chore(deps): update dependency @redocly/cli to v2.51.2 by renovate[bot] · Pull Request #51 · wave-av/api-spec

renovate · 2026-08-11T23:01:28Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@redocly/cli	`2.40.0` → `2.51.2`

Release Notes

Redocly/redocly-cli (@redocly/cli)

`v2.51.2`

Compare Source

Patch Changes

Updated fast-uri to the 3.1.7 version to resolve CVE-2026-75931, CVE-2026-75975, CVE-2026-75899, and CVE-2026-76172.
Fixed drift and coverage failing to match a path template whose segment mixes literal text with parameters, such as /instances/{worldId}:{instanceId}.
Fixed an issue where Redocly config resolution failed when plugins used ESM syntax.
Updated @redocly/openapi-core to v2.51.2.

`v2.51.1`

Compare Source

Patch Changes

Fixed an issue where generate-arazzo produced a malformed remote description URL in sourceDescriptions (https:// collapsed to https:/) when --output-file was provided.
Fixed an issue where $faker.string.email() used without options generated addresses at the undefined.com domain.
Updated @redocly/respect-core to v2.51.1.
Updated @faker-js/faker to the 10.6.0 version to resolve the high severity advisory GHSA-qxc2-j82w-r537.

`v2.51.0`

Compare Source

Minor Changes

Enhanced the generate-arazzo command to print a ready-to-run respect command after generation, including an --input placeholder for every workflow input.
Added --with-ai, --ai-provider, --ai-model, --ai-concurrency, and --max-workflows options to the generate-arazzo command.
--with-ai uses a local AI CLI (claude, codex, or cursor) and OpenAPI descriptions to redesign the generated one-workflow-per-operation skeleton into multi-step workflows.
The AI designs at most --max-workflows workflows (default 10), and the generated file is marked as AI-inferred.
For descriptions that don't fit a single prompt, the AI first selects scenarios from a compact operation index, then it designs each workflow separately.

Patch Changes

Fixed an issue where respect and the x-security-scheme-required-values rule incorrectly rejected x-security HTTP schemes written with non-lowercase casing (such as Basic, Bearer, or Digest).
RFC 7235 scheme names are case-insensitive.
Updated @redocly/openapi-core to v2.51.0.
Updated @redocly/respect-core to v2.51.0.

`v2.50.0`

Compare Source

Minor Changes

Added a new schema assertion for configurable rules.
The assertion validates a property value against a JSON Schema.

Patch Changes

Updated @redocly/openapi-core to v2.50.0.

`v2.49.1`

Compare Source

Patch Changes

Fixed an issue where rule incorrectly reported a duplicate parameter when two or more $refs pointed to the same path item.
Updated @redocly/openapi-core to v2.49.1.

`v2.49.0`

Compare Source

Minor Changes

Added the no-illogical-composition-keywords rule.

Note: the rule is set to warn in the recommended ruleset and to error in recommended-strict. Existing API descriptions may report new problems.

Patch Changes

Fixed an issue where telemetry silently failed to send when npm was not available.
Updated @redocly/openapi-core to v2.49.0.

`v2.48.0`

Compare Source

Minor Changes

Added agent-friendly client generation: python, go, php, and cli generators beside the TypeScript client, each self-documenting with --docs, configurable per generator, and available as source in your own repository through eject-generator.

Patch Changes

Fixed an issue where the bundle command didn't resolve $refs inside an AsyncAPI 3 Multi Format Schema Object.
Fixed an issue where respect --har-output recorded an empty postData for every request.
Request bodies are written to the HAR.
Captures replayed through drift can have their request bodies validated instead of silently passing.
Updated @redocly/client-generator to v0.4.0.
Updated @redocly/openapi-core to v2.48.0.

`v2.47.0`

Compare Source

Minor Changes

Added a Vendor Extensions metric to the stats command that reports how many distinct x- extensions a description file uses and how often each one occurs.

Patch Changes

Fixed the stats command reporting wrong parameter count for AsyncAPI descriptions.
Updated @redocly/openapi-core to v2.47.0.

Patch Changes

Updated @redocly/ajv to ^8.18.3.
Updated @redocly/openapi-core to v2.46.1.
Updated @redocly/respect-core to v2.46.1.

`v2.46.0`

Compare Source

Minor Changes

Added the spec-ref-siblings rule that reports properties placed next to a $ref which the specification does not allow.

Patch Changes

Updated @redocly/openapi-core to v2.46.0.

`v2.45.0`

Compare Source

Minor Changes

Fixed the bundle command losing schema keywords (such as title, properties, or required) written next to a $ref when the referenced schemas started with their own $ref.

Patch Changes

Updated @redocly/openapi-core to v2.45.0.

`v2.44.2`

Compare Source

Patch Changes

Changed the severity of the security-defined rule for AsyncAPI 2.x and 3.x in the recommended ruleset from error to warn.
AsyncAPI descriptions with undefined or unresolved security no longer fail linting by default.
Updated @redocly/openapi-core to v2.44.2.

