Skip to content

[9.2] Update OpenAPI Spec (main) (#230113)#244332

Merged
afharo merged 3 commits intoelastic:9.2from
afharo:backport/9.2/pr-230113
Nov 26, 2025
Merged

[9.2] Update OpenAPI Spec (main) (#230113)#244332
afharo merged 3 commits intoelastic:9.2from
afharo:backport/9.2/pr-230113

Conversation

@afharo
Copy link
Copy Markdown
Member

@afharo afharo commented Nov 26, 2025

Manually created PR from backport of https://github.com/afharo/kibana/pull/230113 (the script failed when creating the PR due to sorenlouv/backport#521)


This PR contains the following updates:

Package Type Update Change Pending
@apidevtools/swagger-parser (source) devDependencies minor ^12.0.0 -> ^12.1.0
@redocly/cli devDependencies major ^1.34.5 -> ^2.11.0 2.11.1
@redocly/cli dependencies major ^1.34.5 -> ^2.11.0 2.11.1

Release Notes

APIDevTools/swagger-parser (@​apidevtools/swagger-parser)

v12.1.0

Compare
Source

Features
Redocly/redocly-cli (@​redocly/cli)

v2.11.0

Compare
Source

Patch Changes

v2.10.0

Compare
Source

Patch Changes

v2.9.0

Compare
Source

Patch Changes
  • Fixed an issue where the mount-path option was not validated, leading to errors when used with an empty path or a path identical to the project path.
  • Updated @​redocly/openapi-core to v2.9.0.

v2.8.0

Compare
Source

Minor Changes
  • Added the no-invalid-schema-examples and no-invalid-parameter-examples to the recommended ruleset.
    Added the no-duplicated-tag-names to the spec ruleset.
  • Added configuration of Respect mTLS certificates on a per-domain basis.
Patch Changes

v2.7.1

Compare
Source

Patch Changes

v2.7.0

Compare
Source

Patch Changes

v2.6.0

Compare
Source

Minor Changes
  • Added new rules for validating OpenAPI 3.2 description files: spec-no-invalid-tag-parents, spec-example-values, spec-discriminator-defaultMapping, and
    spec-no-invalid-encoding-combinations.
    Deprecated the no-example-value-and-externalValue rule in favor of spec-example-values.
Patch Changes

v2.5.1

Compare
Source

Patch Changes
  • Fixed an issue where the no-http-verbs-in-paths rule was incorrectly flagging path names containing the verb query.
  • Updated @​redocly/openapi-core to v2.5.1.

v2.5.0

Compare
Source

Minor Changes
  • Added response size to the Respect terminal and JSON file outputs.
Patch Changes

v2.4.0

Compare
Source

Minor Changes
  • Added the no-secrets-masking option to the respect command, allowing raw (unmasked) output to be generated.
Patch Changes

v2.3.1

Compare
Source

Patch Changes
  • Fixed an issue where JSONPath-based success criteria did not support property names with hyphens in Respect.
  • Updated @​redocly/openapi-core to v2.3.1.

v2.3.0

Compare
Source

Minor Changes
  • Added basic support for OpenAPI 3.2 specification.
Patch Changes

v2.2.3

Compare
Source

Patch Changes
  • Fixed an issue where the Respect workflow separator did not render correctly in GitHub CI environments.
  • Added support for the verbose option in the login command to provide additional output during authentication.
  • Updated @​redocly/respect-core to v2.2.3.

v2.2.2

Compare
Source

Patch Changes
  • Resolved an issue with CLI dependencies to ensure proper package resolution.
  • Updated @​redocly/openapi-core to v2.2.2.

v2.2.1

Compare
Source

Patch Changes
  • Fixed an issue where the remove-unused-components decorator was not functioning when configured at the API level.
  • Updated @​redocly/openapi-core to v2.2.1.

v2.2.0

Compare
Source

Minor Changes
  • Adjusted the calculation of Respect's workflow-level totalTimeMs to sum the network request times of all steps.
Patch Changes

v2.1.5

Compare
Source

Patch Changes
  • Improved the message format for Respect's status code check.
  • Fixed handling of input parameters when invoking step target workflows
    in Respect.
  • Updated
    @​redocly/respect-core
    to v2.1.5.

v2.1.4

Compare
Source

Patch Changes
  • Fixed undefined variable used in the remove-unused-components decorator, which prevented an invalid reference error from being reported.
  • Updated @​redocly/openapi-core to v2.1.4.

