schemathesis

🚀 Added

• Dependency inference unwraps result / data envelopes that carry metadata such as status or time.
• Dependency inference treats PUT /items/{name} as the creator when nothing POSTs to /items.

🐛 Fixed

CLI

• Return exit code 2 for run-wide configuration errors.
• Report custom handler startup errors with a clean message.
• Stateful worker hangs after Ctrl-C from custom handlers.

pytest plugin

• Keep reports separate for identical schemas with different report configurations.
• Reports including results from an identical schema that did not configure reports.

Python API

• ImportError on from schemathesis.checks import content_type_conformance (and other built-in checks) before a schema is loaded.
• schemathesis.check return type: decorated functions and classes keep their own type.
• base_url passed to Case.call ignored for WSGI applications.

Stateful testing

• Memory growing without bound during long runs with a time limit.
• Crash in dependency inference for Open API 3.1 references to boolean schemas.
• Crash in dependency inference for Open API 3.1 boolean schemas inside anyOf and oneOf.
• Crash in dependency inference for response references targeting non-object values.
• Inferred links reading foreign keys from responses that do not declare them.

Data generation

• Hanging, or failing a health check, on arrays with a large minItems.
• Crash while processing patterns beside string length bounds too large for regex engines.
• "Failed Health Check" in negative mode for string path parameters carrying keywords of other types.
• Missing negative multipart bodies for binary fields with multiple content types.
• Preserve case-sensitive cookie parameter names.
• Dictionary bindings on body paths ignored through recursive $ref schemas.

Coverage phase

• Hanging on unique arrays with a large minItems.
• Crashes and invalid positive cases from YAML binary keyword values.
• Invalid positive cases for large arrays and objects beside prefixItems, if, or unevaluatedProperties.
• Missing positive cases for satisfiable numeric multipleOf schemas with large bounds.

Request serialization

• Send binary Open API 3.2 querystring parameters as percent-encoded raw queries.
• Captured array path parameters ignoring their declared Open API style.

Schema handling

• Report malformed Open API servers definitions as clean loading errors.
• Report infinite recursive and unresolvable references as clean errors.
• Report empty or non-object Open API parameter content as a clean error.
• Stalls of up to 30s per document carrying an unreachable $schema URL.

negative_data_rejection

• False positive when path and query numeric values are both valid on the wire.
• Missed failures for invalid single-element arrays in query, header or cookie parameters.
• Missed failures for invalid array or object query, header and cookie parameters.
• Missed failures when an array parameter with a valid element accompanies invalid ones.
• Missed failures for invalid path parameters beside undeclared query parameters.
• Missed failures for numeric strings violating minimum or other bounds.

Others

• False unsupported_method failures when a rate limiter answers an undeclared method with 429 Too Many Requests.
• checks.enabled = false not disabling custom checks.
• Report undecodable JSON response bodies as JSON parsing errors.
• Missing closing delimiter in reproduce cURL commands for empty multipart bodies.

🚀 Added

• WFC Report output via --report wfc or --report-wfc-path.
• Dependency inference links body fields named after a collection to its items' code.
• st replay options -H/--header, --auth, --auth-wfc and --auth-wfc-user for replayed requests.
• Coverage Content-Type probes for malformed multipart and undeclared request media types.
• format: binary values include small valid PNG, JPEG, GIF, WebP, PDF and ZIP files.
• Multipart file names carry the extension of the detected file format, e.g. image.png.
• use_after_free and ensure_resource_availability failures note responses served from a cache.

🔧 Changed

• Negative test cases break a random subset of request locations instead of all of them.
• Name the pattern that stops the analysis when test data cannot be generated.
• BREAKING: st run and st fuzz fail with exit code 2 when nothing is tested.
• BREAKING: st run and st fuzz exit 2 on schema, configuration and internal errors.
• BREAKING: st run, st fuzz and st replay exit 130 when interrupted with Ctrl+C.
• Linked stateful steps send negative requests as often as scenario-starting steps.
• st replay step chains show each linked value as recorded -> replayed.
• st replay removes fixed crash files with masked credentials once config or CLI supplies them.
• Fuzzing and pytest seed each operation separately, so operations with identical parameters explore different inputs.
• Stateful testing targets only metrics from generation.maximize or explicit hypothesis.target() calls.
• ignored_auth stops probing an operation once it rejects missing and invalid credentials.
• missing_deserializer warning names the response media types that go unvalidated.