`v2.44.1`

Compare Source

Patch Changes

Updated undici to the 6.28.0 version.
Fixed an issue where the operation-4xx-problem-details-rfc7807 rule incorrectly reported the type and title properties inherited through allOf as missing.
Updated @redocly/openapi-core to v2.44.1.

`v2.44.0`

Compare Source

Minor Changes

Added the no-duplicated-enum-values rule that requires all values in an enum to be unique.
The rule is enabled at the warn level in the recommended ruleset.

Note: linting output may include new warnings for API descriptions that contain duplicated enum values.
Added the no-unsafe-markdown rule that disallows potentially executable content in description fields.
The rule is enabled at the warn level in the recommended ruleset.

Note: linting output may include new warnings for description fields that contain potentially executable content.

Patch Changes

Updated @redocly/client-generator to v0.3.0.
Updated @redocly/openapi-core to v2.44.0.

`v2.43.3`

Compare Source

Patch Changes

Updated @redocly/respect-core to v2.43.3.

`v2.43.2`

Compare Source

Patch Changes

Updated @redocly/client-generator to v0.2.0.
Updated @redocly/openapi-core to v2.43.2.

`v2.43.1`

Compare Source

Patch Changes

Updated @redocly/openapi-core to v2.43.1.

`v2.43.0`

Compare Source

Patch Changes

Updated @redocly/openapi-core to v2.43.0.

`v2.42.0`

Compare Source

Minor Changes

Added an experimental generate-client command that generates a typed, zero-dependency TypeScript client from an OpenAPI description — auth, retries, middleware, typed SSE streaming, pagination, and multipart included — plus optional companion generators for Zod validation, TanStack Query and SWR hooks, MSW mocks, and date transformers.
See the generate-client command reference and the Use the generated client guide.

Patch Changes

Updated @redocly/client-generator to v0.1.0.
Updated @redocly/openapi-core to v2.42.0.

`v2.41.2`

Compare Source

Patch Changes

Updated js-yaml from 5.2.1 to 5.2.2 to resolve a vulnerability in YAML parsing.
Added support for the Arazzo spec-compliant workflow reference form $sourceDescriptions.<name>.<workflowId> in dependsOn, step workflowId, and success/failure action workflowId.

Unresolvable workflow references fail only the affected workflow with a clear error message, and no longer abort the whole run or pass unnoticed.
Updated @redocly/openapi-core to v2.41.2.
Updated @redocly/respect-core to v2.41.2.

`v2.41.1`

Compare Source

Patch Changes

Fixed an issue where the drift command's schema-consistency rule reported false-positive findings for oneOf schemas with a discriminator.
Payloads are validated only against the branch selected by the discriminator value instead of every oneOf branch.
Schemas whose discriminator does not meet Ajv's structural requirements keep the previous behavior.
Extended the drift command's built-in undocumented-header ignore list with x-amz-, x-amzn- and x-github- prefixes, and the x-hub-signature / x-hub-signature-256 webhook signature headers.

`v2.41.0`

Compare Source

Minor Changes

Added a new built-in rule security-scopes-defined that requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme.
The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in requireScopes option that requires OAuth2 security requirements to list at least one scope.

Patch Changes

Fixed an issue in respect where the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed.
Fixed an issue where the cursor AI provider of the generate-spec command sent only the instructions to the model and the operation to refine never reached it.
Updated @redocly/openapi-core to v2.41.0.
Updated @redocly/respect-core to v2.41.0.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-08-11T23:01:32Z

PR author is in the excluded authors list.

socket-security · 2026-08-11T23:02:01Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@redocly/cli@2.40.0 ⏵ 2.51.2	⁺¹²

View full report

devin-ai-integration

Devin Review found 2 potential issues.

devin-ai-integration · 2026-08-11T23:02:16Z

  },
  "devDependencies": {
-    "@redocly/cli": "2.40.0",
+    "@redocly/cli": "2.46.1",


🔍 New recommended rules in 2.44/2.46 may add lint output

The bump crosses 2.44.0 (no-duplicated-enum-values, no-unsafe-markdown added at warn) and 2.46.0 (spec-ref-siblings added). redocly.yaml extends recommended, so these apply to openapi.yaml via npm run lint. Warn-level rules do not fail the gate per the comment in redocly.yaml:3-6, but the severity of spec-ref-siblings in recommended is not stated in the release notes — worth confirming a lint run stays green before merge.

Was this helpful? React with 👍 or 👎 to provide feedback.

cursor

Risk: low. Left a non-blocking comment because Cursor Security Agent skipped (not a successful completion) and Cursor Bugbot was not present. Assigned yakimoto for human review of this @redocly/cli dependency bump.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

macroscopeapp · 2026-08-11T23:03:03Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a small development-tool dependency and lockfile refresh with no indicated customer-facing API, schema, or production-runtime change. Both changed files are owned by the core team rather than the automated author, so designated human review is warranted.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

codeant-ai · 2026-08-23T04:00:26Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

codeant-ai · 2026-08-26T18:09:57Z