build(deps-dev): bump the contract-tooling group across 1 directory with 4 updates

[dependabot]

Bumps the contract-tooling group with 4 updates in the / directory: @redocly/cli, ajv, prettier and yaml.

Updates @redocly/cli from 2.2.1 to 2.52.1

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.52.1

Patch Changes

• Updated redoc to the 2.5.4 version to fix accessibility problems in the HTML produced by build-docs. Added the lang attribute to the default build-docs template.

@​redocly/cli@​2.52.0

Minor Changes

• Added agent skills for AI coding assistants: redocly-cli for everyday CLI usage, redocly-lint-rules for writing configurable rules and custom plugins. Install them with npx skills add https://redocly.com.
• Added an experimental inspect-node-types command to navigate the Redocly's node type tree of an API description. inspect-node-types helps pick the correct subject types for a configurable rule or the correct visitor for a custom plugin.
• Added a strategy option to the component-name-unique rule, matching the --component-names-strategy option of the bundle command.
• Added an experimental introspect-mcp command that analyzes a running MCP server and records its tools, prompts, resources, and capabilities. introspect-mcp records its findings in the x-mcp extension of an OpenAPI description.

Patch Changes

• Updated @​redocly/openapi-core to v2.52.0.

@​redocly/cli@​2.51.2

Patch Changes

• Updated fast-uri to the 3.1.7 version to resolve CVE-2026-75931, CVE-2026-75975, CVE-2026-75899, and CVE-2026-76172.
• Fixed drift and coverage failing to match a path template whose segment mixes literal text with parameters, such as /instances/{worldId}:{instanceId}.
• Fixed an issue where Redocly config resolution failed when plugins used ESM syntax.
• Updated @​redocly/openapi-core to v2.51.2.

@​redocly/cli@​2.51.1

Patch Changes

• Fixed an issue where generate-arazzo produced a malformed remote description URL in sourceDescriptions (https:// collapsed to https:/) when --output-file was provided.
• Fixed an issue where $faker.string.email() used without options generated addresses at the undefined.com domain.
• Updated @​redocly/respect-core to v2.51.1.
• Updated @faker-js/faker to the 10.6.0 version to resolve the high severity advisory GHSA-qxc2-j82w-r537.

@​redocly/cli@​2.51.0

Minor Changes

• Enhanced the generate-arazzo command to print a ready-to-run respect command after generation, including an --input placeholder for every workflow input.
• Added --with-ai, --ai-provider, --ai-model, --ai-concurrency, and --max-workflows options to the generate-arazzo command. --with-ai uses a local AI CLI (claude, codex, or cursor) and OpenAPI descriptions to redesign the generated one-workflow-per-operation skeleton into multi-step workflows. The AI designs at most --max-workflows workflows (default 10), and the generated file is marked as AI-inferred. For descriptions that don't fit a single prompt, the AI first selects scenarios from a compact operation index, then it designs each workflow separately.

Patch Changes

• Fixed an issue where respect and the x-security-scheme-required-values rule incorrectly rejected x-security HTTP schemes written with non-lowercase casing (such as Basic, Bearer, or Digest). RFC 7235 scheme names are case-insensitive.

... (truncated)

Commits

• 3fa9963 chore: 🔖 release new versions (#3110)
• e15102c docs: mention the redocly-lint-rules skill (#3102)
• 1fa5819 fix: bump @​redocly/mock-server to 0.11.0-next.2 (#3109)
• 93c155f fix: update redoc to 2.5.4 to resolve accessibility issues in build-docs (#3107)
• 2586b31 chore: 🔖 release new versions (#3094)
• 90bb574 chore: update redocly config to v0.56.0 (#3105)
• af8c9bd feat: add introspect-mcp command (#3101)
• abc3555 feat: add support for the strategy parameter in component-name-unique rule (#...
• b14e21a docs: add info about boolean values should be false (#3103)
• 8447573 chore: update changelog for v1 (#3100)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​redocly/cli since your current version.

Updates ajv from 8.17.1 to 8.20.0

Release notes

Sourced from ajv's releases.

v8.20.0

What's Changed

• fix: add support for node 22/24, drop node 16/21 by @​jasoniangreen in ajv-validator/ajv#2580
• fix: add ES2022.RegExp for RegExpIndicesArray by @​SignpostMarv in ajv-validator/ajv#2604

Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0

v8.19.0

What's Changed

• fix prototype pollution via format keyword using $data ref by @​epoberezkin in ajv-validator/ajv#2607

Full Changelog: ajv-validator/ajv@v8.18.0...v8.19.0

v8.18.0

What's Changed

• feat: allow tree-shaking by adding "sideEffects": false to package.json by @​josdejong in ajv-validator/ajv#2480
• fix: #2482 Infinity and NaN serialise to null by @​jasoniangreen in ajv-validator/ajv#2487
• fix: small grammatical error in managing-schemas.md by @​monteiro-renato in ajv-validator/ajv#2508
• fix: typos in schema-language.md by @​monteiro-renato in ajv-validator/ajv#2507
• fix(pattern): use configured RegExp engine with $data keyword to mitigate ReDoS attacks (CVE-2025-69873) by @​epoberezkin in ajv-validator/ajv#2586

New Contributors

• @​josdejong made their first contribution in ajv-validator/ajv#2480
• @​monteiro-renato made their first contribution in ajv-validator/ajv#2508

Full Changelog: ajv-validator/ajv@v8.17.1...v8.18.0

Commits

• 0fba0b8 8.20.0
• 9caf8d6 fix: add ES2022.RegExp for RegExpIndicesArray; fixes ajv-validator/ajv#2603 (...
• 2065350 fix: add support for node 22/24, drop node 16/21 (#2580)
• 154b58d 8.19.0
• e8d2bdc test/fix prototype pollution via $data ref with format keyword (#2607)
• 142ce84 8.18.0
• 720a23f fix(pattern): use configured RegExp engine with $data keyword to mitigate ReD...
• 82735a1 fix: typos in schema-language.md (#2507)
• b17ec32 fix: small grammatical error in managing-schemas.md (#2508)
• 69568d0 fix: #2482 Infinity and NaN serialise to null (#2487)
• Additional commits viewable in compare view

Updates prettier from 3.6.2 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

3.8.4

• Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (prettier/prettier#17746 by @​byplayer)

🔗 Changelog

3.8.3

• SCSS: Prevent trailing comma in if() function (prettier/prettier#18471 by @​kovsu)

🔗 Changelog

... (truncated)

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

1. Install the plugin:

   yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

• 8f0c950 Release 3.9.6
• e910764 Update changelog
• ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
• 73d2efc Update Yuku parser to v0.7.0 (#19664)
• dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
• c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
• b74dd53 Update Yuku parser to v0.6.5 (#19654)
• f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• 0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
• 3bbb815 Remove typescript-only directory (#19636)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for prettier since your current version.

Updates yaml from 2.8.1 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

v2.8.3

• Add trailingComma ToString option for multiline flow formatting (#670)
• Catch stack overflow during node composition (1e84ebb)

v2.8.2

• Serialize -0 as -0 (#638)
• Do not double newlines for empty map values (#642)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view