Skip to content

Update OpenAPI Spec (main) - #295063

Merged
afharo merged 7 commits into
mainfrom
renovate/main-openapi-spec
Oct 30, 2026
Merged

afharo merged 7 commits into
mainfrom
renovate/main-openapi-spec

Conversation

@elastic-renovate-prod

@elastic-renovate-prod elastic-renovate-prod Bot commented Oct 2, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@apidevtools/swagger-parser (source) 13.0.0 → 13.1.0 age confidence
@redocly/cli 2.36.0 → 2.53.3 age confidence
bump-cli (source) 2.10.0 → 2.11.0 age confidence
bump-cli (source) ^2.8.4 → ^2.11.0 age confidence

Release Notes

APIDevTools/swagger-parser (@​apidevtools/swagger-parser)

v13.1.0

Compare Source

Features
  • deps: update dependencies and require Node.js 22.19+ (b867143)
Redocly/redocly-cli (@​redocly/cli)

v2.53.3

Compare Source

Patch Changes
  • Fixed respect so a same-workflow goto no longer cleared $steps outputs from steps that already ran.
    Previously, this broke $steps expressions in the target step.
  • Updated @​redocly/respect-core to v2.53.3.

v2.53.2

Compare Source

Patch Changes
  • Added start and end line and column positions to each problem location in the --format=json lint output.
  • Updated @​redocly/openapi-core to v2.53.2.

v2.53.1

Compare Source

Patch Changes
  • Added a deprecation warning to the build-docs command about the upcoming switch to Redoc 3.

v2.53.0

Compare Source

Minor Changes
  • Added a disallowDefault option to the operation-2xx-response rule, which requires an explicit 2xx response when enabled.
    There is no change in current behavior.
Patch Changes

v2.52.1

Compare Source

Patch Changes
  • Updated redoc to the 2.5.4 version to fix accessibility problems in the HTML produced by build-docs.
    Added the lang attribute to the default build-docs template.

v2.52.0

Compare Source

Minor Changes
  • Added agent skills for AI coding assistants: redocly-cli for everyday CLI usage, redocly-lint-rules for writing configurable rules and custom plugins.
    Install them with npx skills add https://redocly.com.
  • Added an experimental inspect-node-types command to navigate the Redocly's node type tree of an API description.
    inspect-node-types helps pick the correct subject types for a configurable rule or the correct visitor for a custom plugin.
  • Added a strategy option to the component-name-unique rule, matching the --component-names-strategy option of the bundle command.
  • Added an experimental introspect-mcp command that analyzes a running MCP server and records its tools, prompts, resources, and capabilities.
    introspect-mcp records its findings in the x-mcp extension of an OpenAPI description.
Patch Changes

v2.51.2

Compare Source

Patch Changes
  • Updated fast-uri to the 3.1.7 version to resolve CVE-2026-75931, CVE-2026-75975, CVE-2026-75899, and CVE-2026-76172.
  • Fixed drift and coverage failing to match a path template whose segment mixes literal text with parameters, such as /instances/{worldId}:{instanceId}.
  • Fixed an issue where Redocly config resolution failed when plugins used ESM syntax.
  • Updated @​redocly/openapi-core to v2.51.2.

v2.51.1

Compare Source

Patch Changes
  • Fixed an issue where generate-arazzo produced a malformed remote description URL in sourceDescriptions (https:// collapsed to https:/) when --output-file was provided.
  • Fixed an issue where $faker.string.email() used without options generated addresses at the undefined.com domain.
  • Updated @​redocly/respect-core to v2.51.1.
  • Updated @faker-js/faker to the 10.6.0 version to resolve the high severity advisory GHSA-qxc2-j82w-r537.

