fix: no-required-schema-properties rule to report when required properties are not defined in all branches

[tatomyr]

What/Why/How?

• Fixed the no-required-schema-properties-undefined rule to report when a required property is not defined in every oneOf/anyOf branch.
• Refactored the no-required-schema-properties rule code to avoid the 'grandparents' concept
• Refactored tests: make the descriptions clearer and removed duplications.

Discovered internally.

Check yourself

• Code changed? - Tested with Redoc/Realm/Reunite (internal)
• All new/updated code is covered by tests
• New package installed? - Tested in different environments (browser/node)
• Documentation update considered

Security

• The security impact of the change has been considered
• Code follows company security practices and guidelines

---

Note

Medium Risk
Updates a core lint rule’s schema-walking logic, which may change reported violations (and potentially introduce false positives/negatives) across OpenAPI/AsyncAPI/Arazzo documents.

Overview
Fixes no-required-schema-properties-undefined so a required property must be present in every anyOf/oneOf branch (while still honoring allOf and $ref chains), using a new hasProperty traversal with cycle protection and a simplified composition-root lookup.

Updates and expands the test suite to cover the new branch-aware behavior, $ref/allOf nesting cases, and adjusts diagnostics (message text from "is undefined" to "is not defined") and expectations accordingly.

^{Reviewed by Cursor Bugbot for commit 9548252. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 9548252

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/openapi-core	Patch
@redocly/cli	Patch
@redocly/respect-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	79.92% (🎯 79%)	6685 / 8364
🔵	Statements	79.35% (🎯 79%)	6916 / 8715
🔵	Functions	83.12% (🎯 82%)	1355 / 1630
🔵	Branches	71.61% (🎯 71%)	4546 / 6348

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/core/src/rules/common/no-required-schema-properties-undefined.ts	97.29%	96.96%	100%	96.87%	59

Generated in workflow #9292 for commit 9548252 by the Vitest Coverage Report Action

[github-actions]

CLI Version	Mean Time ± Std Dev (s)	Relative Performance (Lower is Faster)
cli-latest	3.545s ± 0.048s	▓ 1.00x (Fastest)
cli-next	3.575s ± 0.048s	▓ 1.01x

[tatomyr]

This is the actual test case added.

[tatomyr]

Removed as duplicated.

[tatomyr]

Refactored similarly to the spec-discriminator-defaultMapping rule.

[DmitryAnansky]

Maybe we could make it more readable, like

const { schema, location } = resolved;

const hasDirectProperty =
  schema.properties &&
  getOwn(schema.properties, propertyName) !== undefined;

const checkSome = (schemas?: any[]) =>
  schemas?.some((s) => hasProperty(s, propertyName, visited, location));

const checkEvery = (schemas?: any[]) =>
  schemas?.every((s) => hasProperty(s, propertyName, visited, location));

if (
  hasDirectProperty ||
  checkSome(schema.allOf) ||
  checkEvery(schema.anyOf) ||
  checkEvery(schema.oneOf)
) {
  return true;
}

[DmitryAnansky]

or similar.

[tatomyr]

The point was to eagerly return once we've found the required property, but you're right--it might be not the most readable solution. I'll give it another try.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Shared visited set causes false positives across branches
  • The bug was real and was fixed by cloning the visited set for each anyOf/oneOf branch so shared references no longer poison sibling branch checks.

Or push these changes by commenting:

@cursor push 94022a32f7

Preview (94022a32f7)

diff --git a/packages/core/src/rules/common/__tests__/no-required-schema-properties-undefined.test.ts b/packages/core/src/rules/common/__tests__/no-required-schema-properties-undefined.test.ts
--- a/packages/core/src/rules/common/__tests__/no-required-schema-properties-undefined.test.ts
+++ b/packages/core/src/rules/common/__tests__/no-required-schema-properties-undefined.test.ts
@@ -610,6 +610,51 @@
     expect(replaceSourceWithRef(results)).toMatchInlineSnapshot(`[]`);
   });
 
+  it('should NOT report when all anyOf branches share the same referenced property definition', async () => {
+    const document = parseYamlToDocument(
+      outdent`
+          openapi: 3.0.0
+          components:
+            schemas:
+              Base:
+                type: object
+                properties:
+                  name:
+                    type: string
+              BranchA:
+                allOf:
+                  - $ref: '#/components/schemas/Base'
+                  - type: object
+                    properties:
+                      huntingSkill:
+                        type: string
+              BranchB:
+                allOf:
+                  - $ref: '#/components/schemas/Base'
+                  - type: object
+                    properties:
+                      curiosityLevel:
+                        type: number
+              Cat:
+                type: object
+                anyOf:
+                  - $ref: '#/components/schemas/BranchA'
+                  - $ref: '#/components/schemas/BranchB'
+                required:
+                  - name
+        `,
+      'foobar.yaml'
+    );
+
+    const results = await lintDocument({
+      externalRefResolver: new BaseResolver(),
+      document,
+      config: await createConfig({ rules: { 'no-required-schema-properties-undefined': 'error' } }),
+    });
+
+    expect(replaceSourceWithRef(results)).toMatchInlineSnapshot(`[]`);
+  });
+
   it('should report when required properties are not declared in all anyOf branches', async () => {
     const document = parseYamlToDocument(
       outdent`

diff --git a/packages/core/src/rules/common/no-required-schema-properties-undefined.ts b/packages/core/src/rules/common/no-required-schema-properties-undefined.ts
--- a/packages/core/src/rules/common/no-required-schema-properties-undefined.ts
+++ b/packages/core/src/rules/common/no-required-schema-properties-undefined.ts
@@ -44,10 +44,12 @@
           }
 
           const check = (s: AnySchema) => hasProperty(s, propertyName, visited, resolved.location);
+          const checkEvery = (s: AnySchema) =>
+            hasProperty(s, propertyName, new Set(visited), resolved.location);
 
           if (resolved.schema.allOf?.some(check)) return true;
-          if (resolved.schema.anyOf?.every(check)) return true;
-          if (resolved.schema.oneOf?.every(check)) return true;
+          if (resolved.schema.anyOf?.every(checkEvery)) return true;
+          if (resolved.schema.oneOf?.every(checkEvery)) return true;
 
           return false;
         };

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 70ce84a. Configure here.}