Changelog

Features

• Improved the pull request code diff in Reunite with syntax highlighting, expandable hidden lines, and a refreshed UI.

Fixes

• Fixed secondary text in Reunite to use consistent styling across light and dark themes.

Fixes

• Updated @redocly/cli and @redocly/openapi-core to version 2.55.0.

Fixes

• Fixed silent webhook setup failures after Git credential updates by showing a warning that names the repository and error when permissions are missing, such as an Azure DevOps token lacking rights to manage service hooks.

Fixes

• Fixed the "Configure SSO and Access" step of the Reunite "Go live" checklist, which stayed incomplete when a project set access.requiresLogin.

Fixes

• Fixed remote content sync and commit status failures for repositories with many remotes.

• Updated the generated CI/CD snippets to use organization and project IDs instead of slugs when addressing the Reunite API.

Features

• Added the requester's email as the reply-to address on AI assistant support escalation emails.

Fixes

• Fixed AI search incorrectly granting access to all visitors when specific RBAC project configurations were used.

• Fixed the AI assistant losing access to project API tools when authentication is required.

Fixes

• Fixed an issue where connecting a Reunite project to GitHub, GitLab, Bitbucket, or Azure DevOps redirected to a 404 page instead of the provider authorization window.

Features

• Added target branch change event to the pull request timeline.

Features

• Added a summary of changed pages to the pull request comment in Reunite, listing added, modified, and removed pages after each preview deploy.

• Added an origin to feedback items to enable filtering by form, API, and MCP server submissions on the Reunite Feedback page.

• Added restore and delete branch events to the pull request timeline.

• Added a warning in the create-organization flow when the entered name matches an organization the user already belongs to or is invited to, helping prevent duplicate organizations.

Fixes

• Fixed AI assistant API to stop model calls when the client connection closes.

Features

• Added a Visual review check setting on the Settings > Git hosting page. When the setting is off, the check in your Git provider is reported as skipped instead of pending.

Fixes

• Fixed the go-live checklist incorrectly showing a connected repository when the organization contained only mounted remote content or deleted projects.

Features

• Added the singleExpanded attribute to the accordion-group Markdoc tag to keep only one accordion open at a time.

• Improved search to index every field, heading, and message.

• Added linkIcon, cta, iconColor, badge, badgeColor, and badgeIcon attributes to the card Markdoc tag to enhance customization options.

• Added recovery hints displayed when Docs MCP lookup failed.

• Added accordion and accordion-group Markdoc tags to organize content into collapsible sections.

• Added a Connect to the MCP server page at /mcp with tabbed setup instructions for Claude, ChatGPT/Codex, and raw JSON configuration. Extended the Connect MCP button with copy options for Claude Code and Codex CLI.

• Improved MCP server code mode to reduce AI agent script failures and provide clearer error messages.

• Improved the credentials page to show all accepted API credentials.

• Added validation to the MCP credentials form.

• Added an opt-in /mcp-public endpoint to serve public content without authentication on RBAC-restricted projects.

• Added Docs MCP server audience validation for bearer tokens. With audience enforcement active, tokens whose aud claims names other organizations are logged, reported, and rejected. Tokens without an aud claim keep working.

• Added an onClose prop to the custom ReplayGate component. The prop closes the Try it overlay when users dismiss the sign-in panel.

• Added idea as a supported type for the admonition Markdoc tag.

• Improved sidebar accessibility: separators are no longer announced as links by screen readers and no longer receive keyboard focus.

• Updated default border radius for components.

• Added translations for the Connect to MCP server and page action dropdown toggle labels.

• Improved the version picker to sort versions from newest to oldest using numeric-aware sorting, that is: 2.10 before 2.9. Projects with a versions.yaml file keep the order and default version specified in that file.

• Added cross-links between the /mcp and /mcp-public setup pages and noted that the public page serves anonymous-accessible content only.

• Added an ability to create new environments in Replay using a ReplayGate.

• Added a shortcut in Replay that converts selected text in a request URL into a path parameter when pressing {.

Fixes

• Fixed an empty Download panel that appeared on the OpenAPI and AsyncAPI overview page when downloadUrls was set to an empty list.

• Fixed an issue where API docs pages opened scrolled down, hiding the breadcrumbs and any custom navigation placed above the API description.

