chore: drift command adjustments

[sobanieca-redocly]

What/Why/How?

Fixed loopback address handling so it doesn't trigger false security reports.

Preventing false positives when server returns 4xx response.

Fixed handling of deep objects in params description.

Added possibility to ignore specific headers.

Reference

Testing

Screenshots (optional)

Check yourself

• This PR follows the contributing guide
• All new/updated code is covered by tests
• Core code changed? - Tested with other Redocly products (internal contributions only)
• New package installed? - Tested in different environments (browser/node)
• Documentation update has been considered

Security

• The security impact of the change has been considered
• Code follows company security practices and guidelines

---

Note

Low Risk
Behavior changes only affect experimental drift validation heuristics (fewer findings on 4xx/loopback/deepObject); no auth or production API runtime impact.

Overview
Improves experimental drift / proxy traffic validation by cutting common false positives and adding a way to ignore gateway-injected headers.

schema-consistency no longer runs request-side contract checks (required parameters, required body, request-body schema) when the exchange returned a 4xx; undocumented query params and headers are still reported. It now understands deepObject query parameters (name[prop]=value), matching bracketed keys to the documented parameter and validating the assembled object. Parameter style is loaded from the OpenAPI index to support this.

security-baseline skips “credential exposure over insecure HTTP” warnings for loopback hosts (localhost, *.localhost, 127.0.0.0/8, [::1]).

New --ignore-headers on drift and proxy (comma-separated names; trailing * for prefix, e.g. x-consumer-*) feeds undocumented-header checks via parseHeaderIgnoreList / RuleContext.ignoreHeaders. Docs, changesets, and unit tests for schema and security rules are included.

^{Reviewed by Cursor Bugbot for commit 63f6bb6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sobanieca-redocly]

@cursor review

[changeset-bot]

🦋 Changeset detected

Latest commit: 63f6bb6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/cli	Minor
@redocly/openapi-core	Minor
@redocly/respect-core	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	70.4% (🎯 69%)	7781 / 11051
🔵	Statements	70.1% (🎯 69%)	8097 / 11550
🔵	Functions	74.8% (🎯 73%)	1562 / 2088
🔵	Branches	62% (🎯 61%)	5249 / 8466

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/cli/src/commands/drift/index.ts	0%	0%	0%	0%	36-153
packages/cli/src/commands/drift/engine/runner.ts	0%	0%	0%	0%	15-59
packages/cli/src/commands/drift/engine/validation-session.ts	0%	0%	0%	0%	23-365
packages/cli/src/commands/drift/openapi/loader.ts	0%	0%	0%	0%	31-439
packages/cli/src/commands/drift/rules/builtins/schema.ts	38.46%	27.13%	40%	38.46%	28-224, 234, 242-264, 301, 310-321, 339, 350, 403, 418-449, 459, 477, 508-517, 521-540, 551-572
packages/cli/src/commands/drift/rules/builtins/security.ts	23.48%	17.89%	33.33%	24.03%	29-34, 42-226, 238-282, 288-294, 302-330, 354, 358, 396, 403-422, 426-439
packages/cli/src/commands/drift/utils/http.ts	27.83%	21.42%	35.29%	27.83%	7, 78-199, 208-213, 226-238, 257, 274, 281
packages/cli/src/commands/proxy/index.ts	0%	0%	0%	0%	29-167

Generated in workflow #10734 for commit 63f6bb6 by the Vitest Coverage Report Action

[github-actions]

Performance Benchmark (Lower is Faster)

CLI Version	Bundle	Lint	Check Config
cli-latest	▓ 1.00x ± 0.01	▓ 1.00x (Fastest)	▓ 1.00x (Fastest)
cli-next	▓ 1.00x (Fastest)	▓ 1.00x ± 0.01	▓ 1.00x ± 0.01

[sobanieca-redocly]

@cursor review

[sobanieca-redocly]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0e6452f. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 009c983. Configure here.}