Skip to content

fix: do not crash on OAS3.2 description; apply npm audit fix#2834

Open
tatomyr wants to merge 2 commits into
v1from
fix/do-not-crash-on-oas3.2
Open

fix: do not crash on OAS3.2 description; apply npm audit fix#2834
tatomyr wants to merge 2 commits into
v1from
fix/do-not-crash-on-oas3.2

Conversation

@tatomyr
Copy link
Copy Markdown
Collaborator

@tatomyr tatomyr commented May 22, 2026

What/Why/How?

  • Allowed OAS3.2 to be bundled as OAS3.1
  • Applied NPM audit fix

Reference

Testing

Screenshots (optional)

Check yourself

  • This PR follows the contributing guide
  • All new/updated code is covered by tests
  • Core code changed? - Tested with other Redocly products (internal contributions only)
  • New package installed? - Tested in different environments (browser/node)
  • Documentation update has been considered

Security

  • The security impact of the change has been considered
  • Code follows company security practices and guidelines

Note

Medium Risk
Updates spec version detection to accept openapi: 3.2.x as OAS3.1 and bumps multiple transitive dependencies via npm audit fix, which could subtly affect CLI bundling/output and runtime behavior.

Overview
Adds temporary OpenAPI 3.2 support by updating detectSpec in packages/core/src/oas-types.ts to treat openapi: 3.2.* as SpecVersion.OAS3_1 (avoiding unsupported-version crashes).

Applies npm audit fix dependency updates (notably styled-components 6.3.96.4.1 and js-yaml 4.1.04.1.1, plus other lockfile bumps/additions), which changes generated build-docs/smoke HTML output; snapshots and expected output file sizes are updated accordingly.

Adds a Changeset for a @redocly/openapi-core patch release documenting the audit fix.

Reviewed by Cursor Bugbot for commit d8b6273. Bugbot is set up for automated code reviews on this repo. Configure here.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 22, 2026

🦋 Changeset detected

Latest commit: d8b6273

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@redocly/openapi-core Patch
@redocly/cli Patch
@redocly/respect-core Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@tatomyr tatomyr changed the base branch from main to v1 May 22, 2026 12:29
Comment thread packages/cli/package.json
"get-port-please": "3.0.1",
"glob": "7.2.3",
"handlebars": "4.7.9",
"js-yaml": "4.1.1",
Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

npm audit fix added it.

@tatomyr tatomyr marked this pull request as ready for review May 22, 2026 13:49
@tatomyr tatomyr requested review from a team as code owners May 22, 2026 13:49
@tatomyr tatomyr closed this May 22, 2026
@tatomyr tatomyr reopened this May 22, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 22, 2026

Command Mean [ms] Min [ms] Max [ms] Relative
redocly lint packages/core/src/benchmark/benches/rebilly.yaml 931.7 ± 12.7 912.8 952.0 1.02 ± 0.02
redocly-next lint packages/core/src/benchmark/benches/rebilly.yaml 917.0 ± 15.4 894.1 939.3 1.00

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 22, 2026

Coverage report

St.
Category Percentage Covered / Total
🟡 Statements 79.48% 7069/8894
🟡 Branches 68.54% 2948/4301
🟡 Functions 75.18% 1154/1535
🟡 Lines 79.87% 6744/8444

Test suite run success

1344 tests passing in 194 suites.

Report generated by 🧪jest coverage report action from d8b6273

Comment thread .changeset/spicy-cats-clap.md Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants