[dependabot]

Bumps the validation-npm group in /validation with 2 updates: @redocly/cli and js-yaml.

Updates @redocly/cli from 2.62.1 to 2.64.1

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.64.1

Patch Changes

• Fixed an issue where the respect command altered string values in runtime expressions that contained a dot followed by a digit. For example, a token read through $response.body#/token or a quoted value in success criteria.
• Fixed an issue where lint and bundle crashed with Unknown type name found: string on OpenAPI 3.2 descriptions that had a deviceAuthorization OAuth flow with non-empty scopes.
• Updated @​redocly/openapi-core to v2.64.1.
• Updated @​redocly/respect-core to v2.64.1.

@​redocly/cli@​2.64.0

Minor Changes

• Added the onSettled middleware hook to the generated TypeScript client. Added the client.telemetry option to the generate-client command.

Patch Changes

• Updated @​redocly/client-generator to v0.7.0.
• Updated @​redocly/openapi-core to v2.64.0.
• Updated @​redocly/reunite-integration to v2.64.0.

@​redocly/cli@​2.63.0

Minor Changes

• Added the body-link pagination style to the generate-client command. Generated clients use it to follow the next page URL from a field in the response, set with the nextLink option.

  The tanstack-query generator also creates infinite query options for these operations.

Patch Changes

• Fixed request timeouts in the generated TypeScript client for older browsers that don't support AbortSignal.timeout() or AbortSignal.any(). Timed-out requests correctly throw TimeoutError instead of AbortError in Chrome 103–123.
• Fixed an issue where the generated Go client sent duplicate query parameters when it followed a next page link.
• Updated @​redocly/client-generator to v0.6.0.

@​redocly/cli@​2.62.2

Patch Changes

• Fixed an issue where the login and push did not exit after a request through a proxy timed out.
• Fixed an issue where the login, push, and other Reunite commands failed on Node.js 26. Updated undici to the 7.30.0 version.
• Updated handlebars to 4.7.10 to resolve CVE-2026-106444, CVE-2026-106445, and CVE-2026-106446.
• Fixed an issue where the respect command ignored the --mtls certificates when a request went through a proxy.
• Updated @​redocly/reunite-integration to v2.62.2.

Commits

• c7cdd4a chore: 🔖 release new versions (#3257)
• 0fb4d97 chore: make each client generator example tsconfig self-contained (#3259)
• 309834a chore: move client generator examples to packages/client-generator/examples (...
• 3cf1c10 fix(respect): keep string values intact when evaluating respect runtime expre...
• a8b940b fix(core): accept non-empty scopes in OpenAPI 3.2 deviceAuthorization flow (#...
• 7f05baf chore: 🔖 release new versions (#3251)
• b633d7b fix: failin release pipeline (#3253)
• e6af2b0 chore: update redocly/config to v0.66.0 (#3252)
• 4e6f421 feat: add opt-in usage telemetry to generated TypeScript clients (#3247)
• b6415bf chore: update changelog for v1 (#3248)
• Additional commits viewable in compare view

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions