npm · #3910

@redocly/openapi-core

2.48.0Redocly/redocly-cli ↗

See https://github.com/Redocly/redocly-cli

Last release today
26 Aug 2026
Ships on a steady schedule
a new release about every 9 days
Nearly every release is documented
notes for 60 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
6 years old
728 releases · first in 2020

Release timeline

728 releases since 2020

202120222023202420252026

Releases

2.48.026 Aug 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.48.0.
Open source →
Additional notes
Patch Changes
- Fixed an issue where the bundle command didn't resolve $refs inside an AsyncAPI 3 Multi Format Schema Object.
Open source →
Additional notes
Minor Changes
- Added agent-friendly client generation: python, go, php, and cli generators beside the TypeScript client, each self-documenting with --docs, configurable per generator, and available as source in your own repository through eject-generator.
Patch Changes
- Fixed an issue where the bundle command didn't resolve $refs inside an AsyncAPI 3 Multi Format Schema Object.
- Fixed an issue where respect --har-output recorded an empty postData for every request.
  Request bodies are written to the HAR.
  Captures replayed through drift can have their request bodies validated instead of silently passing.
- Updated @redocly/client-generator to v0.4.0.
- Updated @redocly/openapi-core to v2.48.0.
Open source →
2.47.021 Aug 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.47.0.
Open source →
Additional notes
Minor Changes
- Added a Vendor Extensions metric to the stats command that reports how many distinct x- extensions a description file uses and how often each one occurs.
Patch Changes
- Fixed the stats command reporting wrong parameter count for AsyncAPI descriptions.
Open source →
Additional notes
Minor Changes
- Added a Vendor Extensions metric to the stats command that reports how many distinct x- extensions a description file uses and how often each one occurs.
Patch Changes
- Fixed the stats command reporting wrong parameter count for AsyncAPI descriptions.
- Updated @redocly/openapi-core to v2.47.0.
Open source →
2.46.219 Aug 2026
Release notes2 sources agree
Patch Changes
- Updated @redocly/openapi-core to v2.46.2.
Open source →
Additional notes
Patch Changes
- Improved the error message raised when a configurable rule is missing the assertions block.
- Fixed an issue where the no-duplicated-enum-values rule didn't report duplicated enum values that are objects or arrays.
  
  Fixed an issue where the no-duplicated-enum-values rule printed [object Object] when reporting duplicate values.
Open source →
2.46.111 Aug 2026
Release notes
Patch Changes
- Updated @redocly/ajv to ^8.18.3.
- Updated @redocly/openapi-core to v2.46.1.
- Updated @redocly/respect-core to v2.46.1.
Open source →
Additional notes
Patch Changes
- Updated @redocly/ajv to ^8.18.3.
- Updated @redocly/openapi-core to v2.46.1.
Open source →
Additional notes
Patch Changes
- Updated @redocly/ajv to ^8.18.3.
Open source →
2.46.07 Aug 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.46.0.
Open source →
Additional notes
Minor Changes
- Added the spec-ref-siblings rule that reports properties placed next to a $ref which the specification does not allow.
Open source →
Additional notes
Minor Changes
- Added the spec-ref-siblings rule that reports properties placed next to a $ref which the specification does not allow.
Patch Changes
- Updated @redocly/openapi-core to v2.46.0.
Open source →
2.45.06 Aug 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.45.0.
Open source →
Additional notes
Minor Changes
- Fixed the bundle command losing schema keywords (such as title, properties, or required) written next to a $ref when the referenced schemas started with their own $ref.
Open source →
Additional notes
Minor Changes
- Fixed the bundle command losing schema keywords (such as title, properties, or required) written next to a $ref when the referenced schemas started with their own $ref.
Patch Changes
- Updated @redocly/openapi-core to v2.45.0.
Open source →
2.44.25 Aug 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.44.2.
Open source →
Additional notes
Patch Changes
- Changed the severity of the security-defined rule for AsyncAPI 2.x and 3.x in the recommended ruleset from error to warn. AsyncAPI descriptions with undefined or unresolved security no longer fail linting by default.
Open source →
Additional notes
Patch Changes
- Changed the severity of the security-defined rule for AsyncAPI 2.x and 3.x in the recommended ruleset from error to warn. AsyncAPI descriptions with undefined or unresolved security no longer fail linting by default.
- Updated @redocly/openapi-core to v2.44.2.
Open source →
2.44.14 Aug 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.44.1.
Open source →
Additional notes
Patch Changes
- Fixed an issue where the operation-4xx-problem-details-rfc7807 rule incorrectly reported the type and title properties inherited through allOf as missing.
Open source →
Additional notes
Patch Changes
- Updated undici to the 6.28.0 version.
- Fixed an issue where the operation-4xx-problem-details-rfc7807 rule incorrectly reported the type and title properties inherited through allOf as missing.
- Updated @redocly/openapi-core to v2.44.1.
Open source →
2.44.04 Aug 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.44.0.
Open source →
Additional notes
Minor Changes
- Added the no-duplicated-enum-values rule that requires all values in an enum to be unique. The rule is enabled at the warn level in the recommended ruleset.
  
  Note: linting output may include new warnings for API descriptions that contain duplicated enum values.
- Added the no-unsafe-markdown rule that disallows potentially executable content in description fields. The rule is enabled at the warn level in the recommended ruleset.
  
  Note: linting output may include new warnings for description fields that contain potentially executable content.
- Added security-defined rule for AsyncAPI 2.x and 3.x.
  
  Warning: this rule is enabled at error severity in the recommended ruleset, so AsyncAPI documents that previously linted clean may now fail. The rule flags security $refs that target an undefined scheme or a path outside components.securitySchemes, and operations that declare no security of their own when the applicable servers don't supply one either.
Open source →
Additional notes
Minor Changes
- Added the no-duplicated-enum-values rule that requires all values in an enum to be unique. The rule is enabled at the warn level in the recommended ruleset.
  
  Note: linting output may include new warnings for API descriptions that contain duplicated enum values.
- Added the no-unsafe-markdown rule that disallows potentially executable content in description fields. The rule is enabled at the warn level in the recommended ruleset.
  
  Note: linting output may include new warnings for description fields that contain potentially executable content.
Patch Changes
- Updated @redocly/client-generator to v0.3.0.
- Updated @redocly/openapi-core to v2.44.0.
Open source →
2.43.33 Aug 2026
Release notes
Patch Changes
- Fixed an issue where secrets masking did not cover encoded secrets in har-output.
- Updated @redocly/openapi-core to v2.43.3.
Open source →
Additional notes
Patch Changes
- Updated @redocly/respect-core to v2.43.3.
Open source →
2.43.231 Jul 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.43.2.
Open source →
Additional notes
Patch Changes
- Updated @redocly/config to v0.53.1.
Open source →
Additional notes
Patch Changes
- Updated @redocly/client-generator to v0.2.0.
- Updated @redocly/openapi-core to v2.43.2.
Open source →
2.43.130 Jul 2026
Release notes2 sources agree
Patch Changes
- Updated @redocly/openapi-core to v2.43.1.
Open source →
Additional notes
Patch Changes
- Fixed skipPluginEval to keep extends unresolved instead of failing when the config extends a plugin preset.
Open source →
2.43.030 Jul 2026
Release notes2 sources agree
Patch Changes
- Updated @redocly/openapi-core to v2.43.0.
Open source →
Additional notes
Minor Changes
- Added a skipPluginEval option to loadConfig that resolves plugin paths without importing or executing plugin code — the returned plugins contain only their absolutePath.
Open source →
2.42.030 Jul 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.42.0.
Open source →
Additional notes
Minor Changes
- Added an experimental generate-client command that generates a typed, zero-dependency TypeScript client from an OpenAPI description — auth, retries, middleware, typed SSE streaming, pagination, and multipart included — plus optional companion generators for Zod validation, TanStack Query and SWR hooks, MSW mocks, and date transformers. See the generate-client command reference and the Use the generated client guide.
Patch Changes
- Updated @redocly/config to v0.53.0.
Open source →
Additional notes
Minor Changes
- Added an experimental generate-client command that generates a typed, zero-dependency TypeScript client from an OpenAPI description — auth, retries, middleware, typed SSE streaming, pagination, and multipart included — plus optional companion generators for Zod validation, TanStack Query and SWR hooks, MSW mocks, and date transformers. See the generate-client command reference and the Use the generated client guide.
Patch Changes
- Updated @redocly/client-generator to v0.1.0.
- Updated @redocly/openapi-core to v2.42.0.
Open source →
2.41.229 Jul 2026
Release notes
Patch Changes
- Added support for the Arazzo spec-compliant workflow reference form $sourceDescriptions.<name>.<workflowId> in dependsOn, step workflowId, and success/failure action workflowId.
  