v2.51.0

Compare Source

Minor Changes
  • Enhanced the generate-arazzo command to print a ready-to-run respect command after generation, including an --input placeholder for every workflow input.
  • Added --with-ai, --ai-provider, --ai-model, --ai-concurrency, and --max-workflows options to the generate-arazzo command.
    --with-ai uses a local AI CLI (claude, codex, or cursor) and OpenAPI descriptions to redesign the generated one-workflow-per-operation skeleton into multi-step workflows.
    The AI designs at most --max-workflows workflows (default 10), and the generated file is marked as AI-inferred.
    For descriptions that don't fit a single prompt, the AI first selects scenarios from a compact operation index, then it designs each workflow separately.
Patch Changes
  • Fixed an issue where respect and the x-security-scheme-required-values rule incorrectly rejected x-security HTTP schemes written with non-lowercase casing (such as Basic, Bearer, or Digest).
    RFC 7235 scheme names are case-insensitive.
  • Updated @​redocly/openapi-core to v2.51.0.
  • Updated @​redocly/respect-core to v2.51.0.

v2.50.0

Compare Source

Minor Changes
  • Added a new schema assertion for configurable rules.
    The assertion validates a property value against a JSON Schema.
Patch Changes

v2.49.1

Compare Source

Patch Changes
  • Fixed an issue where rule incorrectly reported a duplicate parameter when two or more $refs pointed to the same path item.
  • Updated @​redocly/openapi-core to v2.49.1.

v2.49.0

Compare Source

Minor Changes
  • Added the no-illogical-composition-keywords rule.

    Note: the rule is set to warn in the recommended ruleset and to error in recommended-strict. Existing API descriptions may report new problems.

Patch Changes
  • Fixed an issue where telemetry silently failed to send when npm was not available.
  • Updated @​redocly/openapi-core to v2.49.0.

v2.48.0

Compare Source

Minor Changes
  • Added agent-friendly client generation: python, go, php, and cli generators beside the TypeScript client, each self-documenting with --docs, configurable per generator, and available as source in your own repository through eject-generator.
Patch Changes
  • Fixed an issue where the bundle command didn't resolve $refs inside an AsyncAPI 3 Multi Format Schema Object.
  • Fixed an issue where respect --har-output recorded an empty postData for every request.
    Request bodies are written to the HAR.
    Captures replayed through drift can have their request bodies validated instead of silently passing.
  • Updated @​redocly/client-generator to v0.4.0.
  • Updated @​redocly/openapi-core to v2.48.0.

v2.47.0

Compare Source

Minor Changes
  • Added a Vendor Extensions metric to the stats command that reports how many distinct x- extensions a description file uses and how often each one occurs.
Patch Changes
  • Fixed the stats command reporting wrong parameter count for AsyncAPI descriptions.
  • Updated @​redocly/openapi-core to v2.47.0.

v2.46.2

Compare Source

Patch Changes

v2.46.1

Compare Source

Patch Changes

v2.46.0

Compare Source

Minor Changes
  • Added the spec-ref-siblings rule that reports properties placed next to a $ref which the specification does not allow.
Patch Changes

v2.45.0

Compare Source

Minor Changes
  • Fixed the bundle command losing schema keywords (such as title, properties, or required) written next to a $ref when the referenced schemas started with their own $ref.
Patch Changes

v2.44.2

Compare Source

Patch Changes
  • Changed the severity of the security-defined rule for AsyncAPI 2.x and 3.x in the recommended ruleset from error to warn.
    AsyncAPI descriptions with undefined or unresolved security no longer fail linting by default.
  • Updated @​redocly/openapi-core to v2.44.2.

v2.44.1

Compare Source

Patch Changes
  • Updated undici to the 6.28.0 version.
  • Fixed an issue where the operation-4xx-problem-details-rfc7807 rule incorrectly reported the type and title properties inherited through allOf as missing.
  • Updated @​redocly/openapi-core to v2.44.1.

v2.44.0

Compare Source

Minor Changes
  • Added the no-duplicated-enum-values rule that requires all values in an enum to be unique.
    The rule is enabled at the warn level in the recommended ruleset.

    Note: linting output may include new warnings for API descriptions that contain duplicated enum values.

  • Added the no-unsafe-markdown rule that disallows potentially executable content in description fields.
    The rule is enabled at the warn level in the recommended ruleset.

    Note: linting output may include new warnings for description fields that contain potentially executable content.

