[dependabot]

Bumps the validation-npm group in /validation with 2 updates: @redocly/cli and js-yaml.

Updates @redocly/cli from 2.57.0 to 2.62.1

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.62.1

Patch Changes

• Fixed the project clone command so that Git keeps finding its credential helper after a clone run with npx or pnpm dlx.

@​redocly/cli@​2.62.0

Minor Changes

• Added support for in: querystring parameters to the experimental drift command. The command validates the whole query string against the parameter's schema, instead of reporting every query key as undocumented. In --coverage, each key of a form-urlencoded querystring schema counts as a separate parameter.
• Added the early access project clone command to work with a Redocly-hosted Reunite project as a Git repository.

Patch Changes

• Fixed the schema-consistency rule of the drift command so that a required readOnly property in a parameter schema is no longer reported as missing from the request.
• Updated @​redocly/reunite-integration to v2.62.0.

@​redocly/cli@​2.61.0

Minor Changes

• Added pass-through stream request bodies to the generated TypeScript, Python, Go, and PHP clients. A stream body is sent as is in one attempt, and the caller's Content-Type wins over the one in the API description.

Patch Changes

• Added a deprecation warning for Node.js 20.x. Update to Node.js 22.12.0 or higher.
• Updated @modelcontextprotocol/sdk to 1.32.1 to resolve GHSA-6qxp-vccf-f47h.
• Updated @​redocly/client-generator to v0.5.0.
• Updated @​redocly/openapi-core to v2.61.0.
• Updated @​redocly/reunite-integration to v2.61.0.

@​redocly/cli@​2.60.0

Minor Changes

• Added the --file-name-conflicts-severity option for the split command to control how file name conflicts are reported.

Patch Changes

• Fixed an issue where split lost content when two components, paths, webhooks, channels, operations, or code samples got the same file name.

  Warning: split output may differ from older releases: when several names would share one file, each later file now gets a -n suffix, where n is its order, for example user-2.yaml next to User.yaml.

@​redocly/cli@​2.59.0

Minor Changes

• Improved redocly recheck to lint the description fields of API descriptions. Findings report the source line and column. You can suppress the findings by file, rule, and pointer, or adjust rules for descriptions only.

... (truncated)

Commits

• 5daf0a4 chore: 🔖 release new versions (#3229)
• 6a74418 fix: keep the credential helper of project clone working after npx exits (#...
• fdffe75 chore: 🔖 release new versions (#3225)
• 78fae8a feat(drift): support querystring parameters in the schema-consistency rule (#...
• 6e90032 feat: add the project clone command for Redocly-hosted projects (#3174)
• 3c0793b chore: 🔖 release new versions (#3216)
• f31823a chore: stamp the ejected example with the released client-generator version (...
• 1435754 feat(client-generator): pass stream request bodies through in the generated c...
• 25dcdf2 feat(cli): warn that Node.js 20 support is deprecated (#3215)
• 68d6650 chore: update @​modelcontextprotocol/sdk and lint-staged to resolve audit advi...
• Additional commits viewable in compare view

Updates js-yaml from 5.4.2 to 5.4.3

Changelog

Sourced from js-yaml's changelog.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

Commits

• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Kevsy]

LGTM

[hdamker]

Checked that the Redocly bump does not change bundling output.

• Bundled every API definition with external $ref on the current main of the CAMARA API repositories (69 specs) with 2.57.0 and 2.62.1, invoked as the snapshot step does (redocly bundle <spec> -o <out> from the repo root): all 69 outputs byte-identical.
• Same with --component-renaming-conflicts-severity=error (the bundler collision check): identical output and exit codes, identical stderr after normalizing timings/paths.
• TestComponentRenamingConflictIntegration passes against both versions, so the conflict message shape is unchanged.

The split naming change in 2.60.0 does not affect us; only bundle is used.