  Unresolvable workflow references fail only the affected workflow with a clear error message, and no longer abort the whole run or pass unnoticed.
- Updated @redocly/openapi-core to v2.41.2.
Open source →
Additional notes
Patch Changes
- Updated js-yaml from 5.2.1 to 5.2.2 to resolve a vulnerability in YAML parsing.
Open source →
Additional notes
Patch Changes
- Updated js-yaml from 5.2.1 to 5.2.2 to resolve a vulnerability in YAML parsing.
- Added support for the Arazzo spec-compliant workflow reference form $sourceDescriptions.<name>.<workflowId> in dependsOn, step workflowId, and success/failure action workflowId.
  
  Unresolvable workflow references fail only the affected workflow with a clear error message, and no longer abort the whole run or pass unnoticed.
- Updated @redocly/openapi-core to v2.41.2.
- Updated @redocly/respect-core to v2.41.2.
Open source →
2.41.128 Jul 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.41.1.
Open source →
Additional notes
Patch Changes
- Fixed an issue where the drift command's schema-consistency rule reported false-positive findings for oneOf schemas with a discriminator. Payloads are validated only against the branch selected by the discriminator value instead of every oneOf branch. Schemas whose discriminator does not meet Ajv's structural requirements keep the previous behavior.
- Extended the drift command's built-in undocumented-header ignore list with x-amz-, x-amzn- and x-github- prefixes, and the x-hub-signature / x-hub-signature-256 webhook signature headers.
Open source →
2.41.027 Jul 2026
Release notes
Patch Changes
- Fixed an issue in respect where the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed.
- Updated @redocly/openapi-core to v2.41.0.
Open source →
Additional notes
Minor Changes
- Added a new built-in rule security-scopes-defined that requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme. The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in requireScopes option that requires OAuth2 security requirements to list at least one scope.
Open source →
Additional notes
Minor Changes
- Added a new built-in rule security-scopes-defined that requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme. The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in requireScopes option that requires OAuth2 security requirements to list at least one scope.
Patch Changes
- Fixed an issue in respect where the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed.
- Fixed an issue where the cursor AI provider of the generate-spec command sent only the instructions to the model and the operation to refine never reached it.
- Updated @redocly/openapi-core to v2.41.0.
- Updated @redocly/respect-core to v2.41.0.
Open source →
2.40.021 Jul 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.40.0.
Open source →
Additional notes
Minor Changes
- Added linting for the OpenAPI 3.2 Example Object dataValue field.
Patch Changes
- Updated @redocly/config to v0.52.0.
- Updated js-yaml from 4.2.0 to 5.2.1. Fixed an issue where strings that look like numbers with underscores (for example '12_34') had quotation marks removed by the bundle command. These strings stay quoted in the output.
  
  Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. Parse errors are reported at the offending token instead of the end of the document.
- Fixed an issue where the bundle command rewrote internal $refs pointing to other $refs. The issue caused AsyncAPI 3 operation messages references to point to components instead of channel messages.
Open source →
Additional notes
Minor Changes
- Added an --ignore-headers option to the experimental drift and proxy commands. It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing * matches by prefix (for example x-consumer-*). Use it to silence headers a gateway or proxy adds that are not part of the API contract.
- Added an experimental generate-spec command that infers an OpenAPI description from recorded HTTP traffic.
Patch Changes
- Fixed the drift command's schema-consistency rule reporting false-positive "Undocumented query parameter" findings for deepObject-style query parameters. Traffic keys like namespace[id]=...&namespace[name]=... are now matched to the documented namespace parameter, and the reconstructed object is validated against the parameter schema.
- Fixed an issue where the drift command's schema-consistency rule reported false-positive request findings for exchanges the server rejected with a 4xx client error. For example: missing required parameter, missing required body, request-body schema mismatch. A 4xx response means the server never accepted the request. Validating it against the operation's success-path contract flagged the server's own correct rejection as drift. Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.
- Fixed an issue where the join command silently dropped path-level x-* extensions with non-string values.
- Updated js-yaml from 4.2.0 to 5.2.1. Fixed an issue where strings that look like numbers with underscores (for example '12_34') had quotation marks removed by the bundle command. These strings stay quoted in the output.
  
  Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. Parse errors are reported at the offending token instead of the end of the document.
- Fixed an issue where the drift command's security-baseline rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: localhost, *.localhost, 127.0.0.0/8, [::1]. Sandboxed recordings no longer produce transport warnings.
- Fixed an issue where the bundle command rewrote internal $refs pointing to other $refs. The issue caused AsyncAPI 3 operation messages references to point to components instead of channel messages.
- Updated @redocly/openapi-core to v2.40.0.
Open source →
2.39.013 Jul 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.39.0.
Open source →
Additional notes
Minor Changes
- Added support for AsyncAPI 3.1.0 descriptions.
- Fixed the struct rule to validate the contents of AsyncAPI protocol-specific bindings. Added typed definitions for the sns, sqs, ibmmq, googlepubsub, pulsar and ros2 bindings.
Patch Changes
- Updated @redocly/config to v0.51.0.
Open source →
Additional notes
Minor Changes
- Added support for AsyncAPI 3.1.0 descriptions.
- Fixed the struct rule to validate the contents of AsyncAPI protocol-specific bindings. Added typed definitions for the sns, sqs, ibmmq, googlepubsub, pulsar and ros2 bindings.
Patch Changes
- Updated @redocly/openapi-core to v2.39.0.
Open source →
2.38.08 Jul 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.38.0.
Open source →
Additional notes
Patch Changes
- Updated @redocly/config to v0.50.1.
Open source →
Additional notes
Minor Changes
- Added an experimental drift command that compares recorded HTTP traffic (HAR, Kong, Nginx/Apache JSON, NDJSON) against an OpenAPI description and reports undocumented endpoints, schema mismatches, and security findings.
- Added an experimental proxy command that captures live HTTP traffic through a reverse proxy into a HAR file and optionally validates it against an OpenAPI description in real time.
Patch Changes
- Updated @redocly/openapi-core to v2.38.0.
Open source →
2.37.03 Jul 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.37.0.
Open source →
Additional notes
Minor Changes
- Added experimental support for linting GraphQL SDL schema files (.graphql / .gql).
Patch Changes
- Updated @redocly/config to v0.50.0.
Open source →
Additional notes
Minor Changes
- Added experimental support for linting GraphQL SDL schema files (.graphql / .gql).
Patch Changes
- Updated @redocly/openapi-core to v2.37.0.
Open source →
2.36.030 Jun 2026
Release notes
Patch Changes
- Updated @redocly/config to v0.49.1.
Open source →
Additional notes
Minor Changes
- Added a Subresource Integrity (SRI) hash to the Redoc standalone script tag in the HTML produced by build-docs, ensuring the script's integrity.
Open source →
Additional notes
Patch Changes
- Updated @redocly/openapi-core to v2.36.0.
Open source →
2.35.125 Jun 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.35.1.
Open source →
Additional notes
Patch Changes
- Updated undici to the 6.27.0 version.
Open source →
2.35.025 Jun 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.35.0.
Open source →
Additional notes2 sources agree
Minor Changes
- Added support for validating Arazzo 1.1.0 descriptions syntax in the lint command.
- Added the spec-step-mutually-exclusive-fields Arazzo rule to flag steps that use more than one mutually exclusive operation field (operationId, operationPath, workflowId, channelPath, or x-operation).
Open source →
2.34.017 Jun 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.34.0.
Open source →
Additional notes
Minor Changes
- Improved CLI install speed by bundling the CLI into a dependency-free package.
  
  Warning: The published package no longer ships runtime dependencies in node_modules. Plugins that relied on importing packages hoisted from the CLI (such as @redocly/openapi-core) must now declare those packages as their own dependencies.
Open source →
2.33.216 Jun 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.33.2.
Open source →
Additional notes
Patch Changes
- Fixed a path traversal in the split command that might have written files outside the chosen --outDir.
- Updated @redocly/openapi-core to v2.33.2.
Open source →
2.33.116 Jun 2026
Release notes2 sources agree
Patch Changes
- Updated @redocly/openapi-core to v2.33.1.
Open source →
Additional notes
Patch Changes
- Improved AsyncAPI 3 types.
- Updated js-yaml from 4.1.1 to 4.2.0.
Open source →
2.33.016 Jun 2026
Release notes
Patch Changes
- Fixed a remote code execution vulnerability where a crafted $faker expression in an Arazzo description could execute arbitrary JavaScript during Redocly Respect runs. Reported by Hamza Haroon (GitHub: @thegr1ffyn).
- Updated @redocly/openapi-core to v2.33.0.
Open source →
Additional notes
Minor Changes
- Added the --component-names-strategy option to the bundle command. This option allows a choice of how inline Schema components are named: basename (default) or title (from each schema's title field).
Open source →
Additional notes
Minor Changes
- Added the --component-names-strategy option to the bundle command. This option allows a choice of how inline Schema components are named: basename (default) or title (from each schema's title field).
Patch Changes
- Updated @redocly/openapi-core to v2.33.0.
Open source →
2.32.211 Jun 2026
Release notes
Patch Changes
- Fixed respect schema checks to honor readOnly and writeOnly based on context.
  
  Warning: writeOnly properties in responses are reported as errors.
- Updated @redocly/openapi-core to v2.32.2.
Open source →
Additional notes
Patch Changes
- Updated @redocly/respect-core to v2.32.2.
Open source →
2.32.111 Jun 2026
Release notes2 sources agree
Patch Changes
- Updated @redocly/openapi-core to v2.32.1.
Open source →
Additional notes
Patch Changes
- Fixed spurious "can't resolve reference" warnings when linting multiple APIs concurrently.
Open source →
2.32.09 Jun 2026
Release notes
Minor Changes
- Added support for junit output in the lint command.
Open source →
Additional notes
Minor Changes
- Added support for junit output in the lint command.
Patch Changes
- Updated @redocly/openapi-core to v2.32.0.
Open source →
Additional notes
Patch Changes
- Updated @redocly/openapi-core to v2.32.0.
Open source →
2.31.63 Jun 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.31.6.
Open source →
Additional notes
Patch Changes
- Fixed lint --format=checkstyle to produce a single combined XML document when multiple APIs are passed to the command, instead of concatenated per-file documents.
- Updated redoc to v2.5.3, styled-components to v6.4.2, and react to v19.2.7.
- Updated @redocly/openapi-core to v2.31.6.
Open source →
2.31.527 May 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.31.5.
Open source →
Additional notes
Patch Changes
- Updated the no-unused-components rule to validate unused security schemes.
- Fixed the remove-unused-components decorator to remove unused security schemes.
  
  Warning: The bundler may now remove more unused components than before.
Open source →
Additional notes
Patch Changes
- Updated the no-unused-components rule to validate unused security schemes.
- Pinned the official Docker image base to node:24-alpine.
- Fixed the remove-unused-components decorator to remove unused security schemes.
  