Patch Changes

v2.43.3

Compare Source

Patch Changes

v2.43.2

Compare Source

Patch Changes

v2.43.1

Compare Source

Patch Changes

v2.43.0

Compare Source

Patch Changes

v2.42.0

Compare Source

Minor Changes
  • Added an experimental generate-client command that generates a typed, zero-dependency TypeScript client from an OpenAPI description — auth, retries, middleware, typed SSE streaming, pagination, and multipart included — plus optional companion generators for Zod validation, TanStack Query and SWR hooks, MSW mocks, and date transformers.
    See the generate-client command reference and the Use the generated client guide.
Patch Changes

v2.41.2

Compare Source

Patch Changes
  • Updated js-yaml from 5.2.1 to 5.2.2 to resolve a vulnerability in YAML parsing.

  • Added support for the Arazzo spec-compliant workflow reference form $sourceDescriptions.<name>.<workflowId> in dependsOn, step workflowId, and success/failure action workflowId.

    Unresolvable workflow references fail only the affected workflow with a clear error message, and no longer abort the whole run or pass unnoticed.

  • Updated @​redocly/openapi-core to v2.41.2.

  • Updated @​redocly/respect-core to v2.41.2.

v2.41.1

Compare Source

Patch Changes
  • Fixed an issue where the drift command's schema-consistency rule reported false-positive findings for oneOf schemas with a discriminator.
    Payloads are validated only against the branch selected by the discriminator value instead of every oneOf branch.
    Schemas whose discriminator does not meet Ajv's structural requirements keep the previous behavior.
  • Extended the drift command's built-in undocumented-header ignore list with x-amz-, x-amzn- and x-github- prefixes, and the x-hub-signature / x-hub-signature-256 webhook signature headers.

v2.41.0

Compare Source

Minor Changes
  • Added a new built-in rule security-scopes-defined that requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme.
    The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in requireScopes option that requires OAuth2 security requirements to list at least one scope.
Patch Changes
  • Fixed an issue in respect where the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed.
  • Fixed an issue where the cursor AI provider of the generate-spec command sent only the instructions to the model and the operation to refine never reached it.
  • Updated @​redocly/openapi-core to v2.41.0.
  • Updated @​redocly/respect-core to v2.41.0.

v2.40.0

Compare Source

Minor Changes
  • Added an --ignore-headers option to the experimental drift and proxy commands.
    It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing * matches by prefix (for example x-consumer-*).
    Use it to silence headers a gateway or proxy adds that are not part of the API contract.
  • Added an experimental generate-spec command that infers an OpenAPI description from recorded HTTP traffic.
Patch Changes
  • Fixed the drift command's schema-consistency rule reporting false-positive "Undocumented query parameter" findings for deepObject-style query parameters.
    Traffic keys like namespace[id]=...&namespace[name]=... are now matched to the documented namespace parameter, and the reconstructed object is validated against the parameter schema.

  • Fixed an issue where the drift command's schema-consistency rule reported false-positive request findings for exchanges the server rejected with a 4xx client error.
    For example: missing required parameter, missing required body, request-body schema mismatch.
    A 4xx response means the server never accepted the request.
    Validating it against the operation's success-path contract flagged the server's own correct rejection as drift.
    Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.

  • Fixed an issue where the join command silently dropped path-level x-* extensions with non-string values.

  • Updated js-yaml from 4.2.0 to 5.2.1.
    Fixed an issue where strings that look like numbers with underscores (for example '12_34') had quotation marks removed by the bundle command.
    These strings stay quoted in the output.

    Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error.
    Parse errors are reported at the offending token instead of the end of the document.

  • Fixed an issue where the drift command's security-baseline rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: localhost, *.localhost, 127.0.0.0/8, [::1].
    Sandboxed recordings no longer produce transport warnings.

  • Fixed an issue where the bundle command rewrote internal $refs pointing to other $refs.
    The issue caused AsyncAPI 3 operation messages references to point to components instead of channel messages.