v2.1.3

Compare
Source

Patch Changes
  • Updated authentication logic to get the residency from scorecard.fromProjectUrl.
  • Updated @​redocly/openapi-core to v2.1.3.

v2.1.2

Compare
Source

Patch Changes

v2.1.1

Compare
Source

Patch Changes

v2.1.0

Compare
Source

Minor Changes
  • Updated authentication logic to ensure consistency with the VS Code extension's behavior.
Patch Changes
  • Improved error reporting and handling for Digest authentication failures in Respect. Now users receive clearer feedback when required headers or status codes are missing.
  • Fixed push and push-status commands mistakenly requiring the --max-execution-time option.
  • Fixed an issue where wildcard file patterns were not recognized in the Docker image.
  • Updated @​redocly/respect-core to v2.1.0.

v2.0.8

Compare
Source

Patch Changes

v2.0.7

Compare
Source

Patch Changes

v2.0.6

Compare
Source

Patch Changes
  • Fixed an issue where files specified in decorators parameters were not always resolved correctly.
    The resolution logic now properly locates the specified files relative to the config file for info-description-override, media-type-examples-override, operation-description-override, and tag-description-override decorators.
  • Improved messaging to clarify when API alias configuration is implicitly applied during linting or bundling by filename.
  • Updated the retryAfter property in Respect to use seconds (instead of milliseconds) for consistency with the Arazzo specification.
  • Updated @​redocly/openapi-core to v2.0.6.

v2.0.5

Compare
Source

Patch Changes
  • Fixed an issue where the root config was not properly merged with the apis config.
  • Resolved an issue that caused configuration parsing to fail when the config value was set to null.
  • Improved join command server handling for specifications with differing servers.
  • Updated @​redocly/respect-core to v2.0.5.

v2.0.4

Compare
Source

Patch Changes
  • Fixed an issue where the openapi config options were ignored when running the build-docs command.
  • Ensure externalRefResolver option is correctly passed to nested workflow contexts.
  • Updated @​redocly/respect-core to v2.0.4.

v2.0.3

Compare
Source

Patch Changes
  • Fixed type definitions for Respect input and server options to support both string and string[] values.
  • Fixed binary response data in Respect results by properly encoding it as base64.
  • Updated @​redocly/respect-core to v2.0.3.

v2.0.2

Compare
Source

Patch Changes
  • Made executionTimeout parameter optional in the run function exported from respect-core.
  • Updated @​redocly/respect-core to v2.0.2.

v2.0.1

Compare
Source

Patch Changes
  • Fixed an issue where the no-required-schema-properties-undefined rule incorrectly resolved nested $refs relative to the file in which they were defined.
  • Fixed an issue where multipart form-data parameters were not properly resolved and evaluated before sending requests.
  • Updated @​redocly/openapi-core to v2.0.1.

v2.0.0

Compare
Source

Major Changes
  • Removed backward compatibility for the spec rule. Use struct instead.
  • Removed support for the deprecated apiDefinitions option in the Redocly config. Use apis instead.
    Removed the labels field within the apis section, which was associated with the legacy Redocly API Registry product.
  • Removed support for default config file names other than redocly.yaml.
  • Removed support for the deprecated features.openapi and features.mockServer configuration options. Use openapi and mockServer directly instead.
  • Removed backward compatibility for the deprecated lint and styleguide options in the Redocly config.
    Use rules, decorators and other related options on the root level instead.
  • Removed the deprecated disallowAdditionalProperties option support in rules. Use allowAdditionalProperties instead.
  • Removed support for the deprecated theme property of Redocly config. All the properties of theme are now available in the config root.
  • Removed the deprecated path-excludes-patterns and info-license-url rules.
  • Removed the deprecated undefined assertion. Use defined instead.
  • Removed support for the legacy Redocly API Registry in favor of the
    new Reunite platform.
    Reunite provides improved API management capabilities and better
    integration with Redocly's tooling ecosystem.
    Migrated the login and push commands to work exclusively with
    Reunite.
    Removed the preview-docs command as part of platform modernization.
    Use the preview command instead.
  • Removed support for the deprecated referenceDocs option, which was
    related to the legacy Reference docs product.
  • Removed support for the deprecated assert/ prefix in configurable
    rules. Use rule/ prefix instead.
  • Migrated the codebase to ES Modules from CommonJS, bringing improved
    code organization and better support for modern JavaScript features.
    Update to Node.js version 20.19.0+, 22.12.0+, or 23+.
Minor Changes
  • Added x-security extension for Respect that enables secure handling of authentication in Arazzo workflows.
    Use this extension to:

  • Define security schemes at the step level using either predefined schemes or inline definitions

    • Pass values of secrets (passwords, tokens, API keys)
  • Support multiple authentication types including API Key (query,
    header, or cookie), Basic Authentication, Bearer Token, Digest
    Authentication, OAuth2, and OpenID Connect

  • Automatically transform security parameters into appropriate HTTP
    headers or query parameters

  • Added environment variable support for CLI arguments using Yargs .env() method to parse environment variables with matching prefixes.

