build(deps-dev): bump @redocly/cli from 2.37.0 to 2.40.0

[dependabot]

Bumps @redocly/cli from 2.37.0 to 2.40.0.

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.40.0

Minor Changes

• Added an --ignore-headers option to the experimental drift and proxy commands. It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing * matches by prefix (for example x-consumer-*). Use it to silence headers a gateway or proxy adds that are not part of the API contract.
• Added an experimental generate-spec command that infers an OpenAPI description from recorded HTTP traffic.

Patch Changes

• Fixed the drift command's schema-consistency rule reporting false-positive "Undocumented query parameter" findings for deepObject-style query parameters. Traffic keys like namespace[id]=...&namespace[name]=... are now matched to the documented namespace parameter, and the reconstructed object is validated against the parameter schema.

• Fixed an issue where the drift command's schema-consistency rule reported false-positive request findings for exchanges the server rejected with a 4xx client error. For example: missing required parameter, missing required body, request-body schema mismatch. A 4xx response means the server never accepted the request. Validating it against the operation's success-path contract flagged the server's own correct rejection as drift. Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.

• Fixed an issue where the join command silently dropped path-level x-* extensions with non-string values.

• Updated js-yaml from 4.2.0 to 5.2.1. Fixed an issue where strings that look like numbers with underscores (for example '12_34') had quotation marks removed by the bundle command. These strings stay quoted in the output.

  Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. Parse errors are reported at the offending token instead of the end of the document.

• Fixed an issue where the drift command's security-baseline rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: localhost, *.localhost, 127.0.0.0/8, [::1]. Sandboxed recordings no longer produce transport warnings.

• Fixed an issue where the bundle command rewrote internal $refs pointing to other $refs. The issue caused AsyncAPI 3 operation messages references to point to components instead of channel messages.

• Updated @​redocly/openapi-core to v2.40.0.

@​redocly/cli@​2.39.0

Minor Changes

• Added support for AsyncAPI 3.1.0 descriptions.
• Fixed the struct rule to validate the contents of AsyncAPI protocol-specific bindings. Added typed definitions for the sns, sqs, ibmmq, googlepubsub, pulsar and ros2 bindings.

Patch Changes

• Updated @​redocly/openapi-core to v2.39.0.

@​redocly/cli@​2.38.0

Minor Changes

... (truncated)

Commits

• 8678a3a chore: 🔖 release new versions (#2950)
• ee4f14d chore(deps): bump redocly/config version to v0.52.0 (#2952)
• ae86ec8 fix: migrate to js-yaml v5 (#2908)
• b2a31a0 feat: add generate-spec command (#2937)
• 7082ede fix(cli): fix join dropping non-string x-* path extension properties (#2949)
• 8bf7234 fix: do not collapse internal $ref chains when bundling (#2953)
• 5c531c9 chore: drift command adjustments (#2947)
• 697c52f chore: add linting for dataValue in example (#2945)
• 1817eaf chore: update analytics data format (#2946)
• f4592cb chore: 🔖 release new versions (#2942)
• Additional commits viewable in compare view

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	github-readme-stats	e934074	Commit Preview URL Branch Preview URL	Jul 22 2026, 12:35 AM

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[dytsou]

@dependabot rebase

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

Superseded by #324.