schemathesis 4.32.6

Release 4.32.6

on Python PyPI

🏎️ Performance

• Lower memory use for patterns like ^.{0,102400}$.
• Faster positive coverage phase on large nested request bodies.
• Faster coverage phase startup in negative mode for path parameters declared with content.
• Lower coverage phase memory on large $ref-heavy schemas.

🔧 Changed

• Coverage phase covers boundary lengths of password-style patterns like ^(?=.*\d)[a-z\d]*$.
• Coverage phase sends 65,537-character strings to request body fields without maxLength.
• Coverage phase sends 2**63 to numeric fields without an upper bound.
• Coverage phase sends blank values for numeric path and query parameters.

🐛 Fixed

Inferred stateful links

• Links passing resource ids into name parameters like {username}.
• Links filling *_name query filters with an unrelated name field.
• Links filling name parameters with a bare value an unrelated POST returns.
• Links filling *_name query filters with a field naming another resource.
• Missing links for camelCase query parameters like projectName. #5641

GraphQL stateful testing

• Mutation result types like DeleteNote or UpdateNote treated as separate resources.
• Mutations skipped when they wrap results in payload types, such as CreateNotePayload.
• Random ids sent to delete mutations returning Boolean or payloads.
• Multi-word deletes like deleteBookCover linked to the wrong resource.

Data generation

• Valid examples dropped when several discriminator.mapping values point to the same schema. #5631
• Schema examples, multipart filenames and query serialization lost for $ref alias components or $ref siblings.
• Patterns dropped for a hyphen beside a class escape, such as [\w-/].
• Captured values dropped from request bodies missing required fields in the examples phase with fill-missing.

Authentication

• WFC and dynamic cookie auth over WSGI failing for cookie names like user[id] or a@b.
• Python traceback printed for WFC login failures, such as a dropped connection.

--max-time

• Overrun by a request that is still waiting for a response.
• Operations unreached under --max-time missing the Time limit reached skip reason.

Others

• Operations left untested when a malformed request body media type sits beside a valid one.
• False positive positive_data_acceptance in coverage for multipart bodies with custom encoding.contentType strategies.
• Serialization error for XML multipart parts with arrays of $ref items.
• Object-level authorization failures replaying only the peer's request in --report pytest and cURL output.