  • Updated @​redocly/openapi-core to v2.40.0.

v2.39.0

Compare Source

Minor Changes
  • Added support for AsyncAPI 3.1.0 descriptions.
  • Fixed the struct rule to validate the contents of AsyncAPI protocol-specific bindings.
    Added typed definitions for the sns, sqs, ibmmq, googlepubsub, pulsar and ros2 bindings.
Patch Changes

v2.38.0

Compare Source

Minor Changes
  • Added an experimental drift command that compares recorded HTTP traffic (HAR, Kong, Nginx/Apache JSON, NDJSON) against an OpenAPI description and reports undocumented endpoints, schema mismatches, and security findings.
  • Added an experimental proxy command that captures live HTTP traffic through a reverse proxy into a HAR file and optionally validates it against an OpenAPI description in real time.
Patch Changes

v2.37.0

Compare Source

Minor Changes
  • Added experimental support for linting GraphQL SDL schema files (.graphql / .gql).
Patch Changes
bump-sh/cli (bump-cli)

v2.11.0: (2026-09-14) Dependencies update and allow Arazzo documents v1.1

Compare Source

Workflows are now Generally available 🎉
Upgrades
  • As usual dependency updates are part of the release

Have fun designing APIs ✨

v2.10.1: (2026-06-16) Dependencies update and fixes with Bump.sh workspace API

Compare Source

What's Changed

🆕 Use documentation name and MCP server name in CLI output

  • Improve docName and mcpServerName by @​Polo2 (PR #​828)
    Favor "Your {documentationName}... has received a new deployment" (instead of raw doc_id)

📝 Copywriting

  • Fix tiret on mcp-server deployment endpoint (PR #​824)
  • Redirection developers.bump.sh (PR #​827)

🔧 Dependencies

🐛Bugfix

Full Changelog: bump-sh/cli@v2.10.0...v2.10.1


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@elastic-renovate-prod
elastic-renovate-prod Bot requested a review from a team as a code owner October 2, 2026 12:11
@elastic-renovate-prod elastic-renovate-prod Bot added backport:all-open Backport to all branches that could still receive a release release_note:skip Skip the PR/issue when compiling release notes Team:Core Platform Core services: plugins, logging, config, saved objects, http, ES client, i18n, etc t// labels Oct 2, 2026
@elastic-renovate-prod
elastic-renovate-prod Bot requested a review from a team October 2, 2026 12:11
@infra-vault-gh-plugin-prod

Copy link
Copy Markdown
Contributor

Pinging @elastic/kibana-core (Team:Core)

@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/main-openapi-spec branch from c3ec5fc to 52a583a Compare October 2, 2026 12:19
@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/main-openapi-spec branch from 52a583a to be68c54 Compare October 4, 2026 22:14
@afharo

afharo commented Oct 5, 2026

Copy link
Copy Markdown
Member

run renovate helper

@afharo
afharo enabled auto-merge October 5, 2026 11:58
@elastic-renovate-prod

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@afharo
afharo disabled auto-merge October 5, 2026 13:49
Redocly 2.53 parses these schemas with js-yaml 5, which rejects a multiline flow collection whose closing bracket is not indented past its parent key.

Co-authored-by: Cursor <cursoragent@cursor.com>
@afharo
afharo requested a review from a team as a code owner October 5, 2026 14:43
@elastic-vault-github-plugin-prod
elastic-vault-github-plugin-prod Bot requested a review from a team as a code owner October 5, 2026 15:12
@kibanamachine

Copy link
Copy Markdown
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Unknown metric groups

warm start memory

id before after diff
post forced gc heap baseline - 851536336 +851536336
post forced gc heap delta - -2271520 -2271520
post forced gc heap delta standard deviation - 2806264 +2806264
post forced gc heap target - 849264816 +849264816
tail heap delta - -36432967 -36432967
total +1664902929

workflow yaml validation

id before after diff
case_response.yaml (27 steps, 66 vars)/e2e/performComputation 11 12 +1
case_response.yaml (27 steps, 66 vars)/e2e/total 15 16 +1
infosec_demo.yaml (150 steps, 270 vars)/e2e/collectAllVariables 2 3 +1
infosec_demo.yaml (150 steps, 270 vars)/e2e/performComputation 46 49 +3
infosec_demo.yaml (150 steps, 270 vars)/e2e/total 116 123 +7
infosec_demo.yaml (150 steps, 270 vars)/e2e/validateIfConditions 4 5 +1
infosec_demo.yaml (150 steps, 270 vars)/e2e/validateVariables 41 44 +3
infosec_demo.yaml (150 steps, 270 vars)/validateIfConditions 4 5 +1
infosec_demo.yaml (150 steps, 270 vars)/validateVariables (270 vars) 40 41 +1
total +19

Test Failures

  • [job] [logs] Scout Lane #161 - serverless-security_complete / default / local-serverless-security_complete - Osquery live query details - accepts live query creation request (permission check)
  • [job] [logs] Scout Lane #13 - stateful-classic / default / local-stateful-classic - Expandable flyout state sync - should test flyout url sync
  • [job] [logs] Scout Lane #40 - stateful-classic / default / local-stateful-classic - Graph - Venn diagram on edge click - displays link summary for the clicked edge
  • [job] [logs] Scout Lane #40 - stateful-classic / default / local-stateful-classic - Graph - workspace CRUD - build, save, open, replace, and delete a workspace
  • [job] [logs] Jest Tests #3 / ResponseActions labels the copy action for the user prompt when copyTarget is prompt
  • [job] [logs] Jest Tests #3 / ToolCallGroup expands to show each individual step, which opens its own flyout on click

History

@infra-vault-gh-plugin-prod

Copy link
Copy Markdown
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
kbnUiSharedDeps-srcJs 5.4MB 5.4MB +1.0B
Unknown metric groups

warm start memory

id before after diff
post forced gc heap baseline - 665889006 +665889006
post forced gc heap delta - -2531576 -2531576
post forced gc heap delta standard deviation - 2967883 +2967883
post forced gc heap target - 663357430 +663357430
tail heap delta - 12535793 +12535793
total +1342218536

workflow yaml validation

id before after diff
case_response.yaml (27 steps, 66 vars)/e2e/collectAllVariables 1 0 -1
infosec_demo.yaml (150 steps, 270 vars)/e2e/performComputation 49 48 -1
infosec_demo.yaml (150 steps, 270 vars)/e2e/total 117 115 -2
infosec_demo.yaml (150 steps, 270 vars)/validateIfConditions 5 4 -1
infosec_demo.yaml (150 steps, 270 vars)/validateVariables (270 vars) 38 36 -2
total -7

Test Failures

  • [job] [logs] FTR Configs #56 / Endpoint plugin @ess @serverless @skipInServerlessMKI Endpoint artifacts (via lists plugin): Trusted Applications "before all" hook in "@ess @serverless @skipInServerlessMKI Endpoint artifacts (via lists plugin): Trusted Applications"
  • [job] [logs] FTR Configs #24 / Entity analytics - Entity details @ess @serverless @skipInServerlessMKI Entity Details - Highlights API "before all" hook for "should return highlights for entity"
  • [job] [logs] Scout Lane #97 - serverless-observability_complete / default / local-serverless-observability_complete - Serverless Observability Navigation - Complete tier body - navigates between apps without a full page reload (SPA) and restores via logo

History

@afharo
afharo enabled auto-merge October 29, 2026 14:35
@afharo
afharo added this pull request to the merge queue Oct 30, 2026
Merged via the queue into main with commit 5b076ee Oct 30, 2026
28 checks passed
@afharo
afharo deleted the renovate/main-openapi-spec branch October 30, 2026 17:29
@kibanamachine

Copy link
Copy Markdown
Contributor

Starting backport for target branches: 8.19, 9.4, 9.5, 9.6

https://github.com/elastic/kibana/actions/runs/41099320172

@kibanamachine

Copy link
Copy Markdown
Contributor

💔 All backports failed

Status Branch Result
❌ 8.19 Backport failed because of merge conflicts
❌ 9.4 [Network] Forbidden
❌ 9.5 Backport failed because of merge conflicts
❌ 9.6 [Network] Forbidden

Manual backport

To create the backport manually run:

node scripts/backport --pr 295063

Questions ?

Please refer to the Backport tool documentation

@kibanamachine

Copy link
Copy Markdown
Contributor

Backport failed. Please check the action logs for details.

https://github.com/elastic/kibana/actions/runs/41099320172

@afharo afharo removed the backport:all-open Backport to all branches that could still receive a release label Oct 31, 2026
@kibanamachine kibanamachine added the backport:skip This PR does not require backporting label Oct 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Core Platform Core services: plugins, logging, config, saved objects, http, ES client, i18n, etc t// v9.7.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants