chore: update OpenAPI to 969b92560a70

[ant-release-bot]

Updates cf to openapi@969b92560a70c4dc8c29e88543336ba2a1f9cb38.

• pins OpenAPI revision 969b92560a70c4dc8c29e88543336ba2a1f9cb38
• regenerates the committed command surface with the pinned Forge package

This PR is maintained automatically by the Update OpenAPI workflow.

[pkg-pr-new]

npm i https://pkg.pr.new/cf@373

commit: afc5a9a

[ask-bonk]

LGTM

github run

[github-actions]

cf --help startup

	mean	stddev	min	max
PR	270.2 ms	3.8 ms	265.4 ms	277.6 ms
base	271.6 ms	4.2 ms	266.3 ms	279.7 ms

Δ (PR vs base): ↓ -1.4 ms (-0.5%)

Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.

[clanky-the-clanker]

💬 Approved with comments — This is a clean automated OpenAPI pin bump with regenerated output. There is one WARNING: the changeset does not mention the breaking argument change to managed-defense vulnerability-discovery scans create.

Findings: 1 warning

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

🔧 Fix with your agent

Paste the following into your coding agent to investigate and fix these issues.

Fix the following code review issues found in pull request #373.

Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
  for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

## WARNING (1)

### [Release] The changeset does not mention a breaking change to `managed-defense vulnerability-discovery scans create`: `--repo-hosts` is removed, and `--repos` changes from a repeated string list to a JSON array of objects, so existing invocations will fail. Add the change and how to migrate to the release notes.
- **File:** .changeset/update-openapi-969b92560a70.md:5

---

🚀 Release: ⚠️ 1 warning

The changeset does not mention a breaking change to the arguments of scans create.

Recommendation: 📝 Minor Comments

• [WARNING] The changeset does not mention a breaking change to managed-defense vulnerability-discovery scans create: --repo-hosts is removed, and --repos changes from a repeated string list to a JSON array of objects, so existing invocations will fail. Add the change and how to migrate to the release notes. (.changeset/update-openapi-969b92560a70.md:5)

View full review

Risk: Medium

• The release notes do not mention a breaking CLI argument change. In packages/cli/src/commands/_generated/managed-defense/vulnerability-discovery/scans/create.ts, the regenerated cf managed-defense vulnerability-discovery scans create changes two arguments:

  • It removes the --repo-hosts flag.
  • It changes --repos from a repeated list of strings (array: true) to a single JSON array of objects (or @file.json), parsed with parseObjectArray.

  Scripts that pass --repo-hosts, or --repos a b, will now fail when yargs parses the arguments (under strict()) or when --repos is parsed as JSON. The minor bump is right for a pre-1.0 behaviour change. However, .changeset/update-openapi-969b92560a70.md only says the generated command surface was updated. Consider naming the removed flag, the new --repos input format and how to migrate, so users see it in the release notes. The changeset could also mention the new repositories create-token command.

The changeset is otherwise well formed: the cf: minor frontmatter matches what the repository asks of OpenAPI update PRs.

---

✅ All other checks passed

🔒 Security: ✅ LGTM

The new create-token command sends no request body, URL-encodes the repo-id path parameter and writes the returned token only to stdout. Its telemetry classification lists only the dry-run flag, so no user input is sent to telemetry.

---

📖 AGENTS.md: ✅ LGTM

This pull request does not change any agent guidance. An automated OpenAPI refresh needs no new guidance.

---

📋 Code Quality: ✅ LGTM

The generated output is consistent with the pinned OpenAPI revision. The new repositories create-token command, its operation module and the index registration follow the existing generated patterns. In scans create, the switch to parseObjectArray for --repos is wired the same way in both the dry-run path and the request path.

---

⚡ Performance: ✅ LGTM

This regenerates the command surface and touches no performance-sensitive code. The new command is registered inside the existing lazily loaded managed-defense root.

---

📝 Documentation: ✅ LGTM

No documentation issues in the changed files.

---

_{Reviewed commit: afc5a9a8}

[ask-bonk]

cf managed-defense vulnerability-discovery scans create no longer accepts --repo-hosts, and --repos is no longer repeatable strings: it now requires one JSON array of repository objects (or @file). This is a script-breaking API change, but the changeset only identifies the upstream SHA. Please include the migration in the release note.

Suggested change

	Update the generated command surface for Forge OpenAPI release
	`8b31c6ca7b906789504b8f72e3978480f04cfc93`.
	Update the generated command surface for Forge OpenAPI release `969b92560a70c4dc8c29e88543336ba2a1f9cb38`.
	`cf managed-defense vulnerability-discovery scans create` now requires `--repos` as a JSON array of repository objects (or `@file`); the previous repeatable string form and `--repo-hosts` are no longer accepted.

[ask-bonk]

Review: 1 findings.

Posted 1 inline suggestion.

github run

[ask-bonk]

🤖 I've done a thorough review of your PR.

Updates the pinned OpenAPI revision and regenerates the command surface.

1. Warning: The scan-create breaking flag migration is omitted from the changeset. Updated the existing suggestion comment.

github run