• Fixed an issue in API docs where a schema that inherited its discriminator from an allOf parent displayed only the discriminator property, without its variants or other properties.

• Fixed an issue where several Redocly extensions were incorrectly rendered as custom vendor extensions when showExtensions was enabled.

• Fixed the gap between the label and the dropdown arrow in the Connect to MCP button.

• Fixed an issue where the Copied! tooltip on copy buttons disappeared too early when the button was clicked repeatedly.

• Fixed an issue where raw HTML in operation descriptions leaked into search results and was rendered as literal text.

• Fixed security vulnerabilities CVE-2026-84375, CVE-2026-84363, CVE-2026-84364 and CVE-2026-39408 by upgrading js-yaml to version 4.3.2 and hono to version 4.13.7.

• Fixed an issue where environment variable placeholders ({{ process.env.VAR }}) in redocly.yaml resolved to their build-time values instead of the server's runtime environment.

• Fixed the styling of dividers on Markdown pages.

• Fixed an issue in API docs where the request code sample lost its form fields and displayed an empty body.

• Fixed an issue in OpenAPI docs where schemas were positioned before operations in the sidebar.

• Updated openapi-sampler to version 1.7.5.

• Fixed an issue where a variant whose schema was unavailable, such as a schema restricted by RBAC, displayed as an empty option.

• Fixed OAuth2 client credentials exchange in the MCP gateway credentials form.

• Fixed an issue where SSO login in projects without an l10n configuration caused identity providers with strict ui_locales validation to reject the login request.

• Fixed an issue in OpenAPI docs where selecting an example in the response panel did not update the request code sample. The issue occurred when request and response examples shared the same key.

• Fixed an issue where Docs MCP API lookups rejected names that are unique parts of API titles.

• Fixed an issue where angle brackets: <, > weren't rendered inside inline code within Markdown link text, such as [`command <name>`](page).

• Fixed MCP code mode tool results and descriptions to match declared signatures.

• Fixed MCP server code mode crashes for runs that produce no output.

• Improved the MCP gateway to ask which credentials the user holds instead of picking the default.

• Fixed an issue where the MCP server sent outdated credentials. This issue happened for APIs that accept multiple security schemes.

• Updated the MCP API-credentials page to match Redocly styling.

• Fixed an issue where the MCP server served http:// links behind proxies. Credential, skill, and OAuth URLs respect the forwarded protocol and default to https for production. In local development, URLs keep the http protocol.

• Fixed MCP connections for clients on the 2026-07-28 protocol revision.

• Fixed MCP OAuth discovery: the authorization server metadata issuer matches the portal origin (RFC 8414), 401 challenges include scope and authorization_uri. Rejected bearer tokens return error="invalid_token".

• Removed the 405 status code text from the MCP endpoint pages (/mcp and /mcp-public).

• Fixed the documentationUrl in the MCP server card to include the path prefix.

• Fixed an issue where describe-tools tool in the MCP server didn't provide a human-readable name.

• Fixed an issue where project SSO login failed when the IdP sent many group claims.

• Fixed an issue where the Docs MCP get-endpoint-info tool returned operations for paths hidden with x-mcp.

• Fixed security vulnerabilities CVE-2026-83610 and CVE-2026-45820 by upgrading @xmldom/xmldom to version 0.9.12 and fflate to version 0.7.5.

• Fixed spacing and the selected language tab indicator in API docs overview panels.

• Fixed an issue in OpenAPI docs where object-valued path item extensions, such as x-okta-lifecycle, rendered as extra HTTP operations in the navigation.

• Fixed an issue where pages rendered blank for visitors with ad blockers. This issue happened when the product name matched an ad-filter pattern (for example, "Ads").

• Fixed an issue where example descriptions weren't rendered in the request and response samples panels.

• Fixed mcp.docs.ignore to correctly exclude ignored content from Docs MCP search results.

• Fixed an issue where code samples omitted the discriminator value of the selected variant.

• Fixed an issue in Replay where Basic authentication credentials with non-ASCII characters produced a corrupted Authorization header or prevented the request from being sent.

• Fixed an issue in Replay and the Try it console where operations with many editable fields got slower on each reopening.