🐛 Fixed

st run and st fuzz

• Fuzzing phase dropping data generation errors when several distinct errors occur.
• st fuzz --help omitting that fuzzing stops at the first failure without --continue-on-failure.
• st fuzz omitting schema errors of individual operations.
• st fuzz workers continuing after the first failure and reporting Stop reason: Completed.
• Stop reason: Time limit reached for runs stopped by a failure shortly before the deadline.
• continue-on-failure in the config file ignored.
• WFC auth skipping users in the coverage phase and settling operations on the wrong one.
• WFC auth never retrying users rejected before the API created their accounts.
• Crash when writing a baseline file into a directory that does not exist.
• Raw traceback for unreadable or malformed baseline files.
• Python spelling in config type errors, e.g. bool: True instead of boolean: true.
• Crash on TOML dates and times in the config file.

st replay

• Ignoring auth providers and [auth.openapi] credentials, resending masked values instead.
• Reporting a crash as fixed when its credentials were missing or rejected.
• Deleting fixed crash files that sent a masked request body value.
• Reproduce commands for stateful chains using stale recorded IDs.
• Flagging stateful steps as changed when only re-extracted IDs differ.
• Resending stale User-Agent and test case ID headers, or dropping -H headers.

Reports

• Schemathesis check failures marked as broken instead of failed in allure-pytest.
• Wrong Allure status for pytest errors (broken) and skips (skipped).
• Duplicate pytest Allure results for the same operation.
• pytest errors and skips marked as passed in JUnit.
• from_fixture tests missing from pytest Allure and JUnit results.
• Operations with schema errors missing from pytest Allure and JUnit results.
• Missing epic label with the API title in CLI Allure results.
• exit_code of 0 in --report json for runs aborted by a fatal error.
• stop_reason of interrupted and empty errors in --report json for runs aborted by an error.

Hooks

• Raw traceback and exit code 1 for errors in before_load_schema and after_load_schema.
• Keep schema example values that data generation hooks change in the examples phase.
• Apply test-scoped filter_case and map_case in the pytest coverage phase.
• Call test-scoped after_validate.
• Apply apply_to and skip_for filters on hooks registered by name, e.g. hook("before_call").

Stateful testing

• Scenarios with more than 6 steps running rarely or failing with Unsatisfiable.
• Dependency inference ignoring application/x-www-form-urlencoded, multipart/form-data and formData request bodies.
• Inferred links with * wildcards never filling request body fields.
• Inferred links passing names as identifiers, parent names to new resources, or scalars to arrays.
• Keep operations in dependency inference when a response has an unresolvable $ref.
• Missing inferred links for path parameters named after a resource field, e.g. /projects/{code}.
• Inferred links reading response fields the schema does not define.
• Missing inferred links for fields and nested foreign keys inherited through allOf.
• Crash when a link fills the body of an operation accepting */*.

Data generation

• Keywords next to a root $ref applied in Open API 3.0 and Swagger 2.0 schemas.
• Coverage phase sending positive custom media type bodies in negative-only mode.
• Coverage phase missing positive cases for multipart bodies with custom-encoded properties.
• Negative test data unsatisfiable for operations with plain string headers, such as FastAPI's Header(None).
• Open API 3.1 $ref siblings dropped when the target defines the same keyword.
• Coverage phase crash on malformed contains keywords in Open API 3.0 schemas.
• format: binary strings ignoring minLength and maxLength.
• Crash instead of a schema error on malformed keywords like minLength: "x".
• --generation-unique-inputs treating inputs that differ only in sensitive parameter values as duplicates.
• Coverage phase skipping negative cases for optional parameter combinations under --mode negative.
• Integer path parameters violating enum, multipleOf or not in positive test cases.
• Coverage phase ignoring captured identifiers for request body properties defined via $ref.
• False positive negative_data_rejection in coverage phase for parameters with unanchored pattern and maxLength.
• Coverage phase generating different values for an operation depending on how many operations were loaded before it.
• Fuzz dictionary bindings overridden by path, query or header values captured from earlier responses.

Request serialization

• Multipart parts for arrays of primitives labelled application/json while carrying raw text.
• Booleans and nulls sent as True/False/None in label, matrix and object-style parameters.
• Parameter styles ignored for Open API 3.1 type lists and implicit object or array schemas.
• Nested objects and encoding styles ignored in application/x-www-form-urlencoded bodies.
• Coverage phase stringifying nested values of JSON-encoded content parameters.
• Coverage phase sending a declared Content-Type header that names another body media type.
• Percent-encoded delimiters, missing names and dropped falsy values in matrix/label/simple path parameters.
• Examples and fuzzing phases sending a declared Content-Type header that names another media type.
• Missing multipart boundary when Content-Type: multipart/form-data is set explicitly.

Unsatisfiable schema messages

• Property names holding / or ~ printed unescaped.
• Plural 1 more branches for a single branch.
• Name the prefixItems element that admits no value.
• Name conflicting keywords inside $ref branches of a oneOf.

False positives

• ignored_auth when unauthenticated requests redirect to a sign-in page.
• ignored_auth when an API-key cookie is passed via the Cookie header.
• ignored_auth when credentials are passed in an Authorization header the schema does not declare.
• negative_data_rejection for numeric array path parameters sent as a single number.
• negative_data_rejection for multipart bodies with --generation-unique-inputs.
• negative_data_rejection for string parameters declared as anyOf/oneOf with a false branch.
• validation_mismatch, missing_test_data and missing_auth warnings from undeclared-method requests.
• validation_mismatch and missing_test_data warnings from negative test cases.
• negative_data_rejection for repeated string query parameters whose every value is valid.
• negative_data_rejection for request bodies referencing a schema of a newer draft, such as one recursing through $dynamicRef.

Others

• Memory exhaustion from large workers values; reject values below 1.
• Crash files lost when a negative mutation stored a bytes value.
• Wrong or crashing request URLs for GraphQL schemas loaded from files or dictionaries.
• Crash on non-string property names from YAML 1.1 parsers, e.g. on:, passed to from_dict.
• Network errors when a server closes a keep-alive connection without Connection: close.
• Raw or misleading config errors for wrong value types, duplicate list items and non-string choices.
• Broken curl reproduction commands for request data with C1 control or Unicode line-separator characters.
• curl reproduction commands sending wrong bytes in fish, or \$ for $ in bash.
• Equal Case objects hashing differently when header names differ only in case.
• Oversized curl reproduction commands for non-ASCII request data.

🏎️ Performance

• Coverage phase ~1.6x faster on schemas with many enum or const positions, such as recursive request bodies.
• Coverage phase ~4x faster on recursive request bodies with maxItems, such as OGC CQL2 filters.

🚀 Added

• Fuzz dictionary bindings for GraphQL arguments via <Type>.<field>.<argument> keys.
• Opt-in low_valid_rate warning for operations that accept few of the requests sent to them.
• A server that stops accepting connections ends the run with one Server Unavailable error.
• missing_test_data warns for GraphQL operations whose responses never carry data.
• st replay retries passing crashes up to three times and reports intermittent ones as FLAKY.
• Dynamic auth extract_from = "cookie" takes a named cookie from a Set-Cookie login response.
• schemathesis.errors.FailureGroup for catching failures raised by validate_response.
• Support for pytest 8.4.
• validate() and is_valid() on request parameters for checking values against the schema.

🐛 Fixed

• False positive negative_data_rejection for regex, uri-reference and similar string formats in fuzzing.
• False positive response_schema_conformance for HEAD responses that declare a body.
• False positive 'negative_data_rejection' for unknown query parameters next to boolean ones.
• Send examples that different parameters declare under the same name together.
• Send the value, not the name, for examples maps inside a parameter or body schema.
• False positive GraphQL server errors for resolver rejections labelled in error extensions.
• Report OpenAPI links to missing operations or unresolvable references as invalid links.
• Complete partial request body examples declared under the examples keyword.
• Protocol-relative $ref (//host/schema.json) failing to resolve for schemas loaded from a file.
• XML serialization error for scalar bodies under a root element with a namespace prefix.
• Generate cookie values from RFC 6265 cookie-octets only.
• Send a JSON string, not raw bytes, for top-level format: binary JSON bodies.

