Repository navigation
Update OpenAPI Spec (main) - #295063
Merged
Merged
Update OpenAPI Spec (main)#295063
Conversation
Contributor
|
Pinging @elastic/kibana-core (Team:Core) |
elastic-renovate-prod
Bot
force-pushed
the
renovate/main-openapi-spec
branch
from
October 2, 2026 12:19
c3ec5fc to
52a583a
Compare
elastic-renovate-prod
Bot
force-pushed
the
renovate/main-openapi-spec
branch
from
October 4, 2026 22:14
52a583a to
be68c54
Compare
Member
|
run renovate helper |
afharo
approved these changes
Oct 5, 2026
afharo
enabled auto-merge
October 5, 2026 11:58
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
afharo
disabled auto-merge
October 5, 2026 13:49
Redocly 2.53 parses these schemas with js-yaml 5, which rejects a multiline flow collection whose closing bracket is not indented past its parent key. Co-authored-by: Cursor <cursoragent@cursor.com>
elastic-vault-github-plugin-prod
Bot
requested a review
from a team
as a code owner
October 5, 2026 15:12
Contributor
💛 Build succeeded, but was flaky
Failed CI Steps
Metrics [docs]Unknown metric groupswarm start memory
workflow yaml validation
Test Failures
History
|
florent-leborgne
approved these changes
Oct 12, 2026
TamerlanG
approved these changes
Oct 12, 2026
…pi-spec Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
💛 Build succeeded, but was flaky
Failed CI StepsMetrics [docs]Page load bundle
Unknown metric groupswarm start memory
workflow yaml validation
Test Failures
History
|
afharo
enabled auto-merge
October 29, 2026 14:35
kelvtanv
approved these changes
Oct 30, 2026
Contributor
|
Starting backport for target branches: 8.19, 9.4, 9.5, 9.6 |
Contributor
💔 All backports failed
Manual backportTo create the backport manually run: Questions ?Please refer to the Backport tool documentation |
Contributor
|
Backport failed. Please check the action logs for details. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
13.0.0→13.1.02.36.0→2.53.32.10.0→2.11.0^2.8.4→^2.11.0Release Notes
APIDevTools/swagger-parser (@apidevtools/swagger-parser)
v13.1.0Compare Source
Features
Redocly/redocly-cli (@redocly/cli)
v2.53.3Compare Source
Patch Changes
respectso a same-workflowgotono longer cleared$stepsoutputs from steps that already ran.Previously, this broke $steps expressions in the target step.
v2.53.2Compare Source
Patch Changes
startandendline and column positions to each problem location in the--format=jsonlint output.v2.53.1Compare Source
Patch Changes
build-docscommand about the upcoming switch to Redoc 3.v2.53.0Compare Source
Minor Changes
disallowDefaultoption to theoperation-2xx-responserule, which requires an explicit 2xx response when enabled.There is no change in current behavior.
Patch Changes
v2.52.1Compare Source
Patch Changes
redocto the2.5.4version to fix accessibility problems in the HTML produced bybuild-docs.Added the
langattribute to the defaultbuild-docstemplate.v2.52.0Compare Source
Minor Changes
redocly-clifor everyday CLI usage,redocly-lint-rulesfor writing configurable rules and custom plugins.Install them with
npx skills add https://redocly.com.inspect-node-typescommand to navigate the Redocly's node type tree of an API description.inspect-node-typeshelps pick the correctsubjecttypes for a configurable rule or the correct visitor for a custom plugin.strategyoption to thecomponent-name-uniquerule, matching the--component-names-strategyoption of thebundlecommand.introspect-mcpcommand that analyzes a running MCP server and records its tools, prompts, resources, and capabilities.introspect-mcprecords its findings in thex-mcpextension of an OpenAPI description.Patch Changes
v2.51.2Compare Source
Patch Changes
fast-urito the3.1.7version to resolveCVE-2026-75931,CVE-2026-75975,CVE-2026-75899, andCVE-2026-76172.driftandcoveragefailing to match a path template whose segment mixes literal text with parameters, such as/instances/{worldId}:{instanceId}.v2.51.1Compare Source
Patch Changes
generate-arazzoproduced a malformed remote description URL insourceDescriptions(https://collapsed tohttps:/) when--output-filewas provided.$faker.string.email()used without options generated addresses at theundefined.comdomain.@faker-js/fakerto the10.6.0version to resolve the high severity advisoryGHSA-qxc2-j82w-r537.v2.51.0Compare Source
Minor Changes
generate-arazzocommand to print a ready-to-runrespectcommand after generation, including an--inputplaceholder for every workflow input.--with-ai,--ai-provider,--ai-model,--ai-concurrency, and--max-workflowsoptions to thegenerate-arazzocommand.--with-aiuses a local AI CLI (claude,codex, orcursor) and OpenAPI descriptions to redesign the generated one-workflow-per-operation skeleton into multi-step workflows.The AI designs at most
--max-workflowsworkflows (default 10), and the generated file is marked as AI-inferred.For descriptions that don't fit a single prompt, the AI first selects scenarios from a compact operation index, then it designs each workflow separately.
