diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3930a96..9948507 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.18.0 — 2026-09-29
+
+- **Changed.** Requires `rasuvaeff/openapi-contract` `^0.15` (in place of
+  `^0.13`) so downstream projects can adopt the contract's 0.14/0.15
+  releases (#137): 0.14 keeps a shared component as one resolution per
+  document (the local `{$ref: '#/$defs/…'}` form the generator already
+  unfolds since 0.16.0), 0.15 adds `Contract::validateWebhook()` and per-leaf
+  body diagnostics — verdicts unchanged. No generator change was needed; the
+  one test expectation that moved is the formatter rendering of a body
+  member's `actual` (now printed unless the member path looks like a
+  credential; wholesale `[redacted]` stays for a whole-body violation at
+  `$` and a cookie).
+
 ## 0.17.0 — 2026-09-20
 
 - **Changed.** Requires `rasuvaeff/property-testing-core` `^1.0` — the
diff --git a/README.md b/README.md
index 9399c83..9bb6df2 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@ before it reaches a transport.
 
 - PHP 8.3 – 8.5
 - `ext-mbstring`
-- `rasuvaeff/openapi-contract` ^0.13 and `rasuvaeff/property-testing-core` ^1.0
+- `rasuvaeff/openapi-contract` ^0.15 and `rasuvaeff/property-testing-core` ^1.0
 - `psr/http-message`, `psr/http-factory` and `psr/http-server-handler`
   implementations — a PSR-17 factory materializes requests, and `ContractSuite`
   drives a PSR-15 handler in process
diff --git a/README.ru.md b/README.ru.md
index 66cb5ed..2d97c7d 100644
--- a/README.ru.md
+++ b/README.ru.md
@@ -24,7 +24,7 @@ styles и JSON, form-urlencoded или multipart request body, после чег
 
 - PHP 8.3 – 8.5
 - `ext-mbstring`
-- `rasuvaeff/openapi-contract` ^0.13 и `rasuvaeff/property-testing-core` ^1.0
+- `rasuvaeff/openapi-contract` ^0.15 и `rasuvaeff/property-testing-core` ^1.0
 - реализации `psr/http-message`, `psr/http-factory` и
   `psr/http-server-handler`: PSR-17 factory материализует запросы, а
   `ContractSuite` гоняет PSR-15 handler в процессе
diff --git a/composer.json b/composer.json
index a5c3b14..251c96c 100644
--- a/composer.json
+++ b/composer.json
@@ -26,7 +26,7 @@
         "psr/http-factory": "^1.1",
         "psr/http-message": "^1.1 || ^2.0",
         "psr/http-server-handler": "^1.0",
-        "rasuvaeff/openapi-contract": "^0.13",
+        "rasuvaeff/openapi-contract": "^0.15",
         "rasuvaeff/property-testing-core": "^1.0"
     },
     "require-dev": {
diff --git a/tests/ContractSuiteTest.php b/tests/ContractSuiteTest.php
index 8cf2260..12633ea 100644
--- a/tests/ContractSuiteTest.php
+++ b/tests/ContractSuiteTest.php
@@ -165,7 +165,7 @@ public function checkFailedRendersEveryViolationAndKeepsTheStructuredResult(): v
             '   instancePath: "/name"',
             '   specPointer: "/components/schemas/Pet"',
             '   expected: {"type":"string"}',
-            '   actual: "[redacted]"',   // a body value is redacted wholesale; its member names belong to the application
+            '   actual: null',   // a body member renders its actual since openapi-contract 0.15; wholesale redaction stays for a whole-body violation at "$" and a cookie
             '   message: "bad body"',
         ]));
         Assert::same(strtok($request->getMessage(), "\n"), 'Generated request for operation "pets.get" is invalid before transport');