🔧 Changed

• Name the conflicting constraints and where they sit when test data cannot be generated.
• Report GraphQL non-nullable fields resolving to null as a GraphQL schema violation, severity high.
• missing_test_data names the operation that appears to supply the data an unlinked operation needs, or reports that none does.

🐛 Fixed

• Crash on schemas where properties is not an object.
• Drop parameter examples built from nested ones that violate the parameter's own schema.
• Skip parameter schema examples values that violate that schema in the examples phase.
• Coverage phase probing methods of operations disabled via [[operations]].
• Crash in the examples phase for allOf members with wrongly typed examples or required.
• Server-Sent Events: False positives for event payloads containing U+2028 or other control characters.
• Validate SSE events against both itemSchema and a sibling schema.
• Report a schema error instead of a generic check failure for boolean allOf/anyOf branches.

🔧 Changed

• Examples phase fills missing values with schema default values; required parameter defaults count as examples.

🐛 Fixed

• Truncated --report ndjson output containing only the Initialize event. #4807
• Show an error when a report writer fails instead of truncating its output silently.
• Use example/examples declared on array items in the examples phase.
• Use property examples under allOf, oneOf, and anyOf at any depth in the examples phase.
• Drop self-referencing optional properties from examples instead of losing the whole body.
• Crash in the examples phase for boolean property subschemas inside recursive schemas.
• ignored_auth crash on generated cookie values the stdlib parser rejects. #4804
• Use anyOf branches for examples when a schema declares both oneOf and anyOf.
• Emit example and x-example values in a stable order across runs.
• Use x-example and x-examples in OpenAPI 3 parameters in the examples phase.
• Skip discriminator pins the branch's own enum rejects, which made those branches ungeneratable.

🚀 Added

• Refine generation from Luracast Restler 4xx errors.

🏎️ Performance

• st starts about 2.5x faster.

🐛 Fixed

• Substitute only ${VAR} in config values; $${ escapes it, any other $ stays literal. #4785
• Accept QUERY in phases.coverage.unexpected-methods. #4787
• Keep numeric bounds learned from 4xx errors on properties without a declared type.
• False positive missing_required_header for 404 responses on generated path parameters.
• Schema Error aborting operations whose 4xx responses carry a malformed Content-Type.
• Escape XML-illegal control characters in JUnit XML reports. #4794

🐛 Fixed

• Recognize +yaml media types (e.g. application/apply-patch+yaml) and YAML content types with parameters.
• Exceed a declared maximum/minimum that lies outside the range of format: int32/int64.
• Keep percent-encoded reserved characters in the base path intact in request URLs.
• Cover path parameter enum and const values containing / by sending them percent-encoded.
• Name every negated location in the negative_data_rejection failure message.
• Send request bodies for text/* media types without a dedicated serializer as plain text.
• Generate email, hostname and uri values with a dotted domain, which strict checkers require. #4782
• Cover nested properties, items and enums under an allOf sharing a node with additionalProperties.
• False positive ensure_resource_availability when a verb other than DELETE removed the resource.
• False positive negative_data_rejection when another location's negation only adds undeclared parameters.
• False positive ensure_resource_availability for a POST to a resource URI that does not create it.
• Wrap a top-level string body in an XML element instead of sending bare text.
• Complete body example values that omit required fields, and skip those the schema still rejects.
• Crash when an example uses a YAML tag such as !!binary.
• Keep negatives that do not need the body when its media type has no serializer.
• Generate values violating format: duration under Swagger 2.0 and Open API 3.0.
• Generate string values where a format and a wider pattern both apply, instead of skipping the body.
• Infer links from a collection nested under a parent into its top-level resource operations.
• Cover subschemas below a $ref base reused across nesting levels.

