[dependency]: Bump the npm-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the npm-dependencies group with 2 updates in the /openapi directory: @redocly/cli and openapi-to-postmanv2.

Updates @redocly/cli from 2.32.2 to 2.41.0

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.41.0

Minor Changes

• Added a new built-in rule security-scopes-defined that requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme. The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in requireScopes option that requires OAuth2 security requirements to list at least one scope.

Patch Changes

• Fixed an issue in respect where the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed.
• Fixed an issue where the cursor AI provider of the generate-spec command sent only the instructions to the model and the operation to refine never reached it.
• Updated @​redocly/openapi-core to v2.41.0.
• Updated @​redocly/respect-core to v2.41.0.

@​redocly/cli@​2.40.0

Minor Changes

• Added an --ignore-headers option to the experimental drift and proxy commands. It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing * matches by prefix (for example x-consumer-*). Use it to silence headers a gateway or proxy adds that are not part of the API contract.
• Added an experimental generate-spec command that infers an OpenAPI description from recorded HTTP traffic.

Patch Changes

• Fixed the drift command's schema-consistency rule reporting false-positive "Undocumented query parameter" findings for deepObject-style query parameters. Traffic keys like namespace[id]=...&namespace[name]=... are now matched to the documented namespace parameter, and the reconstructed object is validated against the parameter schema.

• Fixed an issue where the drift command's schema-consistency rule reported false-positive request findings for exchanges the server rejected with a 4xx client error. For example: missing required parameter, missing required body, request-body schema mismatch. A 4xx response means the server never accepted the request. Validating it against the operation's success-path contract flagged the server's own correct rejection as drift. Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.

• Fixed an issue where the join command silently dropped path-level x-* extensions with non-string values.

• Updated js-yaml from 4.2.0 to 5.2.1. Fixed an issue where strings that look like numbers with underscores (for example '12_34') had quotation marks removed by the bundle command. These strings stay quoted in the output.

  Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. Parse errors are reported at the offending token instead of the end of the document.

• Fixed an issue where the drift command's security-baseline rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: localhost, *.localhost, 127.0.0.0/8, [::1]. Sandboxed recordings no longer produce transport warnings.

• Fixed an issue where the bundle command rewrote internal $refs pointing to other $refs. The issue caused AsyncAPI 3 operation messages references to point to components instead of channel messages.

• Updated @​redocly/openapi-core to v2.40.0.

@​redocly/cli@​2.39.0

... (truncated)

Commits

• 96c2619 chore: 🔖 release new versions (#2954)
• fba5d04 fix(respect): referenced workflow execution flow inconsistency (#2966)
• dc26151 fix: pipe the whole generate-spec prompt through stdin in the cursor provider...
• 4fe4ecb chore(deps): apply npm audit fix (#2962)
• 129a5a8 chore: add cookbook (#2956)
• bab6a52 chore: apply npm audit fix (#2955)
• 233026f feat: add security-scopes-defined rule (#2951)
• 8678a3a chore: 🔖 release new versions (#2950)
• ee4f14d chore(deps): bump redocly/config version to v0.52.0 (#2952)
• ae86ec8 fix: migrate to js-yaml v5 (#2908)
• Additional commits viewable in compare view

Updates openapi-to-postmanv2 from 6.1.0 to 6.3.1

Changelog

Sourced from openapi-to-postmanv2's changelog.

[v6.3.1] - 2026-07-23

[v6.3.0] - 2026-07-07

[v6.2.0] - 2026-06-29

Commits

• b481d11 Merge pull request #960 from postmanlabs/release/v6.3.1
• cf15b77 Prepare release v6.3.1
• f4b8b56 Merge pull request #959 from postmanlabs/feature/parameter-examples-pairing
• 4b79a73 Refine header merging logic and enhance test fixtures for parameter example s...
• 4f1cb5d Enhance parameter example mapping handling in schemaUtils and response merging
• a3e689c Merge pull request #956 from postmanlabs/release/v6.3.0
• 97eab47 Merge pull request #957 from postmanlabs/release/v6.3.0
• b848e6c Prepare release v6.3.0
• 77124f7 Merge pull request #954 from postmanlabs/feature/deleted-orphaned-req
• 5132cde Add deleteOrphanedRequests option for collection syncing
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.