schemathesis 4.26.1

Release 4.26.1

on Python PyPI

🚀 Added

• --origin option that takes scheme, host and port, and appends the schema's own base path.

🐛 Fixed

ASGI applications

• UnicodeDecodeError on non-ASCII response headers.
• Non-ASCII header values delivered with the wrong encoding.
• Generated requests sent with a different Host than the schema fetch.

WSGI applications

• Flask-RESTX error responses such as abort(404) and 405 raised as internal errors.

WFC authentication

• Operations answering 401 never escalating to the next user.
• Expired tokens never refreshed when the auth document lists several users.

Request serialization

• Array and object cookie parameters dropped instead of sent.
• Header and cookie booleans and nulls sent as Python literals instead of true / false / null.
• XML and text/plain body booleans and nulls sent as Python literals instead of true / false / null.

Coverage phase

• Crashing on parameters and bodies whose schema is written as a boolean.
• Generated header value replaced by a security scheme spelling the same header differently.
• Generated header value replaced by a path-level parameter spelling the same header differently.
• Negative cases treating valid query, header and path values as invalid data.
• Positive cases emitted when a required parameter has no satisfiable value.
• Empty string from a path parameter's enum collapsing the URL segment.
• Required headers, query and cookie parameters dropped from negative cases.
• No positive cases generated for allOf of two disjoint contains.
• Unsatisfiable schema error when an allOf branch forbids a required property with false.
• Positive cases sending a Content-Type header value its own schema rejects.

Schema handling

• Malformed operation or responses node crashing operation counting.
• Malformed operation, requestBody, content, media type, or security nodes aborting the run.
• Malformed components, path item parameters, or non-object reference targets aborting the run.
• Operation-level parameters ignored when a path item declares the same name and location.
• Malformed servers URL templates aborting the run at startup instead of reporting a schema error.
• Swagger 2.0 body parameters written as a boolean schema crashing.
• Specification extensions such as x-codegen-contextRoot beside the path templates crashing.
• One unresolvable media type dropping an operation whose other media types resolve.
• Unresolvable reference when a $ref and a sibling keyword point at the same target.

False positives

• negative_data_rejection for an empty array or string the schema admits.
• negative_data_rejection for read-only properties a server ignores instead of rejecting.
• negative_data_rejection for operations whose security lists alternative requirements.
• negative_data_rejection and missing_required_header for 415 responses to requests without Content-Type.
• positive_data_acceptance when type lists null but enum omits it.
• positive_data_acceptance for nullable / x-nullable fields whose enum omits null.
• positive_data_acceptance for allOf mixing items with a sibling branch's prefixItems.

Others

• --report json missing from the list of written reports in the run summary.
• UnicodeEncodeError when the output encoding cannot represent status glyphs, such as CP1252 on Windows.
• allow-extra-parameters = false ignored for request bodies in the fuzzing phase.
• Credentials in attached short options (-aUSER:PASS, -HAuthorization: ...) leaking into report command lines.
• Run hanging forever when one report path is rejected and another report is enabled.
• Stray traceback and lost crash report when concurrent runs share a .schemathesis directory.
• Checks disabled in a config file staying disabled when selected via --checks, including --checks all.
• st replay reporting sanitized crash files as fixed and deleting them.
• Stateful reproduce chain printing every step with the failing step's request headers.
• Accept base_url_mismatch, unsupported_regex, unresolvable_reference in [warnings], and report invalid warning names clearly.
• Warn about an unsupported pattern dropped from a request parameter or body.
• Custom CLI handler errors at shutdown crashing the run instead of being reported.