chore(deps): update dependency pipx:schemathesis to v4.19.0

[renovate-iws]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
pipx:schemathesis (changelog)	4.1.3 → 4.19.0

---

Release Notes

schemathesis/schemathesis (pipx:schemathesis)

v4.19.0

Compare Source

🚀 Added

• Stateful tests damp reuse of extracted values from unreliable API links.
• Reuse response field values across operations without an inferred producer-consumer link.
• Persist error-feedback, auth, and 405 discoveries to .schemathesis/; probing replays them to skip rediscovery.
• Fuzz dictionaries: sample curated values during generation via [dictionaries.<name>] and [generation.dictionaries]. #​2121
• Override body fields via [parameters] with body.<jsonpath> keys.

🏎️ Performance

• Bound hypothesis-jsonschema caches; ~35% lower coverage-phase peak memory on long-running schemas.
• Cache schema generation across operations during the coverage phase.

🐛 Fixed

• Schema loading crash for external $ref paths containing URI-reserved characters (e.g. paths/{id}/op.yaml). #​4152
• Out-of-memory in coverage phase on wide, deeply-nested OpenAPI schemas (e.g. AWS Glue, Microsoft Graph).
• Surface a clean schema error for body $ref strings without a / separator.
• Crash when --report-allure-path (or reports.allure.path) cannot be used as a filesystem path.
• RecursionError in coverage phase on multi-branch allOf schemas that canonicalish cannot simplify.
• Restore stateful chain coverage for foreign-key consumers whose target resource is produced by another operation.
• Serialize Swagger 2.0 nested array-of-array query parameters using each level's collectionFormat.
• Emit empty-array negatives for minItems: 1 arrays when items is unsatisfiable.
• Emit string-too-long negatives for maxLength thresholds between 32 KB and 1 MB.
• Emit null variants for optional-nullable properties absent from the body template.
• Cover properties inherited via allOf when a sibling property uses a bundled $ref.
• Emit maxItems negatives for uniqueItems: true arrays whose items.enum domain is exhausted.
• Constrain Swagger 2.0 array query parameters with top-level enum to that domain via items.enum.
• Cover sibling properties when one optional property has a self-contradicting schema.
• Cover array properties when items is declared without type: array.
• Emit maxLength negatives even when the schema's pattern is intrinsically unsatisfiable.
• Emit pattern negatives for header and cookie parameters.
• Runtime Error in negative generation for FastAPI Optional[Enum] query parameters (anyOf with $ref and sibling enum).
• Serialize nested-object multipart form-data parts as JSON instead of Python repr.
• False positive positive_data_acceptance for body schemas with additionalProperties: false inherited via allOf.
• False positive positive_data_acceptance for maxItems: 0 arrays whose items schema is satisfiable.
• False positive positive_data_acceptance for not clauses whose violations breach other outer constraints.
• False positive positive_data_acceptance when a discriminator branch references a polymorphic schema.
• False positive positive_data_acceptance when sibling oneOf/anyOf constraints reference bundled $ref schemas.

v4.18.5

Compare Source

🔧 Changed

• Render negative_data_rejection mutation descriptions cleanly: no trailing at, readable original values.

🐛 Fixed

• Runtime Error on hook-driven revalidation of OpenAPI 3.1 parameters with prefixItems. #​4099
• False positive negative_data_rejection when a before_call hook reassigns request parameters. #​4101
• Pad negative-mode arrays to satisfy minItems so per-item violations fire instead of length violations.
• Send formData Swagger 2.0 parameters as form payloads when consumes only declares non-form media types.
• Generate positive body cases for schemas inheriting additionalProperties: false through deep allOf chains.
• Missing sqlite-libs in docker images.
• Emit non-empty XML element values for string fields so server-side keywords reach coverage.
• Cover each discriminator branch when the type tag literal differs from the schema name.

v4.18.4

Compare Source

🐛 Fixed

• Serialize nested-object query parameters using recursive bracket notation.
• Detect Tomcat strict-decoder rejection when the response carries the default HTML error page.
• Cover both branches of non-body oneOf: [array, string] parameters by forcing non-empty strings.
• Pin Content-Type to the body media type when it is declared as an explicit header parameter.
• Crash in coverage phase on schemas with property names pattern/minLength/maxLength (e.g. Kubernetes CRDs).
• Crash in fuzzing phase on negative mutations of bundled $ref schemas carrying sibling validation keywords.
• Generate a positive coverage case for additionalProperties: {schema} on objects without explicit type: object.
• Emit a populated positive baseline for type: array parameters so item-level keywords reach coverage.
• Drop wildcard */* from Swagger 2.0 consumes so coverage requests carry a concrete Content-Type.
• Treat 409 Conflict as a valid rejection status for negative_data_rejection.
• Retry slow schema endpoints (read timeouts) under --wait-for-schema. #​4058
• False positive negative_data_rejection on query-level additionalProperties mutations. #​3730
• Resolve bundled $ref in positive_data_acceptance hint to avoid false "additional properties" suggestions.
• Generate positive body cases for schemas combining allOf with readOnly required properties.
• Emit a unique-array case alongside the duplicate for scalar parameters declaring uniqueItems.

v4.18.3

Compare Source

🐛 Fixed

• Crash in coverage phase on multipart bodies whose schemas reference each other.
• Crash in coverage phase on application/x-www-form-urlencoded bodies declared as top-level arrays or scalars.
• Substitute path templates whose placeholder names contain dots or other non-identifier characters.
• Crash in fuzzing phase when multi-target negative mutations cleared a shared $ref body before required-path propagation.
• Keep producer operations as stateful roots when their request body carries a self-referential id field.

v4.18.2

Compare Source

🚀 Added

• Probe for strict URL decoders (Tomcat, common WAFs) and sanitize backslash/control chars from generated path strings when the server rejects them.

🐛 Fixed

• Skip stateful root rules for operations whose inputs reference producer-supplied resource fields.
• Accept skewed length distributions across sibling quantifiers when rewriting pattern against maxLength.
• Drop spec example/examples/default values that cannot be validated against the schema in positive coverage.
• Honour per-operation phases.stateful.enabled = false in the state machine.
• Treat field-level body must not be blank feedback as a body-required signal so generation stops emitting empty bodies.
• Recognise content as a single-property response wrapper during dependency inference.
• Skip use_after_free false positives when the DELETE itself returned a non-2xx status (server crash or 404).
• Propagate error-feedback observations on first occurrence so coverage reacts to examples-phase 4xx evidence immediately.

🏎️ Performance

• Faster coverage-phase generation for formats the active JSON Schema draft does not validate.

v4.18.1

Compare Source

🔧 Changed

• Seed strategy draws in add_single_example unconditionally so example generation is deterministic.
• Recognize application/jwt, text/json, application/x-json as JSON media types.
• Sort failures alphabetically by operation label for stable output ordering.

🐛 Fixed

• Cover each discriminator-pinned oneOf branch when the branch is a $ref with sibling pin keywords.
• Honour example/examples/default on array items so curated values reach populated arrays instead of synthetic empty fills.
• Recover spec-declared example/examples/default values that carry readOnly-stripped properties by dropping those keys before validating.
• Cover numeric oneOf/anyOf branches when spec examples only match a sibling branch.
• Skip type-violation negatives for multipart/form-data string properties — stringification makes them wire-indistinguishable from enum violations.
• Honour if/then/else constraints in positive and negative coverage.
• Generate type-violation negatives for properties combining type and enum when canonicalization drops the explicit type.
• Drop sibling keys alongside $ref in OpenAPI 3.0 / Swagger 2.0 schemas.
• Respect maxProperties in positive coverage cases for additionalProperties schemas.
• Preserve required for allOf schemas combined with nullable $ref.
• Filter spec-provided examples and defaults when the schema uses Draft-4-only constructs.
• Drop positive coverage bodies that violate sibling anyOf/oneOf constraints.
• Emit empty-array minItems negatives for array schemas that also declare examples/example/default.
• Cover maxLength/minLength boundary strings for nullable string schemas (type: ["string", "null"]).
• Cover each items branch in positive coverage when the array has size constraints.
• Drop duplicate object bodies in positive coverage when scenarios collapse to the same value.
• Skip multipart/form-data property mutations whose stringified value still satisfies the schema.
• Cover falsy default and example spec hints (0, "", false, [], {}) in positive coverage.
• Surface per-property example/default into recursively-generated object templates instead of synthesising values that ignore them.
• Cover the numeric branch of type: ["string", "number", ...] schemas in positive coverage.
• Cover positive parameter values (e.g. enum query params) when the body is unsatisfiable.
• Negative coverage for propertyNames: emit objects with keys violating the sub-schema constraints.

v4.18.0

Compare Source

🚀 Added

Resource pool & captured IDs

• Capture identifiers from {<id>: <object>, ...} map-by-id GET responses (e.g. team / pod / cluster status maps).
• Capture every element of list-shaped responses into the pool, not just the first.
• Capture pool entries from custom wrappers, nested envelopes, and multi-array-root GET responses.
• Apply pool overlay to foreign-key fields nested inside request body objects.

Error feedback (4xx parsers)

• Refine generation from 4xx errors (Spring, Pydantic, DRF, Rails, Laravel, ASP.NET, Symfony, Zod, AJV, go-validator, Confluent, marshmallow, Flask-RESTful, Flask-RESTX, Litestar).

Adaptive operation handling

• Detect runtime auth requirements from 401/403 responses on operations the spec declares public.
• Skip operations that consistently return 405 Method Not Allowed and surface a method_not_allowed warning.

GraphQL

• GraphQL fuzzing: dispatch producer mutations first and reuse captured identifiers across test cases.
• GraphQL stateful phase: chained operation scenarios.

Configuration

• extra-data-sources config for the examples and coverage phases. #​3972
• Document the JSON Schema for schemathesis.toml for editor autocompletion. #​3971

🐛 Fixed

Coverage phase

• Skip pattern rewrites that collapse optional variable-length sub-groups to {0}.
• Skip {} as positive coverage body for schemas with minProperties but no required fields.
• Coverage positive cases from oneOf/anyOf branches violating a root-level constraint (e.g. type: object branch under type: array root) were yielded as valid.
• Positive-mode generation collapse for readOnly fields nested in allOf and listed in parent required.
• Honor minimum: 0 / maximum: 0 and Draft 4 boolean exclusiveMinimum / exclusiveMaximum in coverage-phase number generation.
• Positive-mode coverage skipped object schemas with annotations next to unsatisfiable optional properties.
• Skip parameter-mutation coverage cases when no positive body can be generated.
• Coverage near-boundary numbers drift from multipleOf due to IEEE-754 subtraction (e.g. 99999.99 - 0.01).
• Coverage boundary numbers fail validation when both bounds are exclusive (e.g. exclusiveMinimum: 0 + exclusiveMaximum: 1).
• Preserve minLength / maxLength when the pattern rewrite cannot encode them.
• Emit format: uuid negative cases in coverage on OpenAPI 3.0 / Swagger 2.0 schemas.
• Emit minProperties / maxProperties violations for object schemas alongside additionalProperties.

Resource pool & captured IDs

• Mismatched parent/child path parameters in pool draws for hierarchical operations.
• Recognize nested foreign-key body fields independently of the spec's paths ordering.
• Recognize body foreign-key fields nested behind allOf / oneOf / anyOf composition.
• Drop spec examples invalidated by inferred constraints from the example mixer.
• Pick up in-place mutations of bundled $ref targets when generating from cached schemas.
• Pool overlay corrupting nested object siblings during coverage generation.
• Stop re-feeding deleted resource identifiers to subsequent operations.
• False positive positive_data_acceptance when a runtime pool body variant was missing required fields. #​3949

use_after_free check

• False positive use_after_free on a second DELETE - DELETE is idempotent (RFC 7231 §4.3.5).
• False positive use_after_free after a DELETE on a collection path with no path parameters.
• Include the prior DELETE in use_after_free reproduce when it is a sibling step.

Validation false positives

• False positive negative_data_rejection for integer/number query parameters when an array element is a numeric string. #​3931
• False positive negative_data_rejection on 405 responses from routing-level rejection.
• False positive negative_data_rejection for body schemas combining $ref with sibling keywords.
• False positive response_headers_conformance for Swagger 2.0 array headers serialised via collectionFormat.

Reports & output

• JUnit and Allure reports marked all test cases as skipped when a schema had no inline examples, even though Coverage or Fuzzing phases ran successfully afterwards. #​3738
• Preserve trailing test events when producer threads exit at a phase boundary.

Other

• Panic during response validation for schemas with very large {0,N} regex quantifiers (e.g. {0,404600}).
• Runtime Error from invalid Schema Object when every required parameter of a set is excluded from generation.
• Set filename on binary multipart/form-data parts; use encoding.headers.Content-Disposition if present, field name otherwise. #​3951
• Reject . and .. path-parameter values; URL normalisation routes the request to a different operation.

🔧 Changed

Resource & foreign-key recognition

• Recognize more path parameters as resource identifiers.
• Recognize camelCase foreign-key field names (locationId, userUuid, orderId).
• Recognize plural foreign-key array fields (site_ids, userUuids, session_guids).
• Treat _name-suffixed body fields as attributes when no path or schema backs the inferred resource (first_name, last_name).
• Rebind body and query self-FK slots to the path-derived parent when the parent has the same field.
• Prefer same-module variants for spec-suffixed duplicates (Group / Group1, Member / Member1).
• Steer path slots to the same-module resource the operation actually returns when the suffix matcher would pick a cross-module candidate.

Stateful & output

• Tolerate per-operation transport failures in the stateful phase; abort only when several operations fail.
• Group consecutive same-title failures (e.g. multiple schema violations on one response) under a single header with a violation count.

Generation

• Negative-mode fuzzing distributes mutations across all schema depths.

Schema & dependencies

• Remove direct dependency on jsonschema.
• Recognize application/jose+jwe as JSON media type.

🏎️ Performance

• Up to 2x faster schema processing on large specs (Stripe, VMware, OSIsoft) and ~40% faster CLI startup.
• ~75% lower peak memory for large scenarios when writing NDJSON reports.
• Cap shell-escaped values in reproduce-curl commands at 64 KB with an inline truncation marker.
• Avoid unnecessary function digest calculations when Hypothesis database is disabled.

v4.17.0

Compare Source

🚀 Added

• Capture path-parameter values from successful 2xx requests for reuse during fuzzing.
• Capture request-body field values from successful 2xx requests for reuse during fuzzing.
• Coverage phase records request identifiers into the runtime resource pool for reuse in later phases.
• Use identifiers from the runtime resource pool for resource-bound parameters and body fields during the coverage phase.
• Use captured body-field values to fill resource-bound fields in the examples phase.
• Enable the runtime resource pool for producers that return empty response bodies.
• Chain st fuzz scenarios via inferred and schema Links, biased 80% toward link-driven steps.
• Pick correlated identifiers for nested-resource operations during the coverage phase.
• Dependency inference recognizes <resource>Name-style body fields on collection paths (e.g. POST /products {productName: ...}).
• Dependency inference recognizes more identifier-style path parameters (e.g. username, containerGroupName).
• Dependency inference treats POST /resource/{name} as a producer when the response has no body.
• Dependency inference treats POST /collection {idField: ...} as a producer when the response has no body.
• Dependency inference recognizes GET /collection returning an array of identifier strings.
• Dependency inference recognizes plural {ids} path parameters (e.g. GET /persons/{ids}).
• Seed the runtime resource pool with identifier values from a Bearer JWT or HTTP Basic username.

🐛 Fixed

• False positive negative_data_rejection for body-level type mutations on multipart/form-data endpoints. #​3801
• False positive negative_data_rejection for body fields with format: binary or format: byte.
• Crash on schemas with non-schema values inside properties (e.g. an integer where a sub-schema is expected).
• Cascading generation failures after one schema corrupted shared hypothesis-jsonschema constants in the same process.
• Crash on $ref with sibling keywords when exploring the Python API outside the pytest runner.
• HypothesisRefResolutionError when a $ref and its target both have distinct anyOf lists.
• Report malformed sub-schemas (e.g. description: null) as a clean schema error.
• Unsatisfiable for arrays with allOf of multiple contains requiring distinct const values.
• Operation scheduling respects RESTful method priority even when all operations collapse into one layer.
• Draft-03 schemas surface as a clean InvalidSchema instead of a generic InvalidArgument from the strategy generator.
• False InfiniteRecursiveReference on cycles breakable through patternProperties.
• False InfiniteRecursiveReference on cycles breakable through oneOf/anyOf, top-level allOf, or unused definitions.
• False positives from \p{X} Unicode property escapes inside character classes (e.g. [\p{Alnum}_]+).
• Translate POSIX character classes (e.g. [[:alnum:]_]) to Python equivalents instead of misparsing them.
• Silent character-set widening when \p{X} patterns combine with PCRE class-set operators (||, &&) or nested classes.
• Runtime Error in negative generation for OpenAPI 3.1 schemas with prefixItems. #​3842
• Honor discriminator pin in oneOf/anyOf validation under Draft 4 (OpenAPI 2.0/3.0).
• Spurious FlakyStrategyDefinition from st fuzz when the time limit trips mid-scenario.
• Crash in the examples phase when a body example contained format: binary data alongside captured pool values.
• Resource-pool variants for path/query/header parameters skip values that violate the destination schema.
• Bodies missing required fields when a captured value is overlaid on a schema without type: object.
• Boolean path parameters rewritten to integer 1 when the path also contains an integer parameter.
• Examples violating their own schema surfacing as POSITIVE generation cases.
• Duplicate required header entries when a spec parameter and a security scheme share a header name.
• NDJSON reports truncated after the first event from a threaded requests import race in the writer.

🔧 Changed

• Include meta in NDJSON reports.
• Probe each path with undeclared HTTP methods once per path instead of once per declared operation.

v4.16.1

Compare Source

🐛 Fixed

• auth API on LazySchema to match BaseSchema. #​3797

v4.16.0

Compare Source

🚀 Added

• schemathesis.openapi.require_security_scheme() for scoping auth providers to specific OpenAPI security schemes. #​3745

🐛 Fixed

• Query parameters not serialized when style/explode are omitted from the spec, ignoring OpenAPI 3.0 defaults.
• Use the matching registered serializer for multipart fields with encoding.contentType. #​3785
• before_call hook setting a missing required header in the coverage phase had no effect. #​3784
• Request timeouts reported as a check failure when a replay made them flaky.

positive_data_acceptance false positives

• example values violating constraints (examples phase):

  • When an object schema-level example has a property violating a nested format constraint (e.g. date-time without timezone).
  • When a parameter-level example value violates its declared schema type.
  • When a schema-level parameter example violates the parameter's own constraints (e.g. pattern).
  • When a response-derived parameter example violates the parameter's schema constraints.
  • When a response-derived parameter example violates the parameter's format constraint.
  • When a property example violates its field's own type (also applies to the coverage phase).
  • For content-encoded header parameters with object examples.
  • For property examples violating anyOf/oneOf constraints via bundled $refs.
  • For array body properties with minItems > 1 and object items.
  • When assembled body violates the schema (e.g. allOf with additionalProperties: false).
  • When a required property has an unsatisfiable schema.

• Composition (allOf / oneOf / anyOf / $ref) in the coverage phase:

  • For oneOf branches with nested multi-$ref allOf.
  • For oneOf body schemas where generated values satisfy multiple branches simultaneously.
  • For oneOf body schemas where a branch requires fields only defined in the parent schema.
  • When an anyOf branch has const: null but a sibling type constraint excludes null.
  • When a multi-level allOf chain causes required properties from a base schema to be generated as null.
  • For body schemas with $ref + additionalProperties: false and pattern/minLength/maxLength constraints.

• enum vs sibling constraints (coverage phase):

  • For required array properties with an unsatisfiable enum constraint.
  • For body properties where all enum values violate a sibling constraint (e.g. maxLength).
  • When an enum contains values violating the declared type (e.g. YAML-parsed false for type: string).
  • When enum contains values violating the declared type in template body generation.

• Structural required / properties mismatches:

  • When a nested required field is unsatisfiable, making the parent object invalid (coverage phase).
  • When required lists fields absent from properties (examples phase).
  • When a nested object schema has required properties absent from properties (coverage phase).
  • When a property has type: object alongside items (coverage phase).
  • When a property has a boolean false schema (coverage phase).
  • For type: string properties that also declare properties: {} (coverage phase).

• Pattern / keyword combinations (coverage phase):

  • For string parameters with pattern containing alternation inside a quantified group (e.g. ([a-z]|-[a-z])*).
  • For string fields with format: uuid and optional-hyphen pattern.
  • When a schema has pattern alongside a non-string type (e.g. number).
  • When propertyNames restricts object keys and additionalProperties is present. #​3771
  • For body properties with format constraints in negative mode.

negative_data_rejection false positives

• pattern + length-constraint interaction:

  • For string fields with pattern + maxLength where maxLength was silently lost into an unanchored regex quantifier.
  • For string fields where pattern has an inner quantifier (e.g. ^[a-z]([-a-z]*[a-z])?$) and maxLength is present.
  • When a pattern optional group wraps variable-length content and maxLength is present (coverage phase).
  • When pattern with nested quantifiers caused maxLength/minLength to be silently dropped from the schema.
  • For pattern fields ending with \x1c–\x1f control characters (coverage phase).

• Wire-identical type mutations:

  • For application/x-www-form-urlencoded and application/xml body properties where type mutations are wire-identical (e.g. integer stringifies to a valid string).
  • For application/x-www-form-urlencoded body properties whose schema contains $ref to bundled definitions.
  • For application/x-www-form-urlencoded body properties with nested array/object mutations whose serialized form satisfies the schema.

• Schema-shape edge cases (coverage phase):

  • When additionalProperties is a schema object and required has exactly 2 fields.
  • When a schema has 15 or more properties and exactly 2 required fields.
  • For body objects with additionalProperties: {}.
  • For nullable string properties with maxLength, minLength, or format constraints.
  • When a string property has both enum and maxLength/minLength.
  • For body properties with type: integer and inapplicable minLength/maxLength constraints.
  • For multipart/form-data fields with format: binary and nullable: true. #​3777
  • For maxItems array constraints with complex nested item schemas.

Runtime errors in negative_data_rejection

• When a query, header, or cookie parameter pattern produces a large DFA (e.g. \S{1,8192}).
• When a parameter schema has a pattern that jsonschema_rs rejects (e.g. {,3} as an incomplete quantifier).

Crashes

• Crash generating curl command when a negative coverage case has a primitive body (e.g. integer form-urlencoded schema).
• Crash in the coverage phase for application/x-www-form-urlencoded requests with format: binary body fields in negative mode.
• Crash in the examples phase when a property has an unsatisfiable schema (e.g. not: {}).
• Crash when a schema has boolean property keys (YAML artifact from bare on: fields) in the coverage phase.
• Crash in the coverage phase when a body with boolean property keys is serialized for deduplication in negative mode.

Schema-invalid generated bodies (coverage phase)

• Schema-invalid body when required names a property absent from properties in the coverage phase.
• Schema-invalid body when a Swagger 2.0 array parameter has enum at the array level with items also defined in the coverage phase.
• Schema-invalid positive body when a schema combines allOf (with required fields) and outer-level properties in the coverage phase.
• Schema-invalid positive body when a schema property's default or example fails format validation (e.g. "7.00:00:00" for format: duration) in the coverage phase.

v4.15.2

Compare Source

🔧 Changed

• Show compact path for body property violations instead of a verbose chain.

🐛 Fixed

• False positive negative_data_rejection for integer query parameters with type mutations. #​3712
• False positive positive_data_acceptance for arrays with uniqueItems and enum items.

v4.15.1

Compare Source

🐛 Fixed

• False positive negative_data_rejection for type: number body fields in fuzzing. #​3697
• False positive negative_data_rejection for type: integer query parameters mutated to array. #​3697
• Double JSON encoding for content: application/json query parameters in coverage phase. #​3701
• Sibling keywords on $ref properties ignored in examples phase for OAS 3.1 schemas. #​3698
• False positive positive_data_acceptance for headers with RFC 9110 control characters. #​3696
• False positive positive_data_acceptance for path parameters containing null bytes. #​3696
• JUnit XML missing unsupported_method failures from coverage phase. #​3699

v4.15.0

Compare Source

🚀 Added

• st fuzz command for continuous multi-step API fuzzing across operation sequences.
• Structured generation for If-Match, If-None-Match, If-Modified-Since, If-Unmodified-Since, and Range headers.
• Apply filter_case and map_case hooks in the coverage phase. #​3675
• schemathesis.pytest.parametrize() for testing multiple named schemas in a single test function. #​1409
• Validate discriminator property values against known schema mappings in response_schema_conformance. #​1589
• Pin discriminator property to the correct value when generating data for oneOf/anyOf schemas. #​1589

🔧 Changed

• Make --wait-for-schema retry on HTTP 503 responses. #​3672
• Use native subtest status labels without redundant parameter suffixes in the pytest plugin.
• Allow reusing the same test function across multiple schemas via schema.parametrize().
• Report all distinct JSON Schema errors per response in response_schema_conformance and response_headers_conformance. #​1174

🐛 Fixed

• Wrong length constraints for patterns with multi-character repeated groups.

v4.14.3

Compare Source

🐛 Fixed

• deadline=None lost when @settings applied after @lazy_schema.parametrize().
• format: uuid now generates RFC 4122 compliant UUIDs. #​2909

v4.14.2

Compare Source

🐛 Fixed

• AttributeError on DoctestItem when schemathesis plugin is loaded. #​3663
• Make dynamic auth ([auth.dynamic.openapi.<scheme>]) work with WSGI & ASGI transports. #​3664

v4.14.1

Compare Source

🐛 Fixed

• ModuleNotFoundError on xdist session end when the allure extra is not installed.

v4.14.0

Compare Source

🚀 Added

• Allure report integration. #​2756
• Support for recording VCR, HAR, and JUnit XML reports from the pytest plugin via schema.config.reports. #​701
• after_validate hook fires after all checks run on a response, carrying a list of CheckResult objects.
• Examples phase generates optional properties and one disjoint set per oneOf/anyOf branch. #​2371

🐛 Fixed

• format: email fields generating values rejected by jsonschema_rs response validation.
• flatmap_* hooks raising RuntimeError in negative testing mode. #​3652
• allow-extra-parameters = false now also suppresses unexpected properties in request bodies.
• Stateful checks (e.g. use_after_free) not triggering when run via schema.as_state_machine().
• InvalidSchema exceptions displayed an empty message in pytest output.

🔧 Changed

• Suppress HypothesisWarning when overriding built-in string formats via schemathesis.openapi.format(). #​3269

v4.13.0

Compare Source

🚀 Added

• [auth.dynamic.openapi.<scheme>] config block for token fetch authentication that allows for dynamic authentication without writing Python code. #​3620
• Use captured response data in the examples phase. #​638
• --request-retries to retry requests on network failures with exponential back-off.

🔧 Changed

• Strip API version prefixes during dependency inference.
• Do not cross-link same-named resources from different API namespaces in during dependency inference.

🐛 Fixed

• apply_to / skip_for filter sets not updated between hook registrations, causing hooks registered after the first to silently receive the wrong filter set.
• Base URL truncated with an ellipsis in the startup summary on narrow terminals (e.g. CI environments). #​3618
• Generated strings from regex patterns violating minLength/maxLength constraints in the coverage phase when update_quantifier cannot encode length into the pattern.

v4.12.2

Compare Source

🐛 Fixed

• False positive positive_data_acceptance in the coverage phase for path parameters with minLength greater than 1.

v4.12.1

Compare Source

🐛 Fixed

• Malformed request body media types (e.g. application.json instead of application/json) now report a clean "Schema Error" with the location in the schema instead of a raw Python traceback. #​3615

v4.12.0

Compare Source

🚀 Added

• Docker images now ship with TraceCov pre-installed and enabled by default, providing schema coverage reports out of the box.

🐛 Fixed

• False negative missing_required_header during the coverage phase when negative mode was active - the base test case used an invalid body, preventing header validation from being reached.
• False positive negative_data_rejection for path parameters with format: uuid and a pattern constraint in the fuzzing phase captured valid resource IDs are used. #​3603
• False positive positive_data_acceptance when requestBody contains list-style OAS3 Example Objects - the inner value was not extracted, sending {"value": ...} as the body.

v4.11.2

Compare Source

🚀 Added

• positive_data_acceptance failures now include a hint when Hypothesis-generated extra properties are the likely cause of rejection, suggesting additionalProperties: false. #​3583

🐛 Fixed

• Server-Sent Events: Parse retry field as integer.
• ensure_resource_availability no longer fires a false positive when a successful DELETE on the same resource ID exists in a different root's subtree. #​3588

v4.11.1

Compare Source

🚀 Added

• Support filesystem paths for SCHEMATHESIS_HOOKS.

📝 Documentation

• "Triaging Failures" guide.
• "Docker" guide.

🐛 Fixed

• Server-Sent Events: Ignore invalid retry field values.
• Server-Sent Events: Treat empty event fields as message.
• [auth.openapi.*] HTTP Basic authentication now correctly applied when using WSGI or ASGI apps in pytest mode. #​3575
• Misconfigured [auth.openapi.*] scheme names (e.g. typos) now emit a UserWarning in pytest mode, matching the existing CLI behavior. #​3575
• False positive negative_data_rejection for application/xml body string fields in the fuzzing phase due to type mutations producing wire-identical strings (e.g. False -> "False"). #​3525
• Internal ValueError when validating a response containing lone Unicode surrogate characters (e.g. \uDCF3); now reported as a JSON deserialization error since lone surrogates are invalid JSON per RFC 8259.
• False positive negative_data_rejection for format: hostname in OpenAPI 3.0.x during the coverage phase. #​3567
• Schema at path in failure messages showing internal bundled form (e.g. /x-bundled/schema1/...) instead of the original schema path (e.g. /components/schemas/.../).
• Missing positive test data for format: duration during the coverage phase.
• Path generation now keeps explicit user-provided slash values (custom string formats, examples, and overrides) while still rejecting implicit and negative slash mutations to prevent misrouting. #​3571
• Warning count in the final summary line now reflects the number of distinct warning kinds shown, not just missing_auth operations.
• False positive use_after_free when the server reuses freed resource IDs and a re-created resource is accessed in the same scenario. #​3582
• Correctly resolve $ref inside oneOf/anyOf sub-schemas during the coverage phase. #​3584
• pytest.from_fixture().exclude() (and .include()) intermittently failing with "does not match any API operations" on repeated runs when no [[operations]] are configured in schemathesis.toml. #​3572

🔧 Changed

• Set SCHEMATHESIS_HOOKS to /app/hooks.py in Docker images with a stub hooks file to simplify the UX.

v4.11.0

Compare Source

🚀 Added

• OpenAPI 3.2 support for the QUERY HTTP method.
• OpenAPI 3.2 support for in: querystring parameters.
• OpenAPI 3.2 support for Server-Sent Events (text/event-stream) response validation. #​3064

🐛 Fixed

• Legacy Draft 4 exclusive bounds in OpenAPI 3.1 schemas (exclusiveMinimum: true) no longer silently ignored.
• Coverage-phase crash: ValueError: Unsupported type: 'Binary' when a oneOf/anyOf schema has a sub-schema with format: binary array items.
• False positive negative_data_rejection for application/xml bodies in coverage due to type mutations producing wire-identical bytes. #​3525
• False positive negative_data_rejection in fuzzing for integer/number path parameters when string mutations serialize to URL-decoded numeric values (e.g., %2B1 -> +1).
• Schema-invalid positive values in coverage for schemas with anyOf/oneOf and required constraints. #​3520
• missing_required_header now accepts 400, 401, 403, and 422 (in addition to 406) for missing non-Authorization required headers. #​3521
• Coverage path parameter values no longer silently replaced with "value" when a custom format (e.g., ipv4-network) generates strings containing /. #​3527
• Path examples containing / now escaped in examples phase when some path parameters are generated from schema. #​3533
• Unresolvable $refs inside parameter content schemas now reported as schema errors at load time instead of crashing at generation time.
• filter_body and other filter_* hooks now filter values in negative mode.

🚀 Performance

• ~2x faster negative test generation for operations with complex schemas; reference resolution skipped for ref-free schemas and cached for repeated calls.
• Less serialization work during negative test generation.
• Faster serialization via jsonschema_rs.canonical.json.to_string instead of json.dumps(sort_keys=True).
• hypothesis-jsonschema patched to use jsonschema_rs.canonical.json.to_string instead of a custom encoder.
• Cached can_negate results during negative test generation.
• jsonschema-rs upgraded to 0.44.0 with validator_cls_for for draft detection.
• Custom deepclone replaced with jsonschema_rs.canonical.schema.clone.
• Faster patched hypothesis-jsonschema merge path via cached repeated merges and identity-merge skips.
• No template generation in the negative-only coverage phase.
• Cached repeated schema-based value generation in the coverage phase.

🔧 Changed

• Avoid extra transitive dependencies from jsonschema.
• Remove colorama from dependencies.
• Support for pyrate-limiter>=4.0.
• Pytest 9 native subtests; pytest-subtests dependency removed. #​3522

v4.10.2

Compare Source

🐛 Fixed

• Connection failures when using multiple workers on free-threaded Python due to shared requests.Session across threads. #​3507

v4.10.1

Compare Source

🐛 Fixed

• False positive negative_data_rejection for integer/number path parameters in the coverage phase.

v4.10.0

Compare Source

🚀 Added

• Negative testing support for GraphQL schemas. #​2355

🐛 Fixed

• Misleading "Schema Error: Cannot generate test data" when filter_case hook rejects all generated cases. Now reports "Hook Error" with actionable guidance.
• Incorrect HTTP method shown in failure headers during coverage phase. #​3322
• False positive negative_data_rejection failures for format: password and other formats without validation semantics. #​3480

🔧 Changed

• Use jsonschema-rs for data validation instead of jsonschema.
• Docker images now use free-threaded Python 3.14 with GIL disabled (PYTHON_GIL=0), providing up to 65% faster multi-worker execution.

v4.9.5

Compare Source

🐛 Fixed

• Examples phase crashing with RecursionError when multiple allOf items reference the same schema target.
• Coverage phase generating "missing Content-Type header" test with Content-Type header present due to automatic JSON body serialization.

v4.9.4

Compare Source

🚀 Added

• Detect foreign key fields (e.g., customer_id, order_ids) in responses and request bodies to generate additional stateful links.

🐛 Fixed

• map_*, filter_*, and flatmap_* hooks receiving GeneratedValue wrappers instead of raw dict values in negative generation mode. #​3471

v4.9.3

Compare Source

🐛 Fixed

• Coverage phase hanging on endpoints with many optional parameters due to combinatorial explosion. #​3046
• Coverage phase crashing with TypeError when schema contains non-string pattern values (e.g., "pattern": 0.0).

v4.9.2

Compare Source

🐛 Fixed

• Custom media type strategies registered via schemathesis.openapi.media_type() not being applied in the coverage phase when using @schema.parametrize(). #​3345
• positive_data_acceptance failures caused by RFC-invalid control characters in generated headers. Positive mode now generates only valid ASCII headers. #​3462

v4.9.1

Compare Source

🐛 Fixed

• Duplicate entries in required array causing "non-unique elements" schema validation errors. #​3460

v4.9.0

Compare Source

🚀 Added

• OpenAPI 3.2 support.
• Mix schema examples into fuzzing and stateful data generation.
• Syntax-level fuzzing for JSON bodies in negative mode.
• NDJSON report format (--report=ndjson) for exporting all engine events as newline-delimited JSON.
• Capture primitive identifiers from POST/PUT responses returning bare strings or integers.
• Normalize schema names by stripping common suffixes (-Output, -Input, Out, In, DTO).
• Discover sub-resources inside array items (e.g., BackupFile from AllBackups.imports[]).
• Recognize _name and -name parameter suffixes for resource inference (e.g., file_name -> File).
• Match parameters to resources with matching suffixes or prefixes when exact match not found (e.g., file_name -> BackupFile.name, group_slug -> GroupSummary.slug).

🔧 Changed

• Show all affected operations in CLI warnings instead of truncating to 3.
• Deprioritize successfully deleted resources in variant selection to reduce wasted requests on non-existent resources.
• Generate clean HTTP headers (ASCII without control characters) 95% of the time to reduce invalid request errors.

🐛 Fixed

• CLI headers (-H) not being passed to schema loading requests. #​3440
• PCRE Unicode property escapes (\p{L}, \p{N}) in response schemas causing crashes during dependency analysis.
• OpenAPI 3.1 response schemas with conflicting anyOf arrays (e.g., different const values) causing crashes during dependency analysis.
• Negative testing error descriptions displaying internal bundled refs like #/x-bundled/schema1 instead of original refs like #/components/schemas/Item.
• Resource pool lookups failing due to naming mismatch between producer ($ref-based) and consumer (path-based) sides.
• "Path parameter 'X' is not defined" errors when using captured resource values for endpoints with parameters that have no resource requirements.

v4.8.0

Compare Source

🚀 Added

• Automatic success rate targeting to guide test generation toward valid API inputs.
• Translate PCRE Unicode property escapes (\p{L}, \p{N}) to Python regex equivalents.
• Propagate shared path parameters in inferred links for nested resources.
• Fuzzing phase now uses valid resource relationships for nested paths.

🔧 Changed

• Deprioritize null and boolean type mutations for path parameters to improve test budget efficiency.
• Recency-weighted sampling of captured resource IDs to reduce repeated operations on the same resources.
• Bias path parameter integers toward positive values to reduce test budget spent on likely invalid IDs.

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.