2.0.2

[2.0.2] - 2026-09-20

Fixed

• Allow $ref in root-level servers; previously caused Unexpected property: "$ref" and Missing required properties: [protocol].
• Allow $ref in tag entries (root, info, servers, channels, operations); previously caused Unexpected property: "$ref".
• Accept availableScopes inside OAuth2 flows (AsyncAPI 3.0 rename of scopes); previously rejected as unexpected.
• Make scopes optional in OAuth2 flows for 3.0 compatibility; previously required, causing false Missing required properties: [scopes] errors.
• Accept scopes at the oauth2 security-scheme level (valid in AsyncAPI 3.0); previously rejected as unexpected.
• Accept AsyncAPI-native security scheme types (scramSha256, scramSha512, userPassword, X509, symmetricEncryption, asymmetricEncryption, plain, gssapi, httpApiKey); previously caused validation failure for any type outside http, apiKey, oauth2, openIdConnect.
• Fix visitServersV2 in VersionAwareAsyncApiCheck to iterate map-form servers correctly.
• Accept the oneOf wrapper (message: { oneOf: [...] }) on an Operation's message property in AsyncAPI 2.x; previously caused Unexpected property: "oneOf".

What's Changed

• fix: refs and scopes for openapi by @mels-h in #21
• fix: add AsyncAPI 3.0 grammar support for $ref, native security schem… by @mels-h in #22
• fix: accept oneOf wrapper on message for AsyncAPI 2 by @mels-h in #23
• 2.0.2 by @SebastianDT1 in #24

New Contributors

• @SebastianDT1 made their first contribution in #24

Full Changelog: 2.0.1...2.0.2