schemathesis 4.30.1

Release 4.30.1

on Python PyPI

🔧 Changed

• Report operations answered mostly with 429 as rate-limited, not as a schema validation mismatch.
• Suggest the JSON Pointer form for dotted link body expressions like $response.body.0.id.
• Additional-properties hint offers closing the schema or ignoring unknown fields, without blaming the schema.

🐛 Fixed

False negative_data_rejection in the coverage phase

• Nullable and allowEmptyValue parameters.
• Nullable string header and cookie parameters.
• String header and cookie parameters with items.
• minimum/maximum on string parameters.
• Parameter enum entries like "1" under type: boolean.
• Header and cookie enums like "true".
• 0 sent to boolean header and cookie parameters.

Others

• Empty object query values sent as a literal {} over WSGI.
• Random credentials for alternative security schemes sent alongside configured auth, breaking re-authentication.
• False negative_data_rejection for unknown query parameters beside allowEmptyValue string values like 0.
• Non-ASCII bytes in generated Bearer tokens for valid test cases.
• Error feedback ignoring Jackson Unrecognized field "x" rejections from Spring APIs.
• Coverage phase crashing on header or cookie array/object examples with non-Latin-1 or newline characters.
• Negative cases negating annotation keywords like title or deprecated instead of constraints.
• Exploded object query parameters overwriting a declared query parameter of the same name.
• Crash when the cache holds an entry for a method removed from a path still in the schema.
• Pooled values paired with the wrong parent when names differ, like id and project_id.
• st replay marking cases as fixed when the crash file has masked values like password. #5141
• Unmasked request body fields like password in reproduction commands.
• request-timeout from the config file ignored by st run and st fuzz.
• Coverage phase sending parameter examples that format: float precision pushes out of range.