fix: Handle emptied unusedComponents

CHANGELOG.md

@@ -1,5 +1,8 @@
 ## unreleased
 
+## [1.32.1] - 2026-05-23
+
+- CLI: Handle emptied unusedComponents (#210)
 
 ## [1.32.0] - 2026-05-23
 

openapi-format.js

@@ -756,7 +756,7 @@ async function openapiFilter(oaObj, options) {
   traverse(jsonObj).forEach(function (node) {
     // Remove unused component
     if (this.path[0] === 'components' && this.level === 3 && stripUnused.length > 0) {
-      if (stripUnused.includes(this.path[1]) && unusedComp[this.path[1]].includes(this.key)) {
+      if (stripUnused.includes(this.path[1]) && (unusedComp[this.path[1]] ?? []).includes(this.key)) {
         // debugFilterStep = 'Filter - Remove unused components'
         this.delete();
         // Trigger recurse

test/openapi-core.test.js

@@ -90,6 +90,30 @@ describe('openapi-format core API', () => {
     expect(resultWithResponses.data.components.schemas).toHaveProperty('Pet');
   });
 
+  it('openapiFilter should not crash when unusedComponents recurses over an empty securitySchemes type', async () => {
+    const doc = {
+      openapi: '3.0.0',
+      info: {title: 'API', version: '1.0.0'},
+      components: {
+        securitySchemes: {
+          MyAuth: {
+            type: 'http',
+            scheme: 'bearer'
+          }
+        }
+      },
+      paths: {}
+    };
+
+    await expect(
+      openapiFilter(doc, {
+        filterSet: {
+          unusedComponents: ['securitySchemes']
+        }
+      })
+    ).resolves.toHaveProperty('data');
+  });
+
   it('openapiChangeCase should apply summary, description and securitySchemes ref casing', async () => {
     const doc = {
       openapi: '3.0.0',