🐛 Fixed

• Decline unbuildable negated bodies instead of raising UnsupportedSchema during negative generation. #4753
• Generate a positive body and isolated negatives when a spec's examples mismatch its schema.
• Generate a valid object body in the coverage phase when all example, examples, and default values are invalid.
• Cover items with a valid value when a conflicting sibling type would otherwise silence it.
• Cover a oneOf branch's own properties even when it can never win exclusivity over a sibling branch.
• Send a valid multipart terminator for an empty multipart body instead of an empty request.
• Do not generate null as an incorrect type for nullable OpenAPI 3.0 properties.

🚀 Added

• Dependency inference links body fields to the collection listing their accepted values.
• Generated data reuses values from list responses, not only single-object ones.
• Generated data reuses values from responses whose schema the spec omits.
• Path parameters take values seen under the same name in earlier responses.
• Integer fields in JSON bodies draw float spellings (2.0) under Open API 3.1 and 3.2.
• Baseline file so CI fails only on failures that are new.
• filter_failure hook to drop check failures by a custom condition. #1792

🔧 Changed

• Examples phase names the parameter it cannot generate and prints its schema.
• missing_test_data warning tips reflect whether links reach the operation and whether stateful testing ran.
• Reports record response bodies larger than 1 MiB as a prefix with the original size.

🏎️ Performance

• Coverage phase ~270x faster on strings declaring format, pattern, and a length bound together. #4593
• Coverage phase up to 6x faster on strings carrying a format and a length bound.
• Strings whose length bound no format value can reach are ruled out without drawing.
• format: date-time values are built to fit a length bound instead of drawn until one fits.
• format: email and format: uri values are built to fit a length bound too.

🐛 Fixed

WFC authentication

• Operations refusing every configured identity never retried without credentials.
• Operations no identity can reach left unauthenticated instead of keeping the one that got furthest.
• Every identity tried before anonymous, spending a short run on credentials that never work.
• Identity escalation stopped by a 404, leaving role-gated operations pinned to the first user.

Others

• No positive cases where a format and a length bound could not both be met. #4592
• missing_auth warning for operations that returned 2xx responses later in the run.
• Inferred links dropped for every consumer of a resource after the first with the same method.
• KeyError from an evicted cache entry on free-threaded Python.
• Crash with dictionary changed size during iteration when several workers reuse values from responses.
• Bean-validation @Range bounds ignored in Spring error responses.
• Spring validation errors for query parameters applied to the request body.
• Server-reported numeric bounds not applied to the items of a repeated parameter.
• Server-reported numeric bounds discarded in favour of the wider format: int32/int64 range.
• --exclude-method and other exclusions ignored for unexpected HTTP methods in the coverage phase. #3142
• False positives positive_data_acceptance and negative_data_rejection for 429 responses.
• Config file and CLI values ignored when equal to an option's default.

🚀 Added

• --origin option that takes scheme, host and port, and appends the schema's own base path.

🐛 Fixed

ASGI applications

• UnicodeDecodeError on non-ASCII response headers.
• Non-ASCII header values delivered with the wrong encoding.
• Generated requests sent with a different Host than the schema fetch.

WSGI applications

• Flask-RESTX error responses such as abort(404) and 405 raised as internal errors.

WFC authentication

• Operations answering 401 never escalating to the next user.
• Expired tokens never refreshed when the auth document lists several users.

Request serialization

• Array and object cookie parameters dropped instead of sent.
• Header and cookie booleans and nulls sent as Python literals instead of true / false / null.
• XML and text/plain body booleans and nulls sent as Python literals instead of true / false / null.

Coverage phase

• Crashing on parameters and bodies whose schema is written as a boolean.
• Generated header value replaced by a security scheme spelling the same header differently.
• Generated header value replaced by a path-level parameter spelling the same header differently.
• Negative cases treating valid query, header and path values as invalid data.
• Positive cases emitted when a required parameter has no satisfiable value.
• Empty string from a path parameter's enum collapsing the URL segment.
• Required headers, query and cookie parameters dropped from negative cases.
• No positive cases generated for allOf of two disjoint contains.
• Unsatisfiable schema error when an allOf branch forbids a required property with false.
• Positive cases sending a Content-Type header value its own schema rejects.