  • Added validation for JSON Schema format.

  • Extracted nullable validation from the struct rule into a new nullable-type-sibling rule for OpenAPI 3.0. This allows users to disable nullable validation separately from other structural checks.

  • Configured the spec ruleset for OpenAPI, AsyncAPI, Arazzo, and Overlay specifications.
    This ruleset is designed to strictly follow the specifications.

  • Added the no-duplicated-tag-names rule to check for duplications in the tags field in API descriptions.

  • Enabled no-required-schema-properties-undefined, no-schema-type-mismatch, and no-enum-type-mismatch rules for AsyncAPI and Arazzo specifications.
    Adjusted the rules' severities in the recommended and minimal rulesets. Refer to the following table:

Rule \ Ruleset recommended minimal
no-required-schema-properties-undefined off -> warn off -> warn
no-enum-type-mismatch error warn
no-schema-type-mismatch warn -> error off -> warn
  • Implemented automatic masking of sensitive fields (such as tokens and passwords) in response bodies to enhance security and prevent accidental exposure of secrets in logs and outputs.

  • Added new CLI options for the respect command to improve test execution control.

Patch Changes
  • Fixed plugins validation in config files referenced in the extends section.
  • Fixed no-undefined-server-variable crash when encountering null values in the server list.
  • Refactored @redocly/respect-core to eliminate Node.js-specific dependencies, improving cross-platform compatibility.
  • Updated Redoc to v2.5.0.
  • Fixed alias detection when using --config from a different folder
    than the current working directory.
  • Resolved an issue where dotenv@16.6.0 injected an unintended message
    into the output.
  • Fixed Redocly CLI to correctly read residency from the Redocly
    configuration file.
  • Improved Respect's error handling when server URLs are missing from
    both OpenAPI descriptions and CLI options.
  • Updated
    @​redocly/respect-core
    to v2.0.0.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config
help
if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate
Bot
.


This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [@apidevtools/swagger-parser](https://apidevtools.com/swagger-parser/)
([source](https://redirect.github.com/APIDevTools/swagger-parser)) |
devDependencies | minor | [`^12.0.0` ->
`^12.1.0`](https://renovatebot.com/diffs/npm/@apidevtools%2fswagger-parser/12.0.0/12.1.0)
| |
| [@redocly/cli](https://redirect.github.com/Redocly/redocly-cli) |
devDependencies | major | [`^1.34.5` ->
`^2.11.0`](https://renovatebot.com/diffs/npm/@redocly%2fcli/1.34.5/2.11.0)
| `2.11.1` |
| [@redocly/cli](https://redirect.github.com/Redocly/redocly-cli) |
dependencies | major | [`^1.34.5` ->
`^2.11.0`](https://renovatebot.com/diffs/npm/@redocly%2fcli/1.34.5/2.11.0)
| `2.11.1` |

---

### Release Notes

<details>
<summary>APIDevTools/swagger-parser
(@&elastic#8203;apidevtools/swagger-parser)</summary>

###
[`v12.1.0`](https://redirect.github.com/APIDevTools/swagger-parser/releases/tag/v12.1.0)

[Compare
Source](https://redirect.github.com/APIDevTools/swagger-parser/compare/v12.0.0...v12.1.0)

##### Features

- Add support for version 3.1.2
([#&elastic#8203;279](https://redirect.github.com/APIDevTools/swagger-parser/issues/279))
([8dcd391](https://redirect.github.com/APIDevTools/swagger-parser/commit/8dcd391feea7c7dd694bb20b8706fcb53f736ba5))

</details>

<details>
<summary>Redocly/redocly-cli (@&elastic#8203;redocly/cli)</summary>

###
[`v2.11.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.11.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.10.0...@redocly/cli@2.11.0)

##### Patch Changes

- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.11.0.

###
[`v2.10.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.10.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.9.0...@redocly/cli@2.10.0)

##### Patch Changes

- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.10.0.

###
[`v2.9.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.9.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.8.0...@redocly/cli@2.9.0)

##### Patch Changes

- Fixed an issue where the `mount-path` option was not validated,
leading to errors when used with an empty path or a path identical to
the project path.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.9.0.

###
[`v2.8.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.8.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.7.1...@redocly/cli@2.8.0)

##### Minor Changes

- Added the `no-invalid-schema-examples` and
`no-invalid-parameter-examples` to the `recommended` ruleset.
    Added the `no-duplicated-tag-names` to the `spec` ruleset.
- Added configuration of Respect mTLS certificates on a per-domain
basis.

##### Patch Changes

- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.8.0.

###
[`v2.7.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.7.1)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.7.0...@redocly/cli@2.7.1)

##### Patch Changes

-   Applied proxy settings during Respect execution.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.7.1.

###
[`v2.7.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.7.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.6.0...@redocly/cli@2.7.0)

##### Patch Changes

- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.7.0.

###
[`v2.6.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.6.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.5.1...@redocly/cli@2.6.0)

##### Minor Changes

- Added new rules for validating OpenAPI 3.2 description files:
`spec-no-invalid-tag-parents`, `spec-example-values`,
`spec-discriminator-defaultMapping`, and
`spec-no-invalid-encoding-combinations`.
Deprecated the `no-example-value-and-externalValue` rule in favor of
`spec-example-values`.

##### Patch Changes

- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.6.0.

###
[`v2.5.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.5.1)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.5.0...@redocly/cli@2.5.1)

##### Patch Changes

- Fixed an issue where the `no-http-verbs-in-paths` rule was incorrectly
flagging path names containing the verb `query`.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.5.1.

###
[`v2.5.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.5.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.4.0...@redocly/cli@2.5.0)

##### Minor Changes

-   Added response size to the `Respect` terminal and JSON file outputs.

##### Patch Changes

- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.5.0.

###
[`v2.4.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.4.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.3.1...@redocly/cli@2.4.0)

##### Minor Changes

- Added the `no-secrets-masking` option to the respect command, allowing
raw (unmasked) output to be generated.

##### Patch Changes

- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.4.0.

###
[`v2.3.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.3.1)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.3.0...@redocly/cli@2.3.1)

##### Patch Changes

- Fixed an issue where JSONPath-based success criteria did not support
property names with hyphens in `Respect`.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.3.1.

###
[`v2.3.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.3.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.2.3...@redocly/cli@2.3.0)

##### Minor Changes

-   Added basic support for **OpenAPI 3.2** specification.

##### Patch Changes

- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.3.0.

###
[`v2.2.3`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.2.3)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.2.2...@redocly/cli@2.2.3)

##### Patch Changes

- Fixed an issue where the Respect workflow separator did not render
correctly in GitHub CI environments.
- Added support for the `verbose` option in the `login` command to
provide additional output during authentication.
- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.2.3.

###
[`v2.2.2`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.2.2)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.2.1...@redocly/cli@2.2.2)

##### Patch Changes

- Resolved an issue with CLI dependencies to ensure proper package
resolution.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.2.2.

###
[`v2.2.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.2.1)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.2.0...@redocly/cli@2.2.1)

##### Patch Changes

- Fixed an issue where the `remove-unused-components` decorator was not
functioning when configured at the API level.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.2.1.

###
[`v2.2.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.2.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.1.5...@redocly/cli@2.2.0)

##### Minor Changes

- Adjusted the calculation of Respect's workflow-level `totalTimeMs` to
sum the network request times of all steps.

##### Patch Changes

- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.2.0.

###
[`v2.1.5`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.1.5)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.1.4...@redocly/cli@2.1.5)

##### Patch Changes

-   Improved the message format for Respect's `status code check`.
- Fixed handling of input parameters when invoking step target workflows
in Respect.
- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.1.5.

###
[`v2.1.4`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.1.4)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.1.3...@redocly/cli@2.1.4)

##### Patch Changes

- Fixed undefined variable used in the `remove-unused-components`
decorator, which prevented an invalid reference error from being
reported.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.1.4.

###
[`v2.1.3`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.1.3)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.1.2...@redocly/cli@2.1.3)

##### Patch Changes

- Updated authentication logic to get the residency from
`scorecard.fromProjectUrl`.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.1.3.

###
[`v2.1.2`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.1.2)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.1.1...@redocly/cli@2.1.2)

##### Patch Changes

- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.1.2.

###
[`v2.1.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.1.1)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.1.0...@redocly/cli@2.1.1)

##### Patch Changes

- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.1.1.

