@quobix/vacuum 0.32.0 → 0.33.1

package/README.md

@@ -4,7 +4,7 @@
 </picture>
 
 
-# The world's fastest OpenAPI, AsyncAPI and JSON Schema linter.
+# The world's fastest OpenAPI, AsyncAPI, Arazzo and JSON Schema linter.
 
 ![build](https://github.com/daveshanley/vacuum/workflows/Build/badge.svg)
 [![discord](https://img.shields.io/discord/923258363540815912)](https://discord.gg/UAcUF78MQN)
@@ -13,7 +13,7 @@
 [![Docker Pulls](https://img.shields.io/docker/pulls/dshanley/vacuum?style=flat-square)](https://hub.docker.com/r/dshanley/vacuum)
 [![Mentioned in Awesome Go](https://awesome.re/mentioned-badge-flat.svg)](https://github.com/avelino/awesome-go)
 
-An **ultra-super-fast**, lightweight OpenAPI, AsyncAPI and JSON Schema linter and quality checking tool inspired by [Spectral](https://github.com/stoplightio/spectral).
+An **ultra-super-fast**, lightweight OpenAPI, AsyncAPI, Arazzo and JSON Schema linter and quality checking tool inspired by [Spectral](https://github.com/stoplightio/spectral).
 
 It supports Spectral-style YAML and JSON rulesets. See [Spectral migration](#spectral-migration) for compatibility limits and built-in alternatives.
 
@@ -139,7 +139,25 @@ come say hi!
 
 ## Documentation
 
-🔥 **New in** `v0.29` 🔥: **Lint AsyncAPI 3 documents in vacuum**
+🔥 **New in** `v0.33` 🔥: **Arazzo workflow linting and a new `or` function**
+
+Arazzo 1.0 and 1.1 workflows are now a first-class document type in vacuum, alongside OpenAPI, AsyncAPI and JSON Schema.
+Use `vacuum lint workflows.yaml` and vacuum will detect Arazzo automatically, with recommended rules for workflow structure,
+references, parameters, expressions and linked source documents. Results work in the normal reports, dashboard and editor diagnostics.
+
+The new `or` core function checks that **at least one of two or more properties exists**. Use
+`properties: [title, summary, description]` to require one of those fields. A property counts as present even when its
+value is `null`, `false`, `0` or an empty string.
+
+This release also fixes AsyncAPI header, server and version checks, and improves result locations for YAML aliases and shared references.
+
+- [Read more about Arazzo linting in vacuum](https://quobix.com/vacuum/arazzo/)
+- [See the default Arazzo ruleset](https://quobix.com/vacuum/rulesets/arazzo-recommended/)
+- [Read more about the new `or` function](https://quobix.com/vacuum/functions/core/or/)
+
+---
+
+`v0.29`: **Lint AsyncAPI 3 documents in vacuum**
 
 [AsyncAPI](https://www.asyncapi.com) is now a first-class document type in vacuum, alongside OpenAPI and JSON Schema.
 Use the normal `lint` command and vacuum will detect AsyncAPI 3 documents automatically.
@@ -152,7 +170,7 @@ Use the normal `lint` command and vacuum will detect AsyncAPI 3 documents automa
 
 ---
 
-🔥 **New in** `v0.28` 🔥: **Lint JSON Schema documents in vacuum**
+`v0.28`: **Lint JSON Schema documents in vacuum**
 
 A new `schema` command has been added that opens up vacuum to JSON Schema specific linting rules and checks! 
 With a whole new set of functions and rules, specifically for JSON Schema documents. 
@@ -269,6 +287,27 @@ vs individually.
 
 ### [Quick Start Guide 🚀](https://quobix.com/vacuum/start)
 
+### Bundle AsyncAPI 3
+
+`vacuum bundle` detects AsyncAPI 3 documents and supports inline and composed output:
+
+```bash
+vacuum bundle events.asyncapi.yaml bundled.yaml
+vacuum bundle events.asyncapi.yaml bundled.json --composed --delimiter __
+cat events.asyncapi.yaml | vacuum bundle --stdin --stdout --base ./specs --format json
+```
+
+External objects are inlined by default. Shared schemas are emitted once, with
+local references for later uses. Composed mode stores external objects in AsyncAPI
+component sections. Both modes preserve the local references required by
+operations, messages, channels, and servers. Input-file references resolve from
+the input directory unless `--base` is supplied. Use `--remote=false` to disable
+remote loading; `--ext-refs` opts into resolving references inside extensions.
+Unresolved or ambiguous references return an error without writing an incomplete
+bundle. Schema resource IDs are resolved before relocation. Non-JSON schema
+content is preserved; language-specific imports and dynamic JSON Schema references
+are not bundled.
+
 See all the documentation at https://quobix.com/vacuum
 
 - [Installing vacuum](https://quobix.com/vacuum/installing/)
@@ -286,7 +325,7 @@ See all the documentation at https://quobix.com/vacuum
   - [docs](https://quobix.com/vacuum/commands/docs/)
   - [dashboard](https://quobix.com/vacuum/commands/dashboard/)
   - [html-report](https://quobix.com/vacuum/commands/html-report/)
-  - [bundle](https://quobix.com/vacuum/commands/bundle/)
+  - [bundle](https://quobix.com/vacuum/commands/bundle/) - OpenAPI and AsyncAPI 3, with inline and composed output.
   - [spectral-report](https://quobix.com/vacuum/commands/spectral-report/)
   - [language-server](https://quobix.com/vacuum/commands/language-server/)
   - [upgrade](https://quobix.com/vacuum/commands/upgrade/)
@@ -523,6 +562,30 @@ if you're interested in seeing how things are progressing, it's available.
 ```
 
 ---
+## OWASP hard mode
+
+Run `vacuum lint --hard-mode api.yaml` to enable all built-in OpenAPI rules,
+including the OWASP rules. Hard mode checks:
+
+- OAuth [password](https://quobix.com/vacuum/rules/owasp/owasp-oauth-no-password/)
+  and [implicit](https://quobix.com/vacuum/rules/owasp/owasp-oauth-no-implicit/) flows.
+- [Authentication endpoint URLs](https://quobix.com/vacuum/rules/owasp/owasp-auth-urls-https/)
+  and server URLs for HTTPS, including overrides and server variables.
+- Request objects for unrestricted fields and maps for property-count limits.
+- Write operations for authenticated security requirements, without anonymous alternatives.
+- Declared JWTs for an RFC8725 reference in their description, as a warning.
+
+**Changes for existing users:** strict write security now reports an **error**,
+previously informational. A requirement such as `security: [{auth: []}, {}]` can
+now fail a build. Also, `x-lint-ignore` applies to the entire subtree beneath its
+location for every ruleset, rather than only the node and its immediate children.
+
+See the [OWASP guide](https://quobix.com/vacuum/rulesets/owasp/) for rule details
+and severity overrides, and [ignoring violations](https://quobix.com/vacuum/ignoring/)
+for scoped exceptions.
+
+---
+
 ## Spectral migration
 
 vacuum loads YAML and JSON rulesets. Resolve each relative `extends` path from the
@@ -540,9 +603,10 @@ Use `[vacuum:owasp, all]` for vacuum's built-in OWASP checks instead of importin
 rule names and behavior; they do not execute the Spectral package. JavaScript
 ruleset modules (`.js`, `.mjs`, `.cjs`) are not supported.
 
-Arazzo workflow linting and `spectral:arazzo` are not supported. Remove that entry
-from rulesets used to lint OpenAPI documents. Use an Arazzo-capable linter for
-Arazzo workflow documents.
+Arazzo 1.0 and 1.1 workflows use `vacuum lint workflows.yaml` and the normal
+report commands. `spectral:arazzo` selects Vacuum's native recommended rules.
+See [Arazzo linting](ARAZZO.md) for source lookup, rule IDs, incomplete checks
+and migration differences.
 
 `--functions` takes a directory containing custom function files:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quobix/vacuum",
-  "version": "0.32.0",
+  "version": "0.33.1",
   "description": "The world's fastest, most scalable and complete OpenAPI parser",
   "type": "module",
   "author": "Dave Shanley",