chore(deps): update dependency @redocly/cli to v2.33.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@redocly/cli	2.30.4 → 2.33.2

---

Redocly CLI: Path traversal when using split command

CVE-2026-63225 / GHSA-657c-g7qc-r9j2

More information

Details

Impact

An OpenAPI or AsyncAPI description could make the split command write
files outside the chosen output directory, on the machine of anyone who runs
split against it. The write is constrained rather than a free file-write
primitive: component data is emitted only as YAML/JSON, and code-sample files are
named after the HTTP method, so an attacker can place or overwrite files at an
unintended path but has limited control over their name and contents.

Patches

Fixed in @redocly/cli v2.33.2.

Workarounds

Do not run the split command on API descriptions from untrusted or unreviewed sources.

To detect an exploit attempt, inspect the description's component names and
x-codeSamples lang values for a literal ../ — neither legitimately contains
path segments.

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

References

• https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2
• https://nvd.nist.gov/vuln/detail/CVE-2026-63225
• https://github.com/Redocly/redocly-cli/pull/2891
• https://github.com/Redocly/redocly-cli/pull/2923
• https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee
• https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3
• https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17
• https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2
• https://github.com/advisories/GHSA-657c-g7qc-r9j2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

Redocly/redocly-cli (@​redocly/cli)

v2.33.2

Compare Source

Patch Changes

• Fixed a path traversal in the split command that might have written files outside the chosen --outDir.
• Updated @​redocly/openapi-core to v2.33.2.

v2.33.1

Compare Source

Patch Changes

• Updated @​redocly/openapi-core to v2.33.1.

v2.33.0

Compare Source

Minor Changes

• Added the --component-names-strategy option to the bundle command.
  This option allows a choice of how inline Schema components are named: basename (default) or title (from each schema's title field).

Patch Changes

• Updated @​redocly/openapi-core to v2.33.0.

v2.32.2

Compare Source

Patch Changes

• Updated @​redocly/respect-core to v2.32.2.

v2.32.1

Compare Source

Patch Changes

• Updated @​redocly/openapi-core to v2.32.1.

v2.32.0

Compare Source

Minor Changes

• Added support for junit output in the lint command.

Patch Changes

• Updated @​redocly/openapi-core to v2.32.0.

v2.31.6

Compare Source

Patch Changes

• Fixed lint --format=checkstyle to produce a single combined XML document when multiple APIs are passed to the command, instead of concatenated per-file documents.
• Updated redoc to v2.5.3, styled-components to v6.4.2, and react to v19.2.7.
• Updated @​redocly/openapi-core to v2.31.6.

v2.31.5

Compare Source

Patch Changes

• Updated the no-unused-components rule to validate unused security schemes.

• Pinned the official Docker image base to node:24-alpine.

• Fixed the remove-unused-components decorator to remove unused security schemes.

  Warning: The bundler may now remove more unused components than before.

• Updated @​redocly/openapi-core to v2.31.5.

v2.31.4

Compare Source

Patch Changes

• Updated @​redocly/openapi-core to v2.31.4.

v2.31.3

Compare Source

Patch Changes

• Fixed an issue where the Respect command did not honor the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables when loading remote source descriptions or resolving external $refs.
  Proxy settings are consistently applied during reference resolution as well.
• Updated @​redocly/openapi-core to v2.31.3.

v2.31.2

Compare Source

Patch Changes

• Fixed the remove-unused-components decorator to remove unused components containing allOf keyword.

  Warning: The bundler may now remove more unused components than before.

• Fixed the no-unused-components rule to highlight unused schemas containing allOf keyword.

• Updated @​redocly/openapi-core to v2.31.2.

v2.31.1

Compare Source

Patch Changes

• Updated @​redocly/openapi-core to v2.31.1.

v2.31.0

Compare Source

Patch Changes

• Updated @​redocly/openapi-core to v2.31.0.

v2.30.6

Compare Source

Patch Changes

• Fixed hard crash that happened when no API was provided either via the command argument or in the config.
• Updated @​redocly/openapi-core to v2.30.6.

v2.30.5

Compare Source

Patch Changes

• Fixed a status code mismatch that occurred when using the --har-output option in the respect command.
• Updated @​redocly/openapi-core to v2.30.5.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EBADENGINE
npm error engine Unsupported engine
npm error engine Not compatible with your version of node/npm: @adobe/mysticat-shared-seo-client@1.8.0
npm error notsup Not compatible with your version of node/npm: @adobe/mysticat-shared-seo-client@1.8.0
npm error notsup Required: {"node":">=22.0.0 <25.0.0","npm":">=10.9.0 <12.0.0"}
npm error notsup Actual:   {"node":"v24.15.0","npm":"12.0.2"}
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-20T11_40_34_551Z-debug-0.log

[github-actions]

This PR will trigger no release when merged.