• Fixed an issue in the Try it console where closing an inactive tab moved the selection to a different tab instead of keeping the active tab.

• Fixed an issue in Replay where the request body editor didn't display property descriptions for content with Markdown formatting.

• Fixed an issue in Replay's mobile layout where the first character typed in a request input moved focus to the close button. This behavior caused the rest of the input to be lost.

• Added missing tooltips to the Try it console parameter rows in OpenAPI docs.

• Fixed an issue in Replay where truncated tab names and request titles did not display their full versions on mouse hover or keyboard focus.

• Reworded the AI assistant's welcome message, disclaimer, and error messages for consistent naming.

• Improved the 404 page for API Docs.

• Fixed an issue where clicking an item in the table of contents caused the selection indicator to jump and highlight an incorrect item.

• Fixed an issue in API docs where deep links did not open the linked field.

• Fixed broken llms.txt links to use the configured seo.siteUrl instead of the Redocly-hosted domain.

• Fixed small visual issues with the Connect to MCP server button and aligned its styling with the page action button.

• Fixed an issue in API docs where the menu link for a section of a tag description contained a duplicated path segment.

• Fixed an issue where Markdown tables would render a collapsed gray header row when all heading cells were empty.

• Fixed an issue where a search query that contained duplicated characters returned an error.

• Updated @redocly/openapi-core to version 2.53.0.

• Fixed an issue where a mapping key that pointed to the same schema as defaultMapping disappeared from the variant list.

• Updated the language selection indicator's position in the API docs Languages panel to display inside the language selection box.

• Fixed an issue in OpenAPI docs where the server URL was missing from the request panel for APIs with a single server. This issue occurred when the mock server was disabled.

• Fixed an issue in API docs where the code samples panel displayed no Discriminator selector for schemas that inherited their discriminator from an allOf parent.

• Fixed an issue where preview did not update llms.txt and page Markdown related to LLMs.

• Fixed an issue in Try it where parameters without an example appeared empty and were excluded from requests. Parameters now use schema values such as const, examples, enum, or default. The Send button remains disabled if a required path parameter is empty.

• Fixed an issue in Replay where the input popover truncated selected values.

• Fixed an issue in Replay where a response without a body, such as 204 No Content, displayed an empty code editor on the Body tab.

• Fixed an issue in Try it where typing in the empty parameter row of a request opened in a new tab: discarded the character, moved focus out of the field, and added the parameter to the previously opened request.

• Fixed an issue in Replay where the Send button became wider while a request was in flight, which shifted the request URL row.

• Fixed an issue in Replay where a duplicate server variable appeared as an extra row in the Environments dialog's Inputs table.

• Fixed an issue in Replay where pressing the Return or Enter key in the request URL field could break the URL onto a new line or clear the response panel during a running request.

Fixes

• Fixed processing of pull request webhooks for deleted pull requests to prevent unnecessary retries.

• Updated @redocly/cli and @redocly/openapi-core to version 2.53.0.

• Fixed authentication pages applying the selected color mode from User settings > Appearance.

Fixes

• Removed the Creator column from the Reunite API keys page and the createdById field from API key responses. Audit log exports still indicate who created, updated, or revoked each key.

Fixes

• Fixed an issue where builds complete successfully but incorrectly report internal system errors.

• Fixed an issue where changing a pull request's target branch did not start a preview deployment.

• Improved build times for projects with many commit statuses by reducing redundant status updates.

• Fixed the placement of the Reunite hint shown after the setup checklist is closed. The hint appears next to the checklist button in the sidebar instead of the top-right corner of the screen.

Features

• Added the option for invited users to resend their organization invitation email from within Reunite.

Fixes

• Fixed search errors that occurred when Typesense search was enabled for a project for the first time.

Fixes

• Hardened AI search access rules configured under access.rbac (features.aiSearch and the assistant hide flags).

• Fixed Reunite login to show a clear error message for unverified email addresses and removed sensitive details from login failure responses.

• Fixed missing commit events in the pull request timeline for branches with long histories.

• Fixed duplicated commit events in the Reunite pull request timeline.

Features

• Added a request ID to Reunite server error pages so users can copy it and share it with support when reporting a problem.

Features

• Added a filter on the Reunite Teams page to display all teams, Reunite-managed teams, or SSO-synced teams.