Patch Changes
respectand thex-security-scheme-required-valuesrule incorrectly rejectedx-securityHTTP schemes written with non-lowercase casing (such asBasic,Bearer, orDigest).RFC 7235 scheme names are case-insensitive.
v2.50.0Compare Source
Minor Changes
schemaassertion for configurable rules.The assertion validates a property value against a JSON Schema.
Patch Changes
v2.49.1Compare Source
Patch Changes
$refs pointed to the same path item.v2.49.0Compare Source
Minor Changes
Added the
no-illogical-composition-keywordsrule.Note: the rule is set to
warnin therecommendedruleset and toerrorinrecommended-strict. Existing API descriptions may report new problems.Patch Changes
npmwas not available.v2.48.0Compare Source
Minor Changes
python,go,php, andcligenerators beside the TypeScript client, each self-documenting with--docs, configurable per generator, and available as source in your own repository througheject-generator.Patch Changes
bundlecommand didn't resolve$refs inside an AsyncAPI 3 Multi Format Schema Object.respect --har-outputrecorded an emptypostDatafor every request.Request bodies are written to the HAR.
Captures replayed through
driftcan have their request bodies validated instead of silently passing.v2.47.0Compare Source
Minor Changes
statscommand that reports how many distinctx-extensions a description file uses and how often each one occurs.Patch Changes
statscommand reporting wrong parameter count for AsyncAPI descriptions.v2.46.2Compare Source
Patch Changes
v2.46.1Compare Source
Patch Changes
@redocly/ajvto^8.18.3.v2.46.0Compare Source
Minor Changes
spec-ref-siblingsrule that reports properties placed next to a$refwhich the specification does not allow.Patch Changes
v2.45.0Compare Source
Minor Changes
bundlecommand losing schema keywords (such astitle,properties, orrequired) written next to a$refwhen the referenced schemas started with their own$ref.Patch Changes
v2.44.2Compare Source
Patch Changes
security-definedrule for AsyncAPI 2.x and 3.x in therecommendedruleset fromerrortowarn.AsyncAPI descriptions with undefined or unresolved security no longer fail linting by default.
v2.44.1Compare Source
Patch Changes
undicito the6.28.0version.operation-4xx-problem-details-rfc7807rule incorrectly reported thetypeandtitleproperties inherited throughallOfas missing.v2.44.0Compare Source
Minor Changes
Added the
no-duplicated-enum-valuesrule that requires all values in anenumto be unique.The rule is enabled at the
warnlevel in therecommendedruleset.Note: linting output may include new warnings for API descriptions that contain duplicated enum values.
Added the
no-unsafe-markdownrule that disallows potentially executable content indescriptionfields.The rule is enabled at the
warnlevel in therecommendedruleset.Note: linting output may include new warnings for
descriptionfields that contain potentially executable content.Patch Changes
v2.43.3Compare Source
Patch Changes
v2.43.2Compare Source
Patch Changes
v2.43.1Compare Source
Patch Changes
v2.43.0Compare Source
Patch Changes
v2.42.0Compare Source
Minor Changes
generate-clientcommand that generates a typed, zero-dependency TypeScript client from an OpenAPI description — auth, retries, middleware, typed SSE streaming, pagination, and multipart included — plus optional companion generators for Zod validation, TanStack Query and SWR hooks, MSW mocks, and date transformers.See the
generate-clientcommand reference and the Use the generated client guide.Patch Changes
v2.41.2Compare Source
Patch Changes
Updated js-yaml from
5.2.1to5.2.2to resolve a vulnerability in YAML parsing.Added support for the Arazzo spec-compliant workflow reference form
$sourceDescriptions.<name>.<workflowId>independsOn, stepworkflowId, and success/failure actionworkflowId.Unresolvable workflow references fail only the affected workflow with a clear error message, and no longer abort the whole run or pass unnoticed.
Updated @redocly/openapi-core to v2.41.2.
Updated @redocly/respect-core to v2.41.2.
v2.41.1Compare Source
Patch Changes
driftcommand'sschema-consistencyrule reported false-positive findings foroneOfschemas with adiscriminator.Payloads are validated only against the branch selected by the discriminator value instead of every
oneOfbranch.Schemas whose discriminator does not meet Ajv's structural requirements keep the previous behavior.
driftcommand's built-in undocumented-header ignore list withx-amz-,x-amzn-andx-github-prefixes, and thex-hub-signature/x-hub-signature-256webhook signature headers.v2.41.0Compare Source
Minor Changes
security-scopes-definedthat requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme.The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in
requireScopesoption that requires OAuth2 security requirements to list at least one scope.Patch Changes
respectwhere the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed.cursorAI provider of thegenerate-speccommand sent only the instructions to the model and the operation to refine never reached it.v2.40.0Compare Source
Minor Changes
--ignore-headersoption to the experimentaldriftandproxycommands.It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing
*matches by prefix (for examplex-consumer-*).Use it to silence headers a gateway or proxy adds that are not part of the API contract.
generate-speccommand that infers an OpenAPI description from recorded HTTP traffic.Patch Changes
Fixed the
driftcommand'sschema-consistencyrule reporting false-positive "Undocumented query parameter" findings fordeepObject-style query parameters.Traffic keys like
namespace[id]=...&namespace[name]=...are now matched to the documentednamespaceparameter, and the reconstructed object is validated against the parameter schema.Fixed an issue where the
driftcommand'sschema-consistencyrule reported false-positive request findings for exchanges the server rejected with a4xxclient error.For example: missing required parameter, missing required body, request-body schema mismatch.
A
4xxresponse means the server never accepted the request.Validating it against the operation's success-path contract flagged the server's own correct rejection as drift.
Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.
Fixed an issue where the
joincommand silently dropped path-levelx-*extensions with non-string values.Updated js-yaml from
4.2.0to5.2.1.Fixed an issue where strings that look like numbers with underscores (for example
'12_34') had quotation marks removed by thebundlecommand.These strings stay quoted in the output.
Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error.
Parse errors are reported at the offending token instead of the end of the document.
Fixed an issue where the
driftcommand'ssecurity-baselinerule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example:localhost,*.localhost,127.0.0.0/8,[::1].Sandboxed recordings no longer produce transport warnings.
Fixed an issue where the
bundlecommand rewrote internal$refs pointing to other$refs.The issue caused AsyncAPI 3 operation
messagesreferences to point tocomponentsinstead of channel messages.Updated @redocly/openapi-core to v2.40.0.
v2.39.0Compare Source
Minor Changes
structrule to validate the contents of AsyncAPI protocol-specific bindings.Added typed definitions for the
sns,sqs,ibmmq,googlepubsub,pulsarandros2bindings.Patch Changes
v2.38.0Compare Source
Minor Changes
driftcommand that compares recorded HTTP traffic (HAR, Kong, Nginx/Apache JSON, NDJSON) against an OpenAPI description and reports undocumented endpoints, schema mismatches, and security findings.proxycommand that captures live HTTP traffic through a reverse proxy into a HAR file and optionally validates it against an OpenAPI description in real time.Patch Changes
v2.37.0Compare Source
Minor Changes
.graphql/.gql).Patch Changes
bump-sh/cli (bump-cli)
v2.11.0: (2026-09-14) Dependencies update and allow Arazzo documents v1.1Compare Source
Workflows are now Generally available 🎉
Upgrades
Have fun designing APIs ✨
v2.10.1: (2026-06-16) Dependencies update and fixes with Bump.sh workspace APICompare Source
What's Changed
🆕 Use documentation name and MCP server name in CLI output
Favor "Your {documentationName}... has received a new deployment" (instead of raw doc_id)
📝 Copywriting
🔧 Dependencies
🐛Bugfix
Full Changelog: bump-sh/cli@v2.10.0...v2.10.1
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.