Schema handling

• Malformed operation or responses node crashing operation counting.
• Malformed operation, requestBody, content, media type, or security nodes aborting the run.
• Malformed components, path item parameters, or non-object reference targets aborting the run.
• Operation-level parameters ignored when a path item declares the same name and location.
• Malformed servers URL templates aborting the run at startup instead of reporting a schema error.
• Swagger 2.0 body parameters written as a boolean schema crashing.
• Specification extensions such as x-codegen-contextRoot beside the path templates crashing.
• One unresolvable media type dropping an operation whose other media types resolve.
• Unresolvable reference when a $ref and a sibling keyword point at the same target.

False positives

• negative_data_rejection for an empty array or string the schema admits.
• negative_data_rejection for read-only properties a server ignores instead of rejecting.
• negative_data_rejection for operations whose security lists alternative requirements.
• negative_data_rejection and missing_required_header for 415 responses to requests without Content-Type.
• positive_data_acceptance when type lists null but enum omits it.
• positive_data_acceptance for nullable / x-nullable fields whose enum omits null.
• positive_data_acceptance for allOf mixing items with a sibling branch's prefixItems.

Others

• --report json missing from the list of written reports in the run summary.
• UnicodeEncodeError when the output encoding cannot represent status glyphs, such as CP1252 on Windows.
• allow-extra-parameters = false ignored for request bodies in the fuzzing phase.
• Credentials in attached short options (-aUSER:PASS, -HAuthorization: ...) leaking into report command lines.
• Run hanging forever when one report path is rejected and another report is enabled.
• Stray traceback and lost crash report when concurrent runs share a .schemathesis directory.
• Checks disabled in a config file staying disabled when selected via --checks, including --checks all.
• st replay reporting sanitized crash files as fixed and deleting them.
• Stateful reproduce chain printing every step with the failing step's request headers.
• Accept base_url_mismatch, unsupported_regex, unresolvable_reference in [warnings], and report invalid warning names clearly.
• Warn about an unsupported pattern dropped from a request parameter or body.
• Custom CLI handler errors at shutdown crashing the run instead of being reported.

🚀 Added

• Negative coverage case that omits a request body the operation declares required.
• Apollo Federation subgraph support: _entities and _service stay out unless filters select them.
• base_url_mismatch warning when every response is 404 and --url omits the schema's base path.
• unresolvable_reference warning listing the parameters and responses skipped over a missing schema component.
• Try each user in a WFC auth document, moving on from the ones an operation rejects.
• --max-time stops st run after the given number of seconds.
• --auth-wfc and --auth-wfc-user for Web Fuzzing Commons auth files.
• --report json writes the run's verdict as one JSON document.
• Support for state in the ASGI lifespan scope.

🔧 Changed

• Drop starlette-testclient and starlette dependencies.
• ASGI application state persists between generated test cases.
• ASGI lifespan shutdown runs per pytest test, or at process exit outside pytest.
• The operation serving the loaded schema stays out of testing unless filters select it.

🏎️ Performance

• ~100 ms less overhead in each examples, coverage, and fuzzing phase.
• Single event loop shared by ASGI applications, with one lifespan cycle per test.

🐛 Fixed

ASGI applications

• Incompatibility with anyio 4.15.
• HEAD operations failing with an internal AttributeError.
• Applications that do not implement the lifespan protocol failing with a TypeError.
• Applications that reject the lifespan scope, such as Django, failing with a ValueError.
• Requests served after the application reports a failed startup.
• Lifespan failures after startup or after shutdown completes going unreported.
• Lifespan not started while fetching the schema.
• IPv6 and userinfo base URLs rejected.
• session passed to case.call() ignored.
• Request timeouts ignored, leaving a hung handler unbounded.
• Django's ALLOWED_HOSTS rejection reported without an explanation.

WSGI applications

• Raw multipart bodies sent with an unparsable Content-Type.
• Binary form properties not sent as file parts.
• multipart/mixed request bodies sent as an empty payload.

WFC authentication

• authTemplate not merged into each entry when loading auth files.
• The first entry not selected when no user is configured, as documented.
• Token fetch failures disabling auth for the whole run instead of retrying after a cooldown.
• Login endpoints that specify neither token nor expectCookies rejected, ignoring the returned cookies.
• Login endpoints that redirect after sign-in rejected, ignoring the cookies they set.