  Warning: The bundler may now remove more unused components than before.
- Updated @redocly/openapi-core to v2.31.5.
Open source →
2.31.422 May 2026
Release notes
Patch Changes
- Fixed an issue where running respect on multiple Arazzo files in a single invocation could surface false-positive struct lint errors.
- Updated @redocly/openapi-core to v2.31.4.
Open source →
Additional notes
Patch Changes
- Updated @redocly/config to v0.49.0.
Open source →
Additional notes
Patch Changes
- Updated @redocly/openapi-core to v2.31.4.
Open source →
2.31.321 May 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.31.3.
Open source →
Additional notes
Patch Changes
- Fixed an issue where the Respect command did not honor the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables when loading remote source descriptions or resolving external $refs. Proxy settings are consistently applied during reference resolution as well.
- Updated @redocly/openapi-core to v2.31.3.
Open source →
2.31.219 May 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.31.2.
Open source →
Additional notes
Patch Changes
- Fixed the remove-unused-components decorator to remove unused components containing allOf keyword.
  
  Warning: The bundler may now remove more unused components than before.
- Fixed the no-unused-components rule to highlight unused schemas containing allOf keyword.
Open source →
Additional notes
Patch Changes
- Fixed the remove-unused-components decorator to remove unused components containing allOf keyword.
  
  Warning: The bundler may now remove more unused components than before.
- Fixed the no-unused-components rule to highlight unused schemas containing allOf keyword.
- Updated @redocly/openapi-core to v2.31.2.
Open source →
2.31.118 May 2026
Release notes2 sources agree
Patch Changes
- Updated @redocly/openapi-core to v2.31.1.
Open source →
Additional notes
Patch Changes
- Updated @redocly/config to v0.48.2.
Open source →
2.31.018 May 2026
Release notes2 sources agree
Patch Changes
- Updated @redocly/openapi-core to v2.31.0.
Open source →
Additional notes
Minor Changes
- Added support for clearing the plugins cache.
Open source →
2.30.614 May 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.30.6.
Open source →
Additional notes
Patch Changes
- Fixed hard crash that happened when no API was provided either via the command argument or in the config.
- Updated @redocly/openapi-core to v2.30.6.
Open source →
2.30.512 May 2026
Release notes
Patch Changes
- Fixed an issue where query-language strings (JSONPath, XPath, SPARQL, OPA) in Respect request bodies were incorrectly treated as runtime expressions.
- Updated @redocly/openapi-core to v2.30.5.
Open source →
Additional notes
Patch Changes
- Fixed an issue where using environment variables in redocly.yaml caused a config validation error during the build.
Open source →
Additional notes
Patch Changes
- Fixed a status code mismatch that occurred when using the --har-output option in the respect command.
- Updated @redocly/openapi-core to v2.30.5.
Open source →
2.30.47 May 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.30.4.
Open source →
Additional notes
Patch Changes
- Added contains assertion to check that all listed strings are present in an array property.
Open source →
Additional notes
Patch Changes
- Updated styled-components dependency to 6.4.1.
- Updated @redocly/openapi-core to v2.30.4.
Open source →
2.30.329 Apr 2026
Release notes
Patch Changes
- Updated better-ajv-errors to v2.0.3.
- Updated @redocly/ajv to v8.18.1
- Updated @redocly/openapi-core to v2.30.3.
Open source →
Additional notes
Patch Changes
- Updated @redocly/ajv to v8.18.1
Open source →
Additional notes
Patch Changes
- Updated @redocly/ajv to v8.18.1
- Updated @redocly/respect-core to v2.30.3.
Open source →
