# Changelog ## Latest releases ## Platformv2026-11-08.1latest2026-11-08 ### Fixes - Fixed an issue where a Reunite organization could be named with a payment card number, which put the number in organization URLs and logs. Organization names and slugs that look like a payment card number are rejected with a validation error. - Fixed the **Link** button in Platform pull request comments to use selected text as the link text and a selected URL as the link target. - Improved the custom terms of service editor in Platform organization settings: formatting applies to the word at the cursor, **Bold** and **Italic** toggle off existing formatting, and screen readers announce toolbar buttons by name. ## AI assistant web component1.1.1latest2026-11-05 ### Fixes - Fixed the AI assistant conversation in Firefox, where the last message touched the input field once the conversation scrolled, instead of keeping the same spacing as between messages. ## Framework0.140.0latest2026-11-04 ### Features - Added `McpNotAllowed` to the layouts supported by the `eject component` command. - Added support for GitHub alert syntax in Markdown pages: `> [!NOTE]`, `> [!TIP]`, `> [!IMPORTANT]`, `> [!WARNING]`, and `> [!CAUTION]` render as admonitions. - Deprecated the `mcp.docs` object and moved its options, such as `name` and `ignore`, to `mcp`. Projects that use `mcp.docs` still build, with a warning in the build log. - Added the `options` attribute to the `openapi-code-sample` Markdoc tag that overrides the API's `openapi` configuration for a single embedded code sample. For example, set `codeSamples.skipOptionalParameters` to `true` to leave optional headers, query parameters, and cookies out of the sample. - Renamed the `reunite` option and the `access.rbac.reunite` scope in `redocly.yaml` to `platform` and deprecated the old names. Using the old names does not fail the build, but produces warnings in the build log. - Changed the **Open in Claude** and **Open in ChatGPT** actions of the `prompt` Markdoc tag to open the desktop apps instead of the web chats. **Open in Claude** starts a Claude Code session in the Claude desktop app. - Improved the design of the `prompt` Markdoc tag: **Copy prompt** is the main button, and its menu lists the `actions` with their icons on the menu button. Without a `title` configuration, the prompt text appears in the header. - Switched Markdoc to `@redocly/markdoc`, Redocly's fork of Markdoc. Custom tags that import from `@markdoc/markdoc` keep working. - Added menus for selecting allowed `enum` values and runtime expressions for parameter and form data in the **Try it** console and Replay. - Added the `alt` attribute to the `inline-svg` Markdoc tag, which gives the SVG an accessible name for people who use assistive technologies. ### Fixes - Fixed an issue in Firefox that caused the last message in an AI assistant conversation to overlap the input field when scrolling. - Fixed an issue where `rbac.content` rules for OpenAPI and AsyncAPI description files failed to protect download links with different file extensions. - Fixed an issue where an API docs page crashed when an OpenAPI or AsyncAPI description used a boolean schema (`true` or `false`) inside an `allOf` or as a top-level schema, such as `payload: true` in an AsyncAPI message. - Fixed an issue where the **Try it** console and code samples did not send a parameter declared with `content` and a JSON media type as one JSON value. - Fixed an issue where C# request samples in OpenAPI docs sent number, boolean, and `null` values from the request body example as strings. C# request samples also compile when the example contains strings with quotes, backslashes, or line breaks, or empty, nested, or mixed-type arrays. - Fixed an issue in API docs where content shifted on load when users opened a direct link to an operation or a tag. - Fixed an issue where API docs and the `json-schema` Markdoc tag displayed a `false` schema as `any`, or showed the other parts of an `allOf` that included `false`. A `false` schema, a `$ref` to one, or an `allOf` that includes one displays as **no value allowed**, and the parent type label leaves it out. - Fixed an issue in API docs where description headings with inline formatting were cut off in the sidebar and in section links. Old section links redirect to the new ones. - Fixed an issue that prevented OpenAPI operations from rendering when `x-codeSamples` contained empty or `null` items, or when `parameters` was not a list. - Fixed a build failure when an `openapi-code-sample` Markdoc tag referenced an operation whose `x-codeSamples` entry had a `label` but no `lang`. - Fixed an issue where an invalid