build(deps): Bump @redocly/cli from 2.39.0 to 2.40.0 in the minor-updates group

[dependabot]

Bumps the minor-updates group with 1 update: @redocly/cli.

Updates @redocly/cli from 2.39.0 to 2.40.0

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.40.0

Minor Changes

• Added an --ignore-headers option to the experimental drift and proxy commands. It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing * matches by prefix (for example x-consumer-*). Use it to silence headers a gateway or proxy adds that are not part of the API contract.
• Added an experimental generate-spec command that infers an OpenAPI description from recorded HTTP traffic.

Patch Changes

• Fixed the drift command's schema-consistency rule reporting false-positive "Undocumented query parameter" findings for deepObject-style query parameters. Traffic keys like namespace[id]=...&namespace[name]=... are now matched to the documented namespace parameter, and the reconstructed object is validated against the parameter schema.

• Fixed an issue where the drift command's schema-consistency rule reported false-positive request findings for exchanges the server rejected with a 4xx client error. For example: missing required parameter, missing required body, request-body schema mismatch. A 4xx response means the server never accepted the request. Validating it against the operation's success-path contract flagged the server's own correct rejection as drift. Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.

• Fixed an issue where the join command silently dropped path-level x-* extensions with non-string values.

• Updated js-yaml from 4.2.0 to 5.2.1. Fixed an issue where strings that look like numbers with underscores (for example '12_34') had quotation marks removed by the bundle command. These strings stay quoted in the output.

  Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. Parse errors are reported at the offending token instead of the end of the document.

• Fixed an issue where the drift command's security-baseline rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: localhost, *.localhost, 127.0.0.0/8, [::1]. Sandboxed recordings no longer produce transport warnings.

• Fixed an issue where the bundle command rewrote internal $refs pointing to other $refs. The issue caused AsyncAPI 3 operation messages references to point to components instead of channel messages.

• Updated @​redocly/openapi-core to v2.40.0.

Commits

• 8678a3a chore: 🔖 release new versions (#2950)
• ee4f14d chore(deps): bump redocly/config version to v0.52.0 (#2952)
• ae86ec8 fix: migrate to js-yaml v5 (#2908)
• b2a31a0 feat: add generate-spec command (#2937)
• 7082ede fix(cli): fix join dropping non-string x-* path extension properties (#2949)
• 8bf7234 fix: do not collapse internal $ref chains when bundling (#2953)
• 5c531c9 chore: drift command adjustments (#2947)
• 697c52f chore: add linting for dataValue in example (#2945)
• 1817eaf chore: update analytics data format (#2946)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions