schemathesis 4.17.0

Release 4.17.0

on Python PyPI

🚀 Added

• Capture path-parameter values from successful 2xx requests for reuse during fuzzing.
• Capture request-body field values from successful 2xx requests for reuse during fuzzing.
• Coverage phase records request identifiers into the runtime resource pool for reuse in later phases.
• Use identifiers from the runtime resource pool for resource-bound parameters and body fields during the coverage phase.
• Use captured body-field values to fill resource-bound fields in the examples phase.
• Enable the runtime resource pool for producers that return empty response bodies.
• Chain st fuzz scenarios via inferred and schema Links, biased 80% toward link-driven steps.
• Pick correlated identifiers for nested-resource operations during the coverage phase.
• Dependency inference recognizes <resource>Name-style body fields on collection paths (e.g. POST /products {productName: ...}).
• Dependency inference recognizes more identifier-style path parameters (e.g. username, containerGroupName).
• Dependency inference treats POST /resource/{name} as a producer when the response has no body.
• Dependency inference treats POST /collection {idField: ...} as a producer when the response has no body.
• Dependency inference recognizes GET /collection returning an array of identifier strings.
• Dependency inference recognizes plural {ids} path parameters (e.g. GET /persons/{ids}).
• Seed the runtime resource pool with identifier values from a Bearer JWT or HTTP Basic username.

🐛 Fixed

• False positive negative_data_rejection for body-level type mutations on multipart/form-data endpoints. #3801
• False positive negative_data_rejection for body fields with format: binary or format: byte.
• Crash on schemas with non-schema values inside properties (e.g. an integer where a sub-schema is expected).
• Cascading generation failures after one schema corrupted shared hypothesis-jsonschema constants in the same process.
• Crash on $ref with sibling keywords when exploring the Python API outside the pytest runner.
• HypothesisRefResolutionError when a $ref and its target both have distinct anyOf lists.
• Report malformed sub-schemas (e.g. description: null) as a clean schema error.
• Unsatisfiable for arrays with allOf of multiple contains requiring distinct const values.
• Operation scheduling respects RESTful method priority even when all operations collapse into one layer.
• Draft-03 schemas surface as a clean InvalidSchema instead of a generic InvalidArgument from the strategy generator.
• False InfiniteRecursiveReference on cycles breakable through patternProperties.
• False InfiniteRecursiveReference on cycles breakable through oneOf/anyOf, top-level allOf, or unused definitions.
• False positives from \p{X} Unicode property escapes inside character classes (e.g. [\p{Alnum}_]+).
• Translate POSIX character classes (e.g. [[:alnum:]_]) to Python equivalents instead of misparsing them.
• Silent character-set widening when \p{X} patterns combine with PCRE class-set operators (||, &&) or nested classes.
• Runtime Error in negative generation for OpenAPI 3.1 schemas with prefixItems. #3842
• Honor discriminator pin in oneOf/anyOf validation under Draft 4 (OpenAPI 2.0/3.0).
• Spurious FlakyStrategyDefinition from st fuzz when the time limit trips mid-scenario.
• Crash in the examples phase when a body example contained format: binary data alongside captured pool values.
• Resource-pool variants for path/query/header parameters skip values that violate the destination schema.
• Bodies missing required fields when a captured value is overlaid on a schema without type: object.
• Boolean path parameters rewritten to integer 1 when the path also contains an integer parameter.
• Examples violating their own schema surfacing as POSITIVE generation cases.
• Duplicate required header entries when a spec parameter and a security scheme share a header name.
• NDJSON reports truncated after the first event from a threaded requests import race in the writer.

🔧 Changed

• Include meta in NDJSON reports.
• Probe each path with undeclared HTTP methods once per path instead of once per declared operation.