🐛 Fixed
st fuzz --mode=negativerunning no scenarios when startup exceeds--max-time.- Crash on WSGI apps for
multipart/form-databodies that are arrays or scalars. - Missing form encoding for
application/x-www-form-urlencodedbodies declared with media-type parameters. - False positive
negative_data_rejectionfor request bodies declared with media-type parameters. - Missing extra-properties hint in
positive_data_acceptancefor bodies declared with media-type parameters. - Wrong XML root element when a media range like
*/*is declared beforeapplication/xml. Case.calldropping ajson=ordata=body on WSGI apps or overnull/binary bodies.- Stateful phase skipped and wrong API link counts for chained
$refresponses or links. - Header values, tokens included, leaking into the WFC missing-header error on WSGI apps.
- Coverage phase sending a captured child id under the wrong parent on nested routes.
- Coverage phase sending "Missing
Authorization" cases with the configured credentials under--generation-unique-inputsor when a hook readscase.meta. - Coverage phase counting Content-Type negative cases as rejected valid data when a hook edits headers.
- Report undeclared-method coverage probes as negative for
application/x-www-form-urlencodedbodies. - Coverage phase counting
Content-Typenegative cases as rejected valid data when a hook edits headers.