Realm, Redoc, Revel, and Reef changelog

Features

• Added McpNotAllowed to the layouts supported by the eject component command.

• Added support for GitHub alert syntax in Markdown pages: > [!NOTE], > [!TIP], > [!IMPORTANT], > [!WARNING], and > [!CAUTION] render as admonitions.

• Deprecated the mcp.docs object and moved its options, such as name and ignore, to mcp. Projects that use mcp.docs still build, with a warning in the build log.

• Added the options attribute to the openapi-code-sample Markdoc tag that overrides the API's openapi configuration for a single embedded code sample. For example, set codeSamples.skipOptionalParameters to true to leave optional headers, query parameters, and cookies out of the sample.

• Renamed the reunite option and the access.rbac.reunite scope in redocly.yaml to platform and deprecated the old names. Using the old names does not fail the build, but produces warnings in the build log.

• Changed the Open in Claude and Open in ChatGPT actions of the prompt Markdoc tag to open the desktop apps instead of the web chats. Open in Claude starts a Claude Code session in the Claude desktop app.

• Improved the design of the prompt Markdoc tag: Copy prompt is the main button, and its menu lists the actions with their icons on the menu button. Without a title configuration, the prompt text appears in the header.

• Switched Markdoc to @redocly/markdoc, Redocly's fork of Markdoc. Custom tags that import from @markdoc/markdoc keep working.

• Added menus for selecting allowed enum values and runtime expressions for parameter and form data in the Try it console and Replay.

• Added the alt attribute to the inline-svg Markdoc tag, which gives the SVG an accessible name for people who use assistive technologies.

Fixes

• Fixed an issue in Firefox that caused the last message in an AI assistant conversation to overlap the input field when scrolling.

• Fixed an issue where rbac.content rules for OpenAPI and AsyncAPI description files failed to protect download links with different file extensions.

• Fixed an issue where an API docs page crashed when an OpenAPI or AsyncAPI description used a boolean schema (true or false) inside an allOf or as a top-level schema, such as payload: true in an AsyncAPI message.

• Fixed an issue where the Try it console and code samples did not send a parameter declared with content and a JSON media type as one JSON value.

• Fixed an issue where C# request samples in OpenAPI docs sent number, boolean, and null values from the request body example as strings. C# request samples also compile when the example contains strings with quotes, backslashes, or line breaks, or empty, nested, or mixed-type arrays.

• Fixed an issue in API docs where content shifted on load when users opened a direct link to an operation or a tag.

• Fixed an issue where API docs and the json-schema Markdoc tag displayed a false schema as any, or showed the other parts of an allOf that included false. A false schema, a $ref to one, or an allOf that includes one displays as no value allowed, and the parent type label leaves it out.

• Fixed an issue in API docs where description headings with inline formatting were cut off in the sidebar and in section links. Old section links redirect to the new ones.

• Fixed an issue that prevented OpenAPI operations from rendering when x-codeSamples contained empty or null items, or when parameters was not a list.

• Fixed a build failure when an openapi-code-sample Markdoc tag referenced an operation whose x-codeSamples entry had a label but no lang.

• Fixed an issue where an invalid value in an OpenAPI or AsyncAPI description, such as a server without url or an empty required: in an allOf part, crashed the API docs page. The invalid part is skipped and the rest of the page renders.

• Improved server-side rendering performance for OpenAPI reference pages with heavily reused schemas.

• Fixed an issue in OpenAPI docs where request and response samples were empty when a discriminator option's property referenced part of another schema.

• Fixed an issue where OpenAPI and AsyncAPI pages crashed when an API description set x-badges to a single object instead of a list. The invalid value is ignored and reported in the build log.

• Fixed keyboard and screen reader issues in the sidebar, Markdoc tabs, switches, select fields, search, and Replay. For example, the arrow keys switch Markdoc tabs without a mouse click first, and the Space key expands sidebar groups and toggles switches.

• Fixed an issue where a banner with empty content in redocly.yaml displayed the text of the redocly.yaml file instead of being hidden.

• Fixed security vulnerability CVE-2026-111757 by upgrading hono to version 4.13.13.

• Updated @redocly/openapi-core to version 2.73.0.

• Improved keyboard navigation in catalog entity version history. The arrow keys open the version list and move between versions, the Escape key closes the list, and the focused version shows a focus ring.

• Fixed an issue where the AI assistant chat jumped to the end of the conversation while a response was streaming, even after the user scrolled up to read earlier messages.

• Fixed an issue where reaction-specific reasons in page feedback forms did not use the configured labels or components.

• Fixed an issue where the rating and sentiment page feedback forms accepted invalid email addresses without prompting users to correct them.

• Improved page feedback forms so that screen readers announce the comment and email fields with their labels.

• Fixed an issue where the mood page feedback form did not show its reaction-specific default comment label when comment was not configured.

• Fixed an issue where the sentiment and mood page feedback forms sent the reasons a user selected for one reaction after they switched to another reaction.

• Fixed the Cancel button in the scale page feedback form so it uses the same translation key as other feedback forms. If you translated feedback.settings.comment.cancel for this button, move that translation to feedback.cancel.

• Fixed an issue where the top items of the page table of contents were hidden under the navbar when a banner was displayed.

• Fixed security vulnerabilities GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr and GHSA-c6gr-qvv4-5v3f by upgrading dompurify to version 3.4.17.

• Fixed an issue where the Docs MCP setup snippets gave every site without mcp.name the same server name, which caused a name conflict in the MCP client when users connected more than one site. If mcp.name is not set, the server name is based on the site's domain.

• Fixed a security vulnerability that could allow a request to the Docs MCP server to consume excessive memory.

• Fixed security vulnerabilities GHSA-jm63-cq47-j5jp, GHSA-46jr-4wx8-v453 and GHSA-rvq5-wwqv-78pq by upgrading @modelcontextprotocol/server to version 2.3.1.

• Extended how long MCP clients stay signed in to the authenticated Docs MCP server from 24 hours to 30 days when the identity provider issues refresh tokens. Without refresh tokens, sessions still expire after 24 hours.

• Fixed security vulnerability GHSA-g3hv-75wg-m249 by upgrading minimatch to version 11.0.3.

• Fixed an issue where the mock server returned values from earlier requests in later responses.

• Fixed an issue where the mock server returned a 500 error for requests with a JSON body when the operation declared its response with the */* media type.

• Improved how fast the mobile menu, search, and other dialogs open on touch devices.

• Fixed an issue where OIDC login failed with a misleading 400 Invalid JSON error when the identity provider returned an error status or a non-JSON response, such as an "Access Denied" page from a firewall. The login returns a 502 Bad Gateway error, and the server logs show the identity provider host and the HTTP status of its response.

• Fixed an issue where pages translated with the browser translation feature, such as API docs pages, displayed an error.

• Fixed an issue where the connect-mcp Markdoc tag displayed a connect button on sites that don't serve an MCP server.

• Fixed raw HTML in Markdown pages and API descriptions: boolean attributes such as <details open> take effect, and style values that contain semicolons, such as data URLs, are kept.

• Fixed an issue in the Try it console in OpenAPI docs where the History tab listed requests by path instead of operation name.

• Fixed an issue in the Try it console where the edited request body was replaced with the documented example when the content type changed. For example, when users switched from JSON to XML and back.

• Fixed an issue in the Try it request body editor where valid values were flagged as not divisible when the schema's multipleOf was a decimal such as 0.01.

• Fixed an issue that prevented Try it from sending requests and caused the Security tab to crash when an OAuth2 security scheme had no flows in the API description.

• Fixed parameter checkboxes in the Try it console and Replay so that the keyboard focus is visible.

• Fixed an issue where the Try it console and Replay displayed wrong values or did not load when a server, environment, or parameter had a name such as constructor or toString.

• Fixed an issue that caused array and object query parameters in the Try it console to ignore style and explode settings.

• Fixed an issue where the project's @theme styles and theme overrides did not load when @redocly/theme was installed inside the product package instead of the project root.

• Improved page load performance so that pages respond to clicks and taps sooner. The search dialog loads in the background after the page loads, and the code snippet report form loads the first time a user opens it.

• Fixed keyboard access in select fields: the arrow keys move through the options, Escape closes the list, and a click in a searchable select field lets users type a search right away.

• Fixed an issue where Visual review in Reunite showed a sign-in redirect loop for login-protected projects in browsers that block third-party cookies, such as Safari, Firefox, and Brave.

• Improved the security of the Reunite Visual review sign-in for login-protected projects: Reunite no longer passes the session token in the URL.

• Fixed the AI assistant status lines, such as "Searching documentation..." and "Ran code", that stayed in English on localized sites.

• Improved how fast the Try it console opens in API docs, especially for operations with many request fields.

• Fixed security vulnerability GHSA-mrhx-c7xc-m3w5 by upgrading zod to version 4.6.6.

Fixes

• Fixed an issue in OpenAPI docs where the page of a schema that other schemas extend through allOf never finished rendering when its properties reached schemas that refer back to those extensions.

• Fixed an issue in OpenAPI docs where a page never finished rendering when two discriminator schemas listed the same variants and both declared the properties the variants inherit.

• Fixed an issue where the Docs MCP server in projects with large configurations used too much memory and responded slowly.

Fixes

• Fixed an issue where search with the Typesense engine failed or took several seconds on projects with large API operations.

Fixes

• Fixed an issue where OpenAPI pages that use allOf inheritance with a oneOf discriminator caused the server to stop responding.

Fixes

• Fixed security vulnerability CVE-2026-25128 in fast-xml-parser by upgrading openapi-sampler to version 1.7.0.

Fixes

• Fixed a bug where AI search events were not tracked for project analytics.

Fixes

• Fixed an issue where Project Analytics would not display any data for specific versions of Realm.

Fixes

• Fixed an issue where the login button was not displayed when a default identity provider was configured.

Fixes

• Fixed an issue where project processing could halt indefinitely due to incorrect cache handling.

Fixes

• Fixed a bug where scorecard custom targets did not match.

• Fixed an issue where the product picker was not properly aligned in the navbar.

Fixes

• Fixed an issue where successive sidebar items were not activated when users were scrolling API document pages.

Fixes

• Renamed the get-full-definition MCP tool to get-full-spec-document.

Fixes

• Fixed project analytics collection.

Fixes

• Improved JavaScript compilation time on Windows.

Fixes

• Fixed an issue where Markdoc tags did not render in preview mode.

Fixes

• Fixed an issue causing crashed during a build.

Fixes

• Fixed invalid dependency version causing dependency install to fail.

Fixes

• Fixed broken feedback submission.

• Fixed an issue where LLM page actions appeared on pages excluded from search.

Fixes

• Fixed an issue where an RBAC match pattern starting with ** did not override the global match pattern **.

Fixes

• Fixed an issue where the Markdoc tabs tag incorrectly set the active state for the selected tab.