Data generation

• No test cases generated for schemas with not over patternProperties.
• No values generated for strings that several patterns must match at once.
• Generation failing for an OpenAPI 3.0 pattern that names a capture group.
• Empty strings generated for query parameters declaring allowEmptyValue: false. #4574
• Boolean and null example values in query and path sent as Python literals, and optional nulls sent instead of omitted.
• Delimited query and path array items sent as Python literals instead of true / false / null.
• Optional query parameters generated as null sent instead of omitted.
• OpenAPI 3.1 contentMediaType: application/octet-stream form fields not sent as file uploads.
• Request bodies declared with a media range like application/*+json sent without a concrete Content-Type.
• Crash on repeat runs when an operation's request body declares several media types.
• GraphQL scalars with no registered strategy misreported in some generation modes.

Coverage phase

• Emitting objects for allOf requiring a property no branch combination admits.
• Treating allOf branches naming integer and number as unsatisfiable.
• Emitting valid values as anyOf/oneOf violations for branches with $ref siblings.
• Emitting valid values as items violations for arrays declaring prefixItems.
• Ignoring prefixItems when building array cases for OpenAPI 3.1 operations.
• Dropping a required name properties does not declare from generated array items.
• Emitting properties whose names propertyNames rejects.
• Emitting a multipleOf value outside the float bound minimum and maximum pin.
• Emitting a single-item array that exceeds maxContains.

Schema handling

• A path item or responses that is not an object reported as a generic parsing failure.
• Header parameters written as a boolean schema crashing data generation.
• XML bodies whose schema is written as a boolean crashing serialization.
• Malformed servers URL templates crashing instead of reporting a schema error.
• $ref values that name no readable file crashing instead of reporting an unresolvable reference.
• Response keys that are not status code patterns crashing response matching.
• Unresolvable $ref in an optional parameter or required body rejecting the operation.
• Unresolvable $ref in a response schema rejecting the operation.
• openapi versions with a suffix, such as 3.1.0-custom, rejected.
• Non-object vendor extension values inside responses, such as x-note: null, rejected.

False positives

• ignored_auth for APIs that reject unauthenticated requests with 403.
• negative_data_rejection for example header and cookie values.
• negative_data_rejection for GraphQL when captured identifiers replaced the violating argument.
• negative_data_rejection for GraphQL arguments that declare a default value.
• negative_data_rejection for non-numeric query and path parameters whose serialized value is valid. #4600
• unsupported_method when a secured operation answers 401 or 403 before routing.

Others

• False negative unsupported_method for 404 responses on paths whose parameters are pinned.
• Detect ignored_auth bypasses in APIs that accept any well-formed bearer or basic credentials.
• Send requests without credentials when security accepts unauthenticated access via {}.
• Response schemas validated against undocumented content types.
• Write-only property violations in responses reported as {} is not allowed.
• Read-only property violations in requests reported as a valid value of its type.
• negative_data_rejection message omitting parameter names when several parameters are mutated. #4600
• positive_data_acceptance extra-properties hint shown when the server rejects a declared field.
• Stateful phase crashing when two links produce the same transition name.
• Several boundaries used in the reproduce cURL for multipart request bodies.
• Zero scenarios run when st fuzz startup outlasts --max-time.

🔧 Changed

• NDJSON report spells phase names and skip reasons as machine tokens (stateful, not_applicable).

🐛 Fixed

• NDJSON report omitting each failure's title, severity and operation.
• Credentials from --header, --auth, --proxy and the schema URL stored unsanitized in the recorded command.
• Missing Allure entry in the Reports section of the CLI summary.
• Coverage phase emitting a pattern-matching string as a multipleOf violation for union types.
• Coverage phase emitting a value two oneOf branches admit when one keeps keywords beside $ref.
• Coverage phase ignoring keywords beside $ref when generating values.
• Coverage phase ignoring patternProperties entries matching a declared property name.

🚀 Added

• Support for validating httpx2 responses in Case.validate_response.

🔧 Changed

• Suggest the server URL declared in the schema when the missing base_url error fires.
• Mention warnings.fail-on in the --warnings help text.

