schemathesis 4.26.0 on Python PyPI

Negative coverage case that omits a request body the operation declares required.
Apollo Federation subgraph support: _entities and _service stay out unless filters select them.
base_url_mismatch warning when every response is 404 and --url omits the schema's base path.
unresolvable_reference warning listing the parameters and responses skipped over a missing schema component.
Try each user in a WFC auth document, moving on from the ones an operation rejects.
--max-time stops st run after the given number of seconds.
--auth-wfc and --auth-wfc-user for Web Fuzzing Commons auth files.
--report json writes the run's verdict as one JSON document.
Support for state in the ASGI lifespan scope.

Drop starlette-testclient and starlette dependencies.
ASGI application state persists between generated test cases.
ASGI lifespan shutdown runs per pytest test, or at process exit outside pytest.
The operation serving the loaded schema stays out of testing unless filters select it.

~100 ms less overhead in each examples, coverage, and fuzzing phase.
Single event loop shared by ASGI applications, with one lifespan cycle per test.

Incompatibility with anyio 4.15.
HEAD operations failing with an internal AttributeError.
Applications that do not implement the lifespan protocol failing with a TypeError.
Applications that reject the lifespan scope, such as Django, failing with a ValueError.
Requests served after the application reports a failed startup.
Lifespan failures after startup or after shutdown completes going unreported.
Lifespan not started while fetching the schema.
IPv6 and userinfo base URLs rejected.
session passed to case.call() ignored.
Request timeouts ignored, leaving a hung handler unbounded.
Django's ALLOWED_HOSTS rejection reported without an explanation.

authTemplate not merged into each entry when loading auth files.
The first entry not selected when no user is configured, as documented.
Token fetch failures disabling auth for the whole run instead of retrying after a cooldown.
Login endpoints that specify neither token nor expectCookies rejected, ignoring the returned cookies.
Login endpoints that redirect after sign-in rejected, ignoring the cookies they set.

No test cases generated for schemas with not over patternProperties.
No values generated for strings that several patterns must match at once.
Generation failing for an OpenAPI 3.0 pattern that names a capture group.
Empty strings generated for query parameters declaring allowEmptyValue: false. #4574
Boolean and null example values in query and path sent as Python literals, and optional nulls sent instead of omitted.
Delimited query and path array items sent as Python literals instead of true / false / null.
Optional query parameters generated as null sent instead of omitted.
OpenAPI 3.1 contentMediaType: application/octet-stream form fields not sent as file uploads.
Request bodies declared with a media range like application/*+json sent without a concrete Content-Type.
Crash on repeat runs when an operation's request body declares several media types.
GraphQL scalars with no registered strategy misreported in some generation modes.

Emitting objects for allOf requiring a property no branch combination admits.
Treating allOf branches naming integer and number as unsatisfiable.
Emitting valid values as anyOf/oneOf violations for branches with $ref siblings.
Emitting valid values as items violations for arrays declaring prefixItems.
Ignoring prefixItems when building array cases for OpenAPI 3.1 operations.
Dropping a required name properties does not declare from generated array items.
Emitting properties whose names propertyNames rejects.
Emitting a multipleOf value outside the float bound minimum and maximum pin.
Emitting a single-item array that exceeds maxContains.

A path item or responses that is not an object reported as a generic parsing failure.
Header parameters written as a boolean schema crashing data generation.
XML bodies whose schema is written as a boolean crashing serialization.
Malformed servers URL templates crashing instead of reporting a schema error.
$ref values that name no readable file crashing instead of reporting an unresolvable reference.
Response keys that are not status code patterns crashing response matching.
Unresolvable $ref in an optional parameter or required body rejecting the operation.
Unresolvable $ref in a response schema rejecting the operation.
openapi versions with a suffix, such as 3.1.0-custom, rejected.
Non-object vendor extension values inside responses, such as x-note: null, rejected.

ignored_auth for APIs that reject unauthenticated requests with 403.
negative_data_rejection for example header and cookie values.
negative_data_rejection for GraphQL when captured identifiers replaced the violating argument.
negative_data_rejection for GraphQL arguments that declare a default value.
negative_data_rejection for non-numeric query and path parameters whose serialized value is valid. #4600
unsupported_method when a secured operation answers 401 or 403 before routing.

False negative unsupported_method for 404 responses on paths whose parameters are pinned.
Detect ignored_auth bypasses in APIs that accept any well-formed bearer or basic credentials.
Send requests without credentials when security accepts unauthenticated access via {}.
Response schemas validated against undocumented content types.
Write-only property violations in responses reported as {} is not allowed.
Read-only property violations in requests reported as a valid value of its type.
negative_data_rejection message omitting parameter names when several parameters are mutated. #4600
positive_data_acceptance extra-properties hint shown when the server rejects a declared field.
Stateful phase crashing when two links produce the same transition name.
Several boundaries used in the reproduce cURL for multipart request bodies.
Zero scenarios run when st fuzz startup outlasts --max-time.

schemathesis 4.26.0 Release 4.26.0 on Python PyPI