strict "found no methods" check is retained
  for spy(object) and stub(object), which now use a dedicated
  walkObjectStrict export, while restoreObject uses the loose walkObject.
  Passing a falsy value still throws.

  Fixes #​2736

• 4db4feff
  fix: preserve fake undefined argument validation (Vishal Kumar Singh)
• 755a40d7
  fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

  The global callId counter in proxy-invoke.js caused calledImmediatelyBefore
  and calledImmediatelyAfter to fail when tests run in parallel with separate
  sandboxes. Each sandbox now maintains its own callId counter, passed through
  the spy/stub/fake creation chain via a context object.

  Fixes #​2472

Released by Morgan Roderick on 2026-07-20.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[adobe-bot]

🎉 This PR is included in version 1.13.6 🎉

The release is available on:

• v1.13.6
• GitHub release

Your semantic-release bot 📦🚀