value in an OpenAPI or AsyncAPI description, such as a server without `url` or an empty `required:` in an `allOf` part, crashed the API docs page. The invalid part is skipped and the rest of the page renders. - Improved server-side rendering performance for OpenAPI reference pages with heavily reused schemas. - Fixed an issue in OpenAPI docs where request and response samples were empty when a discriminator option's property referenced part of another schema. - Fixed an issue where OpenAPI and AsyncAPI pages crashed when an API description set `x-badges` to a single object instead of a list. The invalid value is ignored and reported in the build log. - Fixed keyboard and screen reader issues in the sidebar, Markdoc tabs, switches, select fields, search, and Replay. For example, the arrow keys switch Markdoc tabs without a mouse click first, and the `Space` key expands sidebar groups and toggles switches. - Fixed an issue where a banner with empty `content` in `redocly.yaml` displayed the text of the `redocly.yaml` file instead of being hidden. - Updated `@redocly/openapi-core` to version `2.73.0`. - Improved keyboard navigation in catalog entity version history. The arrow keys open the version list and move between versions, the `Escape` key closes the list, and the focused version shows a focus ring. - Fixed an issue where the AI assistant chat jumped to the end of the conversation while a response was streaming, even after the user scrolled up to read earlier messages. - Fixed an issue where reaction-specific reasons in page feedback forms did not use the configured labels or components. - Fixed an issue where the `rating` and `sentiment` page feedback forms accepted invalid email addresses without prompting users to correct them. - Improved page feedback forms so that screen readers announce the comment and email fields with their labels. - Fixed an issue where the `mood` page feedback form did not show its reaction-specific default comment label when `comment` was not configured. - Fixed an issue where the `sentiment` and `mood` page feedback forms sent the reasons a user selected for one reaction after they switched to another reaction. - Fixed the **Cancel** button in the `scale` page feedback form so it uses the same translation key as other feedback forms. If you translated `feedback.settings.comment.cancel` for this button, move that translation to `feedback.cancel`. - Fixed an issue where the top items of the page table of contents were hidden under the navbar when a banner was displayed. - Fixed security vulnerabilities `GHSA-cg2g-xh64-v4q7`, `GHSA-mrv2-3pqr-j5jr` and `GHSA-c6gr-qvv4-5v3f` by upgrading `dompurify` to version `3.4.17`. - Fixed an issue where the Docs MCP setup snippets gave every site without `mcp.name` the same server name, which caused a name conflict in the MCP client when users connected more than one site. If `mcp.name` is not set, the server name is based on the site's domain. - Fixed a security vulnerability that could allow a request to the Docs MCP server to consume excessive memory. - Fixed security vulnerabilities `GHSA-jm63-cq47-j5jp`, `GHSA-46jr-4wx8-v453` and `GHSA-rvq5-wwqv-78pq` by upgrading `@modelcontextprotocol/server` to version `2.3.1`. - Extended how long MCP clients stay signed in to the authenticated Docs MCP server from 24 hours to 30 days when the identity provider issues refresh tokens. Without refresh tokens, sessions still expire after 24 hours. - Fixed security vulnerability `GHSA-g3hv-75wg-m249` by upgrading `minimatch` to version `11.0.3`. - Fixed an issue where the mock server returned values from earlier requests in later responses. - Fixed an issue where the mock server returned a 500 error for requests with a JSON body when the operation declared its response with the `*/*` media type. - Improved how fast the mobile menu, search, and other dialogs open on touch devices. - Fixed an issue where OIDC login failed with a misleading `400 Invalid JSON` error when the identity provider returned an error status or a non-JSON response, such as an "Access Denied" page from a firewall. The login returns a `502 Bad Gateway` error, and the server logs show the identity provider host and the HTTP status of its response. - Fixed an issue where pages translated with the browser translation feature, such as API docs pages, displayed an error. - Fixed an issue where the `connect-mcp` Markdoc tag displayed a connect button on sites that don't serve an MCP server. - Fixed raw HTML in Markdown pages and API descriptions: boolean attributes such as `
` take effect, and `style` values that contain semicolons, such as data URLs, are kept. - Fixed an issue in the **Try it** console in OpenAPI docs where the **History** tab listed requests by path instead of operation name. - Fixed an issue in the **Try it** console where the edited request body was replaced with the documented example when the content type changed. For example, when users switched from JSON to XML and back. - Fixed an issue in the **Try it** request body editor where valid values were flagged as not divisible when the schema's `multipleOf` was a decimal such as `0.01`. - Fixed an issue that prevented **Try it** from sending requests and caused the **Security** tab to crash when an OAuth2 security scheme had no `flows` in the API description. - Fixed parameter checkboxes in the **Try it** console and Replay so that the keyboard focus is visible. - Fixed an issue where the **Try it** console and Replay displayed wrong values or did not load when a server, environment, or parameter had a name such as `constructor` or `toString`. - Fixed an issue that caused array and object query parameters in the **Try it** console to ignore `style` and `explode` settings. - Fixed an issue where the project's `@theme` styles and theme overrides did not load when `@redocly/theme` was installed inside the product package instead of the project root. - Improved page load performance so that pages respond to clicks and taps sooner. The search dialog loads in the background after the page loads, and the code snippet report form loads the first time a user opens it. - Fixed keyboard access in select fields: the arrow keys move through the options, `Escape` closes the list, and a click in a searchable select field lets users type a search right away. - Fixed an issue where Visual review in Reunite showed a sign-in redirect loop for login-protected projects in browsers that block third-party cookies, such as Safari, Firefox, and Brave. - Improved the security of the Reunite Visual review sign-in for login-protected projects: Reunite no longer passes the session token in the URL. - Fixed the AI assistant status lines, such as "Searching documentation..." and "Ran code", that stayed in English on localized sites. - Improved how fast the **Try it** console opens in API docs, especially for operations with many request fields. - Fixed security vulnerability `GHSA-mrhx-c7xc-m3w5` by upgrading `zod` to version `4.6.6`. ## Previous releases ## Platformv2026-11-06.62026-11-06 ### Fixes - Fixed the "Last updated" date on pages of Framework projects that Reunite builds. - Updated `@redocly/cli` and `@redocly/openapi-core` to version `2.75.0`. - Updated `@redocly/openapi-core` to version `2.75.0`. - Fixed the Contact support buttons on the deployment summary and publish pages in Reunite to open the AI assistant when the AI assistant is enabled, the same way the Contact support menu item does. Front chat opens otherwise. - Fixed Reunite lists restoring cleared filters or removed sorting after reload. Default filters and sorting no longer override URL state, and project menu links include only explicitly selected filters. - Fixed continuous data reloading on the Feedback list and project analytics pages in Platform when the selected date range ended today. ## Platformv2026-11-06.22026-11-06 ### Fixes - Fixed the editor hanging and disconnecting in projects with very large file trees. - Fixed an issue where the Reunite editor sometimes switched to the default branch and showed a "Branch was not found" warning after you renamed the current branch. - Fixed an issue where builds from the previous repository remained available after switching a project to another repository, except for the live production build. - Fixed incorrect sorting on project analytics details pages and in Reunite feedback exports. - Fixed the Redeploy action on the Platform Deployments page, which sometimes stayed on the list instead of opening the new deployment. - Fixed Reunite browser tab titles that displayed hyphens from page URLs. ## Platformv2026-11-06.12026-11-06 ### Features - Improved Analytics date filters with preset ranges from the last 24 hours to the last 90 days and custom date ranges. - Improved tables on the Analytics details pages with rows that load as you scroll and headers that stay visible. - Added the `mcp.name`, `mcp.ignore`, and `mcp.publicEndpoint` options to the Redocly platform config editor and marked the `mcp.docs` options as deprecated. ### Fixes - Fixed `redocly push --wait-for-deployment` reporting success when the link checker or scorecard blocked the publish, or when the production deployment failed or did not run. - Fixed Slack notifications in Reunite showing a server error when the chosen channel couldn't be used or the Redocly app was removed from Slack. Reunite shows a clear message instead. ## Platformv2026-11-05.32026-11-05 ### Fixes - Fixed an issue where the **Internal Comment** field on the Reunite feedback details page listed invalid reasons for marking feedback as spam. - Fixed the Platform editor preview for Realm Plus projects that pin `@redocly/realm-plus` in `package.json`. The preview showed a `Could not resolve "virtual:realm-runtime"` error. - Fixed an issue that prevented the Reunite project analytics dashboard from loading when its date range was cleared. Date ranges can no longer be cleared; select another range to change the selected period. - Fixed an issue where Reunite lists opened from links with partial filters, such as Feedback, initially displayed results without the default filters. - Fixed an issue that prevented Reunite project analytics and other lists from opening when a link contained a malformed date range filter. The filter now falls back to its default. - Fixed Respect Monitoring run details opened from a deployment or a pull request check: an expired run shows the retention notice instead of an empty error, and a run stopped by the global timeout shows the timeout error. ## Platformv2026-11-04.22026-11-04 ### Fixes - Updated `@redocly/cli` and `@redocly/openapi-core` to version `2.73.0`. - Fixed the empty "Access denied" page shown for a deleted project preview. The preview URL shows a "Preview not found" page with a link to the production site. - Fixed an issue where a remote content update could not reopen its closed pull request in the Platform after the pull request branch was deleted. The branch is restored and the pull request opens again. - Fixed an issue where the Reunite editor rejected new files with uppercase extensions, such as `README.MD`, and did not display or insert images such as `LOGO.PNG` as images. - Improved Markdown rendering in Reunite announcements, custom login and registration terms, and incident banners with GitHub-style formatting and alerts. Links in pull request comments and Agent run summaries open in a new tab. - Updated `@redocly/openapi-core` to version `2.73.0`. ## Platformv2026-11-04.12026-11-04 ### Fixes - Fixed a 1.5-second delay when loading the next page of branches in the Reunite project logs and Git settings branch pickers. - Fixed the colors of the Slack channel picker's arrow and selected channel in Reunite dark mode. - Fixed an issue where the Slack channel picker in Reunite notification settings showed a spinner indefinitely when a search returned no channels. It now shows an empty state. ## Platformv2026-11-03.52026-11-03 ### Fixes - Fixed an issue that caused an idle Webview to reload every few minutes. - Fixed an issue that caused Reunite lists, including Respect Monitoring workflows and Git providers, to fail when opened with an unsupported sort column in the URL. - Fixed sign-in from the Redocly CLI and VS Code extension for users without an organization, so they can continue after creating one. Clarified that creating an organization starts a trial. ## Platformv2026-11-03.42026-11-03 ### Features - Added a link to the changelog in the Reunite notification that announces a new version of the Redocly platform. ## Platformv2026-11-03.32026-11-03 ### Features - Redesigned deployment lint reports to prioritize APIs with results that changed since the previous production deployment and group issues by scorecard level. Added guidance for configuring lint in projects without a lint configuration. ## Platformv2026-11-03.22026-11-03 ### Features - Added the `Format Document` command for YAML files in the Platform editor. ### Fixes - Fixed an issue that caused a stopped Webview to restart while its Reunite tab was in the background. The Webview now restarts when you return to the tab. ## Platformv2026-11-02.62026-11-02 ### Fixes - Fixed an issue where Runtime logs showed logs older than the plan allows. Organizations on a plan with a 30-minute range now get the last 30 minutes, even when a bookmarked link asks for a longer range, and the range selector shows the range that is applied. - Fixed an issue where the Runtime logs API returned only the last 5 minutes for `since=1-month`. - Fixed an issue where the Reunite team page hid existing team managers after the organization moved to a plan without team managers. Owners can also demote those managers on every plan. ## Platformv2026-11-02.52026-11-02 ### Fixes - Fixed an issue where SSO login failed on projects hosted in the EU region unless `access.residency` was set in `redocly.yaml`. Projects on Realm 0.132.0 or later use the login service of the region they are hosted in. - Fixed