Changelog

Features

• Added support for agent skills placed under the @skills folder.

• Added numbered-list and numbered-item Markdoc tags to render step-by-step guides with numbered, icon, or bulleted lists and deep-linkable item headlines.

• Added support for automatic access token refresh for the MCP server.

• Improved GraphQL exploration in the MCP docs server.

• Allowed the redocly special value in the access.idps config option to offer the standard Redocly login (email/password and Social Login providers) alongside specific identity providers.

• Added support for the 2026-07-28 MCP protocol revision, including secure upstream API credential prompts for clients on the new revision.

• Added manageApiCredentials tool to update or remove stored API credentials.

• Added team-based access control for the MCP server using the rbac.features.mcp configuration.

• Added locale and translate options to the renderForLlms tag render context.

• Added customizable ReplayGate and ReplayTopBarActions components to tailor authentication and the top bar in the Try It feature.

• Migrated from the react-router-dom to react-router version 8.x.

• Added support for Agent-to-Agent card and MCP server card.

• Added hover hints to Try it request body fields.

Fixes

• Fixed an issue where API docs pages with large, deeply-nested schemas might have stopped responding after users clicked Expand all.

• Fixed an issue where mock server requests in hosted projects failed with a 500 error due to restricted API access.

• Fixed editor-to-Webview navigation for API operations rendered as anchors on a single page.

• Improved credential handling and rate limiting in the experimental gateway MCP.

• Fixed rate limit enforcement for the experimental MCP gateway to work correctly across server instances.

• Hardened access control of llms.txt on the homepage Markdown page.

• Fixed an issue in the Typesense search engine where search requests failed with a 500 error.

• Fixed credential handling in the gateway MCP for clients without URL-mode elicitation.

• Fixed fetch capability in an experimental gateway MCP.

• Fixed endpoint details returned by the Docs MCP server to correctly display documentation for individual endpoints.

• Fixed intermittent Session not found errors from the MCP server.

• Fixed an issue on iOS devices where the on-screen keyboard caused the search and AI Assistant's inputs to overflow the screen making the send button inaccessible.

• Fixed an issue in API docs where documented array items were not displayed in a nested indexed row.

• Fixed the built-in Docs MCP OAuth flow for public sites so they no longer advertise an authorization server or force a login.

• Improved response time on sites with many pages that use the llms.txt feature.

• Fixed incorrect rendering of array items with primitive values in API docs.

• Fixed SSO logout to require re-authentication with the identity provider, preventing automatic login immediately after logout.

• Fixed an issue where the search modal could render taller than the browser window on short screens, causing it to be cut off.

• Fixed security vulnerabilities CVE-2026-67214 and CVE-2026-67213 by upgrading nanoid to version 5.1.16.

• Fixed an issue in API docs where links to schema definitions inside operations were displayed as regular text instead of links.

• Fixed security vulnerabilities CVE-2026-69207 by upgrading hono to version 4.12.34.

• Improved rendering of schema property examples.

• Fixed security vulnerability GHSA-5p4m-2wfm-xmqj by upgrading js-yaml to version 4.3.1.

• Updated @redocly/openapi-core to version 2.45.0.

• Fixed an issue where deep links to callbacks navigated users to the operation instead.

• Fixed an issue where API docs callbacks failed to render when expanded.

• Fixed an issue where some pages containing curation keywords were missing from search results.

• Fixed an issue where some queries returned multiple search results for the same page.

• Fixed an issue where the Show more command would display even though only one search result existed.

• Fixed an issue where callbacks and other collapsible panels in API docs could not be expanded.

• Fixed an issue where multiple adjacent separators in the sidebar rendered only the last separator.

• Fixed an issue where requests sent in one Replay tab aborted the in-flight request in another tab.

• Fixed an issue in Replay where OAuth2 Client Credentials token requests with strict authorization servers failed due to empty client_assertion.

• Fixed an issue where the clickable path parameters in request URLs didn't render the popovers when clicked.

• Fixed display overflow of environment and server variables by truncating long values.

• Fixed an issue in Try it where removing a path parameter prevented users from adding it again.

• Fixed an issue where the Try It request body editor displayed a $ref can not be resolved warning when request body schemas referenced components.

• Fixed case-insensitive handling of HTTP headers by ignoring Content-Type on GET requests and preventing duplicate Content-Type response headers.

Fixes

• Added auditing to AI Assistant conversations.

• Fixed commit statuses remaining in a running state on GitLab pull requests when the GitLab API became unresponsive.

• Fixed an issue where deleted or archived GitLab projects appeared in project and namespace lists, causing slow namespace loading. On self-managed GitLab versions before 18.0, deleted projects may still appear in the project list.

• Fixed curation keywords to be fully case-insensitive.

• Fixed Typesense search curation to prioritize excludes over includes for the same keyword.

Fixes

• Fixed AI code review flagging current dates as future dates.

• Fixed an issue where the Reunites Organizations and projects menu displayed an empty list when the sidebar was collapsed.

Features

• Added an AI search conversation view to the Analytics page, showing each question and answer from a search session in order.

Fixes

• Fixed Azure DevOps OAuth connection failures after token expiration.

• Updated @redocly/cli and @redocly/openapi-core to version 2.45.0.

• Updated @redocly/cli and @redocly/openapi-core to version 2.44.2.

Features

• Added seats quota notifications: organization owners receive emails when seat usage reaches 90%, and when the quota is exceeded.

Fixes

• Restricted audit log export endpoints to callers with the org.auditLogs.read permission. Organization owners have this permission by default. Ensure your API keys and OAuth2 clients include the org.auditLogs.read scope to access audit log export jobs and downloads. Audit log exports remain available on Enterprise plans.

• Moved the AI assistant to its own AI Assistant section, separate from site search statistics.

• Fixed the announcement modal to focus on the close button when opened.

• Fixed the pull request page to show the correct status when the Git provider connection fails.

Features

• Added automatic pull request comments to warn contributors when their changes affect files managed by remote content, preventing accidental overwrites during updates.

Fixes

• The initial pull requests created after adding remote content are created as drafts.

• Fixed GitLab OAuth connection failures after token expiration.

• Updated @redocly/cli and @redocly/openapi-core to version 2.43.1.

• Fixed the remote content connection dialog to display specific server errors, such as missing Git access token permissions, instead of a generic "Forbidden" message.

• Fixed notification for review failures to correctly indicate Git provider connection issues and to stop appearing after successful sync.

• Fixed the misaligned close button on the announcement modal.

Fixes

• Fixed dot-prefixed files and folders (except the .git folder) being hidden in the repository path picker when adding remote content.

Fixes

• Hardened access control of llms.txt on the homepage Markdown page.

• Improved response time on sites with many pages that use the llms.txt feature.

Fixes

• Fixed security vulnerabilities CVE-2026-59896, CVE-2026-59895, and CVE-2026-59897 by upgrading hono to version 4.12.27.

• Fixed security vulnerability GHSA-c2j3-45gr-mqc4 by upgrading dompurify to version 3.4.12.

• Fixed security vulnerability CVE-2026-59869 by upgrading js-yaml to version 4.3.0.

Fixes

• Added a default project setting to SAML identity providers that controls where viewers land after an IdP-initiated login.

• Fixed navigation synchronization between the editor and the Webview.

• Hid the What's new sidebar item when no announcements are available for the organization.

• Fixed an issue where signing in to an organization that requires SSO with a different login method could unexpectedly log you out and return you to the login page instead of showing the organization sign-in screen.

Fixes

• Added redirect for viewer users signing in via IdP-initiated SSO login to their organization's first project portal instead of the Reunite app.

• Fixed an issue that caused project source download links to be invalid, restoring ZIP download functionality.

Fixes

• Updated @redocly/cli and @redocly/openapi-core to version 2.40.0.

Fixes

• Fixed autonomous agent jobs failing to load configured source code repositories.

Features

• Added the ability to download Redocly-hosted projects for a specific branch.

Fixes

• Added draft pull request support for the Bitbucket Cloud git provider.

• Fixed pull request statuses and checks not updating after new commits. Restored filtering on the project custom domains endpoint.

• Moved the sidebar collapse toggle to the sidebar’s bottom menu and fixed icon alignment and spacing in the menu.

Fixes

• Fixed creator filter in pull request list to show user names instead of their IDs.

• Preserved the original login destination when the SSO login flow restarts and the stale login challenge can no longer be refreshed.

• Fixed the search input on the Feedback page losing focus while typing, so you can filter feedback without repeatedly clicking the search box.

• Centered Delete organization and Delete project confirmation modals vertically for improved alignment.

• Fixed identity providers' names and slugs rendering vertically on the SSO and login page when space was limited.

Fixes

• Fixed SSO login failures caused by expired login challenges. The login flow restarts automatically and returns users to their original destination.

• Fixed security vulnerability CVE-2026-12151 affecting service security.

• Fixed built-in teams such as redocly.members, redocly.owners, and redocly.viewers not being recognized in project RBAC. Access rules referencing these teams now grant access based on organization roles without additional configuration.

• Improved consistency and reliability of modals, breadcrumbs, dropdowns, and copy-to-clipboard controls.

• Fixed misleading date labels on the project analytics "Views and Users" chart. Points that group a whole month or week used to show just one day (like "05/01"). They now show "May 2026" for a month or "May 25" for a week, so the label matches the period it covers.

Features

• Added a Paid seat filter to the organization People page to show only users occupying paid seats.

Fixes

• Updated @redocly/cli and @redocly/openapi-core to version 2.39.0.

Fixes

• Enabled Redocly login (email/password and Social Login providers) on project login when the access.idps configuration includes the redocly value.

• Allowed sending invitations in organizations with the Require SSO authentication option enabled.

Fixes

• Fixed security vulnerabilities CVE-2025-46394 and CVE-2024-58251 by upgrading busybox to version 1.37.0-r30.

• Fixed SSO login downgrading the organization's last Owner and blocked SSO logins for organizations whose plan does not include SSO.