###
[`v2.1.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.1.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.0.8...@redocly/cli@2.1.0)

##### Minor Changes

- Updated authentication logic to ensure consistency with the VS Code
extension's behavior.

##### Patch Changes

- Improved error reporting and handling for Digest authentication
failures in Respect. Now users receive clearer feedback when required
headers or status codes are missing.
- Fixed `push` and `push-status` commands mistakenly requiring the
`--max-execution-time` option.
- Fixed an issue where wildcard file patterns were not recognized in the
Docker image.
- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.1.0.

###
[`v2.0.8`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.0.8)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.0.7...@redocly/cli@2.0.8)

##### Patch Changes

- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.0.8.

###
[`v2.0.7`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.0.7)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.0.6...@redocly/cli@2.0.7)

##### Patch Changes

-   Improved Respect verbose logs to display response headers.
- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.0.7.

###
[`v2.0.6`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.0.6)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.0.5...@redocly/cli@2.0.6)

##### Patch Changes

- Fixed an issue where files specified in decorators parameters were not
always resolved correctly.
The resolution logic now properly locates the specified files relative
to the config file for `info-description-override`,
`media-type-examples-override`, `operation-description-override`, and
`tag-description-override` decorators.
- Improved messaging to clarify when API alias configuration is
implicitly applied during linting or bundling by filename.
- Updated the `retryAfter` property in Respect to use seconds (instead
of milliseconds) for consistency with the Arazzo specification.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.0.6.

###
[`v2.0.5`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.0.5)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.0.4...@redocly/cli@2.0.5)

##### Patch Changes

- Fixed an issue where the root config was not properly merged with the
`apis` config.
- Resolved an issue that caused configuration parsing to fail when the
config value was set to `null`.
- Improved join command server handling for specifications with
differing servers.
- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.0.5.

###
[`v2.0.4`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.0.4)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.0.3...@redocly/cli@2.0.4)

##### Patch Changes

- Fixed an issue where the `openapi` config options were ignored when
running the `build-docs` command.
- Ensure `externalRefResolver` option is correctly passed to nested
workflow contexts.
- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.0.4.

###
[`v2.0.3`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.0.3)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.0.2...@redocly/cli@2.0.3)

##### Patch Changes

- Fixed type definitions for Respect `input` and `server` options to
support both string and string\[] values.
- Fixed binary response data in `Respect` results by properly encoding
it as base64.
- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.0.3.

###
[`v2.0.2`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.0.2)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.0.1...@redocly/cli@2.0.2)

##### Patch Changes

- Made `executionTimeout` parameter optional in the `run` function
exported from `respect-core`.
- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.0.2.

###
[`v2.0.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.0.1)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@2.0.0...@redocly/cli@2.0.1)

##### Patch Changes

- Fixed an issue where the `no-required-schema-properties-undefined`
rule incorrectly resolved nested `$ref`s relative to the file in which
they were defined.
- Fixed an issue where multipart form-data parameters were not properly
resolved and evaluated before sending requests.
- Updated
[@&elastic#8203;redocly/openapi-core](https://redirect.github.com/redocly/openapi-core)
to v2.0.1.

###
[`v2.0.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.0.0)

[Compare
Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/cli@1.34.5...@redocly/cli@2.0.0)

##### Major Changes

- Removed backward compatibility for the `spec` rule. Use `struct`
instead.
- Removed support for the deprecated `apiDefinitions` option in the
Redocly config. Use `apis` instead.
Removed the `labels` field within the `apis` section, which was
associated with the legacy Redocly API Registry product.
- Removed support for default config file names other than
`redocly.yaml`.
- Removed support for the deprecated `features.openapi` and
`features.mockServer` configuration options. Use `openapi` and
`mockServer` directly instead.
- Removed backward compatibility for the deprecated `lint` and
`styleguide` options in the Redocly config.
Use `rules`, `decorators` and other related options on the root level
instead.
- Removed the deprecated `disallowAdditionalProperties` option support
in rules. Use `allowAdditionalProperties` instead.
- Removed support for the deprecated `theme` property of Redocly config.
    All the properties of `theme` are now available in the config root.
- Removed the deprecated `path-excludes-patterns` and `info-license-url`
rules.
-   Removed the deprecated `undefined` assertion. Use `defined` instead.
- Removed support for the legacy Redocly API Registry in favor of the
new Reunite platform.
Reunite provides improved API management capabilities and better
integration with Redocly's tooling ecosystem.
Migrated the `login` and `push` commands to work exclusively with
Reunite.
Removed the `preview-docs` command as part of platform modernization.
    Use the `preview` command instead.
- Removed support for the deprecated `referenceDocs` option, which was
related to the legacy Reference docs product.
- Removed support for the deprecated `assert/` prefix in configurable
rules. Use `rule/` prefix instead.
- Migrated the codebase to ES Modules from CommonJS, bringing improved
code organization and better support for modern JavaScript features.
    Update to Node.js version 20.19.0+, 22.12.0+, or 23+.