an issue in Reunite where the organization switcher returned users to their previous organization after they signed in to an organization that requires SSO, instead of opening that organization. ## Platformv2026-11-02.42026-11-02 ### Fixes - Fixed long branch names pushing the `Create pull request` button out of view on the Platform Pull requests page. ## Platformv2026-10-31.12026-10-31 ### Features - Added support for the `platform` option and the `access.rbac.platform` scope in `redocly.yaml`, which replace the deprecated `reunite` option and scope. Projects that use `reunite` continue to work, and the configuration form in the editor offers `platform` to projects on Realm 0.140.0 or later. ### Fixes - Fixed an issue where Reunite date filters with a `0` or longer than 100 years time range, such as `Last 0 days`, failed to load results. - Fixed an issue where the Platform’s **Deployments** page showed a loading indicator instead of the deployment list when returning from a deployment’s details. ## Platformv2026-10-30.42026-10-30 ### Fixes - Aligned Reunite feedback exports with the **List all feedback** API response by adding `object` and `uri`, removing `spamTestedAt`, and matching the CSV column order. ## AI assistant web component1.1.02026-10-30 ### Features - Added the tool calls of an answer to the `onAISearchComplete` callback of the AI assistant. ## Platformv2026-10-30.22026-10-30 ### Fixes - Fixed an issue that could let a sign-in initiated from a portal visit open an organization in Reunite with an authentication method the organization doesn't allow, such as a password when the organization requires SSO. - Fixed an issue where Reunite did not start the trial of an organization whose name or owner's name looks like a payment card number. - Fixed an issue in Reunite where a member demoted to viewer or billing kept their committer linked, so the seat the committer still took did not show under the **Paid seat** filter on the **People** page. Changing a role to viewer or billing unlinks the member's committers, and Reunite also unlinks committers that were already linked to viewer or billing members. - Fixed an issue that caused the Respect Monitoring notification settings dialog in Reunite to close after a save failure, so users can correct settings and try again. - Fixed an issue in Reunite where saving the Respect Monitoring notification settings stored only the changes on the open tab and discarded the changes on the other tabs. - Fixed the message shown after saving Slack notification events without selecting a channel. The message now correctly indicates that Slack notifications were not activated. ## Platformv2026-10-29.32026-10-29 ### Fixes - Fixed an issue where the Platform editor could open a branch at an older commit than the remote after the branch's working copy was recreated. - Fixed the editor incorrectly reporting successful file reverts and branch merges when those operations failed. - Updated `@redocly/cli` and `@redocly/openapi-core` to version `2.72.1`. - Fixed an issue where renaming a Reunite organization to an existing slug returned an internal error instead of indicating that the slug was unavailable. - Changed the rate-limit feedback for sign-in, registration, and password recovery requests to notifications instead of form field errors to match the rest of the Redocly platform. - Fixed the **Docs** tab in the Platform editor, which showed a "Something went missing" page instead of the Redocly documentation. - Removed the **Beta** label from the **Docs** tab in the Platform editor. External links in the tab open in a new browser tab. - Improved login page load times in the Platform. - Improved how fast the Platform opens a project page. - Updated `@redocly/openapi-core` to version `2.72.1`. - Improved Redocly platform page load times. ## Framework0.139.42026-10-29 ### Fixes - Fixed an issue in OpenAPI docs where the page of a schema that other schemas extend through `allOf` never finished rendering when its properties reached schemas that refer back to those extensions. - Fixed an issue in OpenAPI docs where a page never finished rendering when two discriminator schemas listed the same variants and both declared the properties the variants inherit. - Fixed an issue where the Docs MCP server in projects with large configurations used too much memory and responded slowly. ## Platformv2026-10-28.52026-10-28 ### Features - Combined identity-provider-synced and manually managed teams in Reunite’s Teams list, with each team’s source identified. Looking for earlier releases? See the [archived changelog of Reunite, Realm, Redoc, Revel, and Reef](./changelog-realm).