2.30.229 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.30.2.
Open source →
Additional notes
Patch Changes
- Improved Redocly config validation: now the config checks for typos in built-in decorator names.
Open source →
Additional notes
Patch Changes
- Improved Redocly config validation: now the config checks for typos in built-in decorator names.
- Updated @redocly/openapi-core to v2.30.2.
Open source →
2.30.127 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.30.1.
Open source →
Additional notes
Patch Changes
- Increased the default fetch timeout used by the push command to better support slower uploads.
- Updated @redocly/openapi-core to v2.30.1.
Open source →
2.30.024 Apr 2026
Release notes2 sources agree
Patch Changes
- Updated @redocly/openapi-core to v2.30.0.
Open source →
Additional notes
Minor Changes
- Added a reference property to context.report() so that custom rules can link to external documentation. When set, the URL is rendered beneath the message in both stylish and github-actions output formats. Configurable rules also accept a top-level reference field.
Open source →
2.29.223 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.29.2.
Open source →
Additional notes
Patch Changes
- Updated @redocly/config to v0.48.1.
Open source →
Additional notes
Patch Changes
- Resolved GHSA-xq3m-2v4x-88gg vulnerabilitiy by updating dependency versions.
- Updated @redocly/openapi-core to v2.29.2.
Open source →
2.29.122 Apr 2026
Release notes
Patch Changes
- Made Respect's JSONPath criteria compliant with RFC 9535.
- Updated @redocly/openapi-core to v2.29.1.
Open source →
Additional notes
Patch Changes
- Fixed an issue where discriminator's mapping values written as bare local file names were not resolved during build.
Open source →
Additional notes
Patch Changes
- Fixed an issue where discriminator's mapping values written as bare local file names were not resolved during build.
- Updated @redocly/openapi-core to v2.29.1.
Open source →
2.29.020 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.29.0.
Open source →
Additional notes
Minor Changes
- Added new score command that analyzes OpenAPI 3.x descriptions and produces an AI Agent Readiness score (0-100). Reports normalized subscores, raw per-operation metrics, and top hotspot operations with human-readable explanations. Supports --format=stylish (default) and --format=json output.
Patch Changes
- Improved the stability of the push command.
- Updated @redocly/openapi-core to v2.29.0.
Open source →
2.28.117 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.28.1.
Open source →
Additional notes
Patch Changes
- Ordered top-level keys in AsyncAPI documents during bundling for improved consistency and readability.
- Updated @redocly/openapi-core to v2.28.1.
Open source →
2.28.015 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.28.0.
Open source →
Additional notes
Minor Changes
- Moved the remove-unused-components decorator to the post-bundle phase so that components that become unused only after $ref resolution are correctly removed.
Patch Changes
- Fixed an issue where the discriminator's defaultMapping property was not resolved when bundling.
Open source →
Additional notes
Minor Changes
- Moved the remove-unused-components decorator to the post-bundle phase so that components that become unused only after $ref resolution are correctly removed.
Patch Changes
- Fixed an issue where the discriminator's defaultMapping property was not resolved when bundling.
- Updated @redocly/openapi-core to v2.28.0.
Open source →
2.27.114 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.27.1.
Open source →
Additional notes
Patch Changes
- Fixed an issue where --component-renaming-conflicts-severity ignored conflicts when different files had components with the same name but different content.
  
  Warning: Autogenrated component names and $ref paths in bundled documents may differ from older releases.
Open source →
Additional notes
Patch Changes
- Fixed an issue where --component-renaming-conflicts-severity ignored conflicts when different files had components with the same name but different content.
  
  Warning: Autogenrated component names and $ref paths in bundled documents may differ from older releases.
- Updated @redocly/openapi-core to v2.27.1.
Open source →
2.27.014 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.27.0.
Open source →
Additional notes
Patch Changes
- Updated @redocly/config to v0.48.0.
Open source →
Additional notes
Minor Changes
- Added support for junit output in the scorecard-classic command.
- Changed lint behavior with the --generate-ignore-file option. Now lint updates only the entries related to the file being linted. Other files' entries are unchanged.
Patch Changes
- Updated @redocly/openapi-core to v2.27.0.
Open source →
2.26.08 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.26.0.
Open source →
Additional notes
Minor Changes
- Added excludedPaths option to the no-http-verbs-in-paths rule, allowing specific paths to be excluded from evaluation.
Patch Changes
- Fixed the no-required-schema-properties-undefined rule to report when a required property is not defined in every oneOf/anyOf branch.
- Updated @redocly/config to v0.46.1.
Open source →
Additional notes
Minor Changes
- Added support for AsyncAPI v2 and v3 in the split command.
- Added excludedPaths option to the no-http-verbs-in-paths rule, allowing specific paths to be excluded from evaluation.
Patch Changes
- Fixed the no-required-schema-properties-undefined rule to report when a required property is not defined in every oneOf/anyOf branch.
- Updated @redocly/openapi-core to v2.26.0.
Open source →
2.25.42 Apr 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.25.4.
Open source →
Additional notes
Patch Changes
- Updated @redocly/config to v0.46.0.
Open source →
Additional notes
Patch Changes
- Updated handlebars to v4.7.9.
- Updated @redocly/openapi-core to v2.25.4.
Open source →
2.25.330 Mar 2026
Release notes
Patch Changes
- Handled content type wildcards in response validation to improve Respect's accuracy when matching described content types.
- Updated @redocly/openapi-core to v2.25.3.
Open source →
Additional notes
Patch Changes
- Fixed multiple issues in the spec-discriminator-defaultMapping rule that could cause crashes or incorrect validation results. The rule now correctly resolves existing schema names, traverses composite schemas (allOf, anyOf, oneOf) to find required properties, treats defaultMapping values as $refs to schemas, resolves $refs correctly across files, and handles cyclic schema dependencies.
Open source →
Additional notes
Patch Changes
- Fixed multiple issues in the spec-discriminator-defaultMapping rule that could cause crashes or incorrect validation results. The rule now correctly resolves existing schema names, traverses composite schemas (allOf, anyOf, oneOf) to find required properties, treats defaultMapping values as $refs to schemas, resolves $refs correctly across files, and handles cyclic schema dependencies.
- Updated @redocly/respect-core to v2.25.3.
Open source →
2.25.227 Mar 2026
Release notes2 sources agree
Patch Changes
- Updated picomatch dependency to ^4.0.4.
- Updated @redocly/openapi-core to v2.25.2.
Open source →
Additional notes
Patch Changes
- Updated @redocly/config to v0.45.0.
- Fixed a crash when a non-string value (for example, a number) was used in an extends array in redocly.yaml inside scorecard/scorecardClassic. Fixed a crash when reference could not be resolved in extends.
- Improved error message when a plugin is not detected.
- Updated picomatch dependency to ^4.0.4.
Open source →
2.25.124 Mar 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.25.1.
Open source →
Additional notes
Patch Changes
- Fixed an issue where a message about a missing configuration was shown even though the --extends option was provided.
- Updated @redocly/openapi-core to v2.25.1.
Open source →
2.25.024 Mar 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.25.0.
Open source →
Additional notes
Minor Changes
- Added no-mixed-number-range-constraints rule for OpenAPI 3.1+, as well as for AsyncAPI and Arazzo. This rule warns when schemas use both maximum and exclusiveMaximum or both minimum and exclusiveMinimum keywords.
Patch Changes
- Updated @redocly/config to v0.44.2.
- Fixed an issue where invalid discriminator mapping values could cause linting to fail.
Open source →
Additional notes
Minor Changes
- Added no-mixed-number-range-constraints rule for OpenAPI 3.1+, as well as for AsyncAPI and Arazzo. This rule warns when schemas use both maximum and exclusiveMaximum or both minimum and exclusiveMinimum keywords.
Patch Changes
- Fixed an issue where invalid discriminator mapping values could cause linting to fail.
- Resolved high severity audit vulnerabilities by updating dependency versions.
- Updated @redocly/openapi-core to v2.25.0.
Open source →
2.24.120 Mar 2026
Release notes
Patch Changes
- Updated @redocly/openapi-core to v2.24.1.
Open source →
Additional notes
Patch Changes
- Downgraded undici to resolve an issue where formData was being submitted empty.
- Updated @redocly/openapi-core to v2.24.1.
Open source →
2.24.018 Mar 2026
Release notes
Minor Changes
- Added x-allowReserved extension for Respect. This extension enables the use of unencoded reserved characters in query parameter values in Arazzo workflows.
Patch Changes
- Updated @redocly/openapi-core to v2.24.0.
Open source →
Additional notes
Minor Changes
- Added x-allowReserved extension for Respect. This extension enables the use of unencoded reserved characters in query parameter values in Arazzo workflows.
Open source →
Additional notes
Patch Changes
- Updated @redocly/openapi-core to v2.24.0.
Open source →

@redocly/openapi-core

Release timeline

Releases

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes