• feat: Prefer direct object properties over nested properties in storedValuePriority
• fix: Guard non-map modelName property in transformInJson and fallback to valid CLI server URL
• feat: Add SmallNegativeAndInt32BoundaryFieldsFuzzer, QueryObjectAsRequestBodyFuzzer, and fallback 2XX baselines
• feat: Add AlternativeDateTimeFormatsFieldsFuzzer and NullElementsInArrayFieldsFuzzer
• feat: Include RemoveFields in crash profile for multi-field resource seeding
• feat: Extend DescriptionGenerator to body fields and lazily initialize CatsRandom
• fix: Avoid using self-identity GET resources as targets for destructive PUT/DELETE path parameters
• fix: Preserve oneOf/anyOf array combinations and require envelope siblings for wrapper identifiers
• feat: Fix type-coercion profile fuzzer names and add coverage and crash profiles
• fix: Skip binary octet-stream endpoints during collection GET preseeding
• feat: Allow combining explicitly supplied special fuzzers with seed fuzzers
• feat: Add boundary, type-confusion, and crash mutators with multi-field random fuzzing
• feat: Improve address generation, array item uniqueness, and scalar/map resource correlation
• feat: Enhance operation dependency ordering and runtime resource correlation
• feat: Negotiate declared 2xx Accept media types and skip schema validation when --ib is enabled
• feat: Support x-extensible-enum, paired numeric bounds, and timestamp/hex-address formats
• fix: Cap unbounded maxLength in case-expanding fuzzers and string generator
• feat: Cross-bind hierarchical path parameters from leaf to parent in RuntimeResourcePool
• fix: Include uuid and guid in own POST identifier exclusion
• fix: Use BigInteger when generating numeric IDOR alternatives
• fix: Scope deleted resource baseline eviction to identifier fields only
• fix: Strip query parameters from observed request URLs in second-phase target resolution
• feat: Support application/x-www-form-urlencoded in RuntimeResourcePool baselines and diagnostics
• feat: Preserve successful baseline elements when array length changes or elements are duplicated
• feat: Use runtime-enriched and alternative pool IDs in InsecureDirectObjectReferencesFuzzer
• fix: Select leaf path resource for header enrichment on nested paths
• feat: Capture nested array child IDs and scope nested object ID aliases
• feat: Infer failing producer operations for unresolved body and query identifiers
• feat: Strip volatile fields recursively and case-insensitively in PutIdempotencyFuzzer
• feat: Support composed schemas and numeric scale equality in UpdateReadConsistencyFuzzer
• fix: Resolve path parameters before request body fields in RuntimeResourcePool
• fix: Match deleted resources across generic and resource-qualified identifier aliases
• feat: Expand generic target identifier aliases with resource-qualified aliases
• fix: Strip server base path and disable param replacement in CheckDeletedResourcesNotAvailableFuzzer
• feat: Use alternative parent IDs from RuntimeResourcePool in CrossParentResourceIsolationFuzzer
• feat: Enrich primitive identifier arrays in RuntimeResourcePool
• feat: Improve OperationDependencyOrder for composed/nested schemas, parameters, and plurals
• fix: Avoid aliasing child response IDs with parent collection names on nested paths
• feat: Support resource ownership via POST 2xx JSON response body IDs when Location is absent
• feat: Seed GET before PUT/PATCH and detect stale ETags across GET and write exchanges
• fix: Extend fix for #213 for schema using same discriminator propery, but different mapping keys
• Fix discriminator values with duplicate oneOf property names
• fix: Fix for #211 - field response path was not properly sanitized
• feat: Add more fuzzers running with state
• feat: Add new fuzzer to check still works after fuzzing
• feat: Make delete run last to maximize success rates
• feat: Improve request correlation to maximize fuzzer coverage
• feat: Add support for text/plain and ndjson
• feat: Enable fuzzing for HEAD and TRACE
• fix: Improve IDOR heuristics
• fix: Improve support for application/json and url form encoded, reject not supported content types
• fix: Improve quality gates parsing and don't default when invalid
• fix: Single parsing instead of double parsing for replay command
• feat: Add arguments and defaults for max timeout and max req size
• feat: Read .env by default and redact secrets by default
• feat: TLS and hostname check are enabled by default and use --insecure to disable
• feat: Introduce proper schema vaidatoin for responses
• feat: resolve variables in functional verify values
• feat: resolve embedded variables in custom body values
• feat: resolve embedded variables in global values
• feat: resolve embedded variables in template headers
• feat: resolve embedded variables in replay headers
• feat: capture functional outputs from response headers
• feat: resolve dynamic variables in query parameters
• refactor: centralize dynamic value resolution
• feat: Allow variable reuse in headers for functional tests
• fix: Fix failure executions cases that might leave state inconsistent
• feat: Add summary of quality gates and stop condition and split response details by tab
• feat: Improve reporting with additional details and stop conditions
• feat: Add runtime correlation details in test details
• fix: Fix serialization for deepObject query params
• feat: Introduce state persitence when receiving 2xx in order to seed data for subsequent requests
• feat: Add 2 new fuzzers for free form arrays
• feat: Add new fuzzer for free form objects
• feat: Add new fuzzer for duplicate array elements in unique arrays
• feat: Add new OnlyRequiredFieldsFuzzer
• fix: Differentiate between required fields from different anyOf/oneOf payloads