##### Minor Changes

- Added `x-security` extension for Respect that enables secure handling
of authentication in Arazzo workflows.
    Use this extension to:

- Define security schemes at the step level using either predefined
schemes or inline definitions
    -   Pass values of secrets (passwords, tokens, API keys)
- Support multiple authentication types including API Key (query,
header, or cookie), Basic Authentication, Bearer Token, Digest
Authentication, OAuth2, and OpenID Connect
- Automatically transform security parameters into appropriate HTTP
headers or query parameters

- Added environment variable support for CLI arguments using Yargs
`.env()` method to parse environment variables with matching prefixes.

-   Added validation for JSON Schema format.

- Extracted `nullable` validation from the `struct` rule into a new
`nullable-type-sibling` rule for OpenAPI 3.0. This allows users to
disable `nullable` validation separately from other structural checks.

- Configured the `spec` ruleset for OpenAPI, AsyncAPI, Arazzo, and
Overlay specifications.
    This ruleset is designed to strictly follow the specifications.

- Added the `no-duplicated-tag-names` rule to check for duplications in
the `tags` field in API descriptions.

- Enabled `no-required-schema-properties-undefined`,
`no-schema-type-mismatch`, and `no-enum-type-mismatch` rules for
**AsyncAPI** and **Arazzo** specifications.
Adjusted the rules' severities in the `recommended` and `minimal`
rulesets. Refer to the following table:

| Rule \ Ruleset | recommended | minimal |
| --------------------------------------- | ----------------- |
--------------- |
| no-required-schema-properties-undefined | `off` -> `warn` | `off` ->
`warn` |
| no-enum-type-mismatch | `error` | `warn` |
| no-schema-type-mismatch | `warn` -> `error` | `off` -> `warn` |

- Implemented automatic masking of sensitive fields (such as tokens and
passwords) in response bodies to enhance security and prevent accidental
exposure of secrets in logs and outputs.

- Added new CLI options for the `respect` command to improve test
execution control.

##### Patch Changes

- Fixed plugins validation in config files referenced in the `extends`
section.
- Fixed `no-undefined-server-variable` crash when encountering `null`
values in the server list.
- Refactored `@redocly/respect-core` to eliminate Node.js-specific
dependencies, improving cross-platform compatibility.
-   Updated Redoc to v2.5.0.
- Fixed alias detection when using `--config` from a different folder
than the current working directory.
- Resolved an issue where `dotenv@16.6.0` injected an unintended message
into the output.
- Fixed Redocly CLI to correctly read `residency` from the Redocly
configuration file.
- Improved Respect's error handling when server URLs are missing from
both OpenAPI descriptions and CLI options.
- Updated
[@&elastic#8203;redocly/respect-core](https://redirect.github.com/redocly/respect-core)
to v2.0.0.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xMDcuMCIsInVwZGF0ZWRJblZlciI6IjM5LjEwNy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJUZWFtOkNvcmUiLCJyZWxlYXNlX25vdGU6c2tpcCJdfQ==-->

---------

Co-authored-by: elastic-renovate-prod[bot] <174716857+elastic-renovate-prod[bot]@users.noreply.github.com>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit 9833d79)

# Conflicts:
#	oas_docs/output/kibana.serverless.yaml
#	oas_docs/output/kibana.yaml
#	package.json
@afharo afharo self-assigned this Nov 26, 2025
@afharo afharo added the backport This PR is a backport of another PR label Nov 26, 2025
@afharo afharo changed the title Update OpenAPI Spec (main) (#230113) [9.2] Update OpenAPI Spec (main) (#230113) Nov 26, 2025
@afharo afharo enabled auto-merge (squash) November 26, 2025 15:15
Copy link
Copy Markdown
Contributor

@azasypkin azasypkin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with green CI, thanks!

@afharo afharo merged commit c820d90 into elastic:9.2 Nov 26, 2025
12 checks passed
@afharo afharo deleted the backport/9.2/pr-230113 branch November 26, 2025 19:04
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

cc @afharo

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants