Changelog

Features

• Added identity verification for the embedded AI assistant to provide access-controlled responses for signed-in users.

• Blocked sign-up with disposable email domains in Reunite by rejecting these addresses in the registration form and API validation.

Fixes

• Removed the beta insiders program. Sign-up and SSO login are no longer gated behind the beta-insiders allowlist, and organization creation no longer shows the Insiders confirmation step.

• Fixed an issue that prevented custom domain verification from succeeding when a DNS or CDN provider added an intermediate CNAME hop before ssl.redocly.app. Verification now follows the full CNAME chain instead of only checking the first record. Note that domains served through a proxying CDN (such as Cloudflare's proxied/orange-cloud mode) hide the origin and must use DNS-only mode to be verified.

Fixes

• Fixed the collapsed height of logs in the webview error screen.

Fixes

• Fixed pull request creation failing when the title was too long. Pull request actions now report the reason the git provider gives.

• Fixed incorrect empty 502 responses for requests with incompatible credentials.

Fixes

• Improved project creation speed in Reunite by eliminating delays during repository setup.

Features

• Added AI code review follow-up replies that identify remaining issues when flagged problems are only partially fixed.

• Added a notification prompting users to refresh the UI after a version update in Reunite.

• Added Find in file option to the editor file tree context menu.

Fixes

• Fixed file-level access in the Reunite editor to restrict editing to files within a member's permission scope for projects using the access.rbac setting.

Features

• Added support for agent skills placed under the @skills folder.

• Added numbered-list and numbered-item Markdoc tags to render step-by-step guides with numbered, icon, or bulleted lists and deep-linkable item headlines.

• Added support for automatic access token refresh for the MCP server.

• Improved GraphQL exploration in the MCP docs server.

• Allowed the redocly special value in the access.idps config option to offer the standard Redocly login (email/password and Social Login providers) alongside specific identity providers.

• Added support for the 2026-07-28 MCP protocol revision, including secure upstream API credential prompts for clients on the new revision.

• Added manageApiCredentials tool to update or remove stored API credentials.

• Added team-based access control for the MCP server using the rbac.features.mcp configuration.

• Added locale and translate options to the renderForLlms tag render context.

• Added customizable ReplayGate and ReplayTopBarActions components to tailor authentication and the top bar in the Try It feature.

• Migrated from the react-router-dom to react-router version 8.x.

• Added support for Agent-to-Agent card and MCP server card.

• Added hover hints to Try it request body fields.

Fixes

• Fixed an issue where API docs pages with large, deeply-nested schemas might have stopped responding after users clicked Expand all.

• Fixed an issue where mock server requests in hosted projects failed with a 500 error due to restricted API access.

• Fixed editor-to-Webview navigation for API operations rendered as anchors on a single page.

• Improved credential handling and rate limiting in the experimental gateway MCP.

• Fixed rate limit enforcement for the experimental MCP gateway to work correctly across server instances.

• Hardened access control of llms.txt on the homepage Markdown page.

• Fixed an issue in the Typesense search engine where search requests failed with a 500 error.

• Fixed credential handling in the gateway MCP for clients without URL-mode elicitation.

• Fixed fetch capability in an experimental gateway MCP.

• Fixed endpoint details returned by the Docs MCP server to correctly display documentation for individual endpoints.

• Fixed intermittent Session not found errors from the MCP server.

• Fixed an issue on iOS devices where the on-screen keyboard caused the search and AI Assistant's inputs to overflow the screen making the send button inaccessible.

• Fixed an issue in API docs where documented array items were not displayed in a nested indexed row.

• Fixed the built-in Docs MCP OAuth flow for public sites so they no longer advertise an authorization server or force a login.

• Improved response time on sites with many pages that use the llms.txt feature.

• Fixed incorrect rendering of array items with primitive values in API docs.

• Fixed SSO logout to require re-authentication with the identity provider, preventing automatic login immediately after logout.

• Fixed an issue where the search modal could render taller than the browser window on short screens, causing it to be cut off.

• Fixed security vulnerabilities CVE-2026-67214 and CVE-2026-67213 by upgrading nanoid to version 5.1.16.

• Fixed an issue in API docs where links to schema definitions inside operations were displayed as regular text instead of links.

• Fixed security vulnerabilities CVE-2026-69207 by upgrading hono to version 4.12.34.

• Improved rendering of schema property examples.

• Fixed security vulnerability GHSA-5p4m-2wfm-xmqj by upgrading js-yaml to version 4.3.1.

• Updated @redocly/openapi-core to version 2.45.0.

• Fixed an issue where deep links to callbacks navigated users to the operation instead.

• Fixed an issue where API docs callbacks failed to render when expanded.

• Fixed an issue where some pages containing curation keywords were missing from search results.

• Fixed an issue where some queries returned multiple search results for the same page.

• Fixed an issue where the Show more command would display even though only one search result existed.

• Fixed an issue where callbacks and other collapsible panels in API docs could not be expanded.

• Fixed an issue where multiple adjacent separators in the sidebar rendered only the last separator.

• Fixed an issue where requests sent in one Replay tab aborted the in-flight request in another tab.

• Fixed an issue in Replay where OAuth2 Client Credentials token requests with strict authorization servers failed due to empty client_assertion.

• Fixed an issue where the clickable path parameters in request URLs didn't render the popovers when clicked.

• Fixed display overflow of environment and server variables by truncating long values.

• Fixed an issue in Try it where removing a path parameter prevented users from adding it again.

• Fixed an issue where the Try It request body editor displayed a $ref can not be resolved warning when request body schemas referenced components.

• Fixed case-insensitive handling of HTTP headers by ignoring Content-Type on GET requests and preventing duplicate Content-Type response headers.

Features

• Added the ability to invite several people to an organization at once by entering a list of email addresses in the invite dialog.

Fixes

• Added auditing to AI Assistant conversations.

• Fixed commit statuses remaining in a running state on GitLab pull requests when the GitLab API became unresponsive.

• Fixed an issue where deleted or archived GitLab projects appeared in project and namespace lists, causing slow namespace loading. On self-managed GitLab versions before 18.0, deleted projects may still appear in the project list.

• Fixed curation keywords to be fully case-insensitive.

• Fixed Typesense search curation to prioritize excludes over includes for the same keyword.

Fixes

• Fixed AI code review flagging current dates as future dates.

• Fixed an issue where the Reunites Organizations and projects menu displayed an empty list when the sidebar was collapsed.

Features

• Added an AI search conversation view to the Analytics page, showing each question and answer from a search session in order.

Fixes

• Fixed Azure DevOps OAuth connection failures after token expiration.

• Updated @redocly/cli and @redocly/openapi-core to version 2.45.0.

• Updated @redocly/cli and @redocly/openapi-core to version 2.44.2.

Features

• Added seats quota notifications: organization owners receive emails when seat usage reaches 90%, and when the quota is exceeded.

Fixes

• Restricted audit log export endpoints to callers with the org.auditLogs.read permission. Organization owners have this permission by default. Ensure your API keys and OAuth2 clients include the org.auditLogs.read scope to access audit log export jobs and downloads. Audit log exports remain available on Enterprise plans.

• Moved the AI assistant to its own AI Assistant section, separate from site search statistics.

• Fixed the announcement modal to focus on the close button when opened.

• Fixed the pull request page to show the correct status when the Git provider connection fails.

Features

• Added automatic pull request comments to warn contributors when their changes affect files managed by remote content, preventing accidental overwrites during updates.

Fixes

• The initial pull requests created after adding remote content are created as drafts.

• Fixed GitLab OAuth connection failures after token expiration.

• Updated @redocly/cli and @redocly/openapi-core to version 2.43.1.

• Fixed the remote content connection dialog to display specific server errors, such as missing Git access token permissions, instead of a generic "Forbidden" message.

• Fixed notification for review failures to correctly indicate Git provider connection issues and to stop appearing after successful sync.

• Fixed the misaligned close button on the announcement modal.

Fixes

• Fixed dot-prefixed files and folders (except the .git folder) being hidden in the repository path picker when adding remote content.

Fixes

• Hardened access control of llms.txt on the homepage Markdown page.

• Improved response time on sites with many pages that use the llms.txt feature.

Fixes

• Fixed security vulnerabilities CVE-2026-59896, CVE-2026-59895, and CVE-2026-59897 by upgrading hono to version 4.12.27.

• Fixed security vulnerability GHSA-c2j3-45gr-mqc4 by upgrading dompurify to version 3.4.12.

• Fixed security vulnerability CVE-2026-59869 by upgrading js-yaml to version 4.3.0.

Fixes

• Added a default project setting to SAML identity providers that controls where viewers land after an IdP-initiated login.

• Fixed navigation synchronization between the editor and the Webview.

• Hid the What's new sidebar item when no announcements are available for the organization.

• Fixed an issue where signing in to an organization that requires SSO with a different login method could unexpectedly log you out and return you to the login page instead of showing the organization sign-in screen.

Fixes

• Added redirect for viewer users signing in via IdP-initiated SSO login to their organization's first project portal instead of the Reunite app.

• Fixed an issue that caused project source download links to be invalid, restoring ZIP download functionality.

Fixes

• Updated @redocly/cli and @redocly/openapi-core to version 2.40.0.

Fixes

• Fixed autonomous agent jobs failing to load configured source code repositories.

Features

• Added the ability to download Redocly-hosted projects for a specific branch.

Fixes

• Added draft pull request support for the Bitbucket Cloud git provider.

• Fixed pull request statuses and checks not updating after new commits. Restored filtering on the project custom domains endpoint.

• Moved the sidebar collapse toggle to the sidebar’s bottom menu and fixed icon alignment and spacing in the menu.