Bump undici and @redocly/cli in /openapi

[dependabot]

Bumps undici to 7.29.0 and updates ancestor dependency @redocly/cli. These dependencies need to be updated together.

Updates undici from 7.25.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	8cb10f98
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	04201f89
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	3805b8f8
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	85a24055
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	d0574cc4
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	d0574cc4
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	ea8930cf

---

... (truncated)

Commits

• 9e38fc1 Bumped v7.29.0 (#5590)
• d887e34 fix: validate coerced header values for CRLF (#5579)
• 33928bc fix: validate blob body content type
• 98011a8 fix(cache): harden cache directive parsing
• 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
• 1b5a531 fix(retry): reject partial content length mismatch
• 466e99d test: cover crash on mixed unqualified and qualified private cache directives
• 9f10f1e fix: handle empty qualified private cache directive
• 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
• f9eba0a Bumped v7.28.0 (#5430)
• Additional commits viewable in compare view

Updates @redocly/cli from 2.32.2 to 2.47.0

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.47.0

Minor Changes

• Added a Vendor Extensions metric to the stats command that reports how many distinct x- extensions a description file uses and how often each one occurs.

Patch Changes

• Fixed the stats command reporting wrong parameter count for AsyncAPI descriptions.
• Updated @​redocly/openapi-core to v2.47.0.

@​redocly/cli@​2.46.2

Patch Changes

• Updated @​redocly/openapi-core to v2.46.2.

@​redocly/cli@​2.46.1

Patch Changes

• Updated @redocly/ajv to ^8.18.3.
• Updated @​redocly/openapi-core to v2.46.1.
• Updated @​redocly/respect-core to v2.46.1.

@​redocly/cli@​2.46.0

Minor Changes

• Added the spec-ref-siblings rule that reports properties placed next to a $ref which the specification does not allow.

Patch Changes

• Updated @​redocly/openapi-core to v2.46.0.

@​redocly/cli@​2.45.0

Minor Changes

• Fixed the bundle command losing schema keywords (such as title, properties, or required) written next to a $ref when the referenced schemas started with their own $ref.

Patch Changes

• Updated @​redocly/openapi-core to v2.45.0.

@​redocly/cli@​2.44.2

Patch Changes

• Changed the severity of the security-defined rule for AsyncAPI 2.x and 3.x in the recommended ruleset from error to warn. AsyncAPI descriptions with undefined or unresolved security no longer fail linting by default.
• Updated @​redocly/openapi-core to v2.44.2.

@​redocly/cli@​2.44.1

Patch Changes

... (truncated)

Commits

• 62fdb42 chore: 🔖 release new versions (#3043)
• 048de15 chore: update snapshots (#3048)
• 21f30a7 chore: remove missing 2.45.1 version from changelog (#3044)
• 6419e98 feat: add vendor extensions metric with per-extension counts (#3021)
• 3d2ec7c chore: 🔖 release new versions (#3041)
• 2bb702c fix: detect duplicated enum values that are objects or arrays (#3042)
• af879b2 fix: improve error output when a configurable rule is missing its assertions ...
• d5bd757 chore: bump redocly/mock-server version (#3039)
• e39c129 chore: improve linter by adding eslint-plugin-sonarjs (#3037)
• ae9771c chore: 🔖 release new versions (#3035)
• Additional commits viewable in compare view