🐛 Fixed

Coverage phase

• Keeping false for const: 0 (and vice versa) when intersecting allowed values.
• Emitting branch values that ignore a sibling anyOf/oneOf/allOf or the keywords beside them.
• Emitting objects without a name one allOf branch requires and another forbids.
• Duplicate positive cases for schemas combining anyOf/oneOf with keywords beside them.
• Emitting a property's const that the rest of its schema rejects.
• Emitting a oneOf value a second branch admits under the operation's draft.
• Emitting enum/const members the operation's draft rejects.
• Emitting example/default values the operation's draft rejects.
• Judging anyOf/oneOf branch values against the parent in the wrong draft.
• Crashing on multipleOf beside a numeric bound past 28 significant digits.
• Emitting multipleOf steps no float can carry, landing back on the excluded bound.
• Numeric exclusiveMinimum/exclusiveMaximum overriding a tighter minimum/maximum instead of combining.
• Integer boundary values emitted as floats when the bound is written like 7.0.
• Integer steps past float bounds taken in binary, not the decimal the validator reads.
• Emitting an excluded integer bound when minimum/maximum repeats a large float exclusiveMinimum/exclusiveMaximum.
• Emitting a float as a type violation for integer when number is allowed too.
• Emitting a non-multiple for multipleOf past 2^53.
• Emitting inf as a violation of a bound at the largest float.
• Generating non-integer values for integers with a fractional multipleOf.
• Dropping every value of a type when another type's container template cannot be built.
• Ignoring additionalProperties for required names absent from properties.
• Exceeding maxProperties when covering a property the template omits.
• Emitting an optional object property whose schema requires a name it forbids.
• Emitting a non-object as a minProperties violation for untyped schemas.
• Dropping properties named if, then, else, or not from nested templates.
• Generating no positive cases for objects with an ungeneratable property.
• Crashing on a pattern whose minLength exceeds the generation buffer.
• Emitting values for strings, alone or as properties, whose minLength exceeds maxLength.
• Omitting string parameters with a very large maxLength.
• Crashing on a pattern whose minLength exceeds maxLength.
• Crashing on a minItems/minProperties past the generation buffer beside a combinator.
• Filling a large minItems/minProperties floor past a smaller ceiling.
• Hanging on a maxProperties past the generation buffer.
• Crashing on a large minItems without items, and building arrays past the generation buffer.
• Crashing on a minProperties past the generation buffer.
• Spending a minute on a minProperties in the hundreds and then emitting nothing.
• Sending empty array and object path parameters that blank the path segment.
• Repeating requests when different generated values serialize identically.
• Ignoring header and cookie example/default values with non-alphanumeric characters.
• Skipping body examples that name a readOnly field.
• Reusing generated values across operations whose $ref targets differ.

False positives

• positive_data_acceptance for values with a sibling anyOf/oneOf in the coverage phase.
• negative_data_rejection for format: float bounds a single-precision server cannot distinguish.
• negative_data_rejection for numeric bounds past 2^53 in the coverage phase.
• negative_data_rejection for bodies whose schema declares a format anywhere.

Others

• Report a minItems/minProperties past the generation buffer as a schema error instead of a health check.
• Non-body parameters with anyOf/oneOf/$ref schemas losing their null branch to the default string type.
• Object values for query parameters declared with anyOf/oneOf serialized as their property names.

🚀 Added

• Report filter expressions that match no API operations, with the closest match as a suggestion.
• allow_header_conformance check comparing the Allow header against the methods declared in the schema.

🐛 Fixed

Data generation

• Slow generation for a grouped or anchored pattern under a length bound.
• Generation hanging on a pattern whose repeated group cannot fit an exact length bound.
• Strings longer than a single-character pattern like ^[a-z]$ allows when maxLength is set.
• Values violating a pattern with possessive quantifiers like 0++0 when a length bound is set.
• Internal error generating values for a pattern naming characters outside generation.codec.
• Generate values for patterns using Unicode property escapes like \p{L}.
• Generate values for patterns using named capture groups like (?<name>...).
• Generate values for the other anyOf branches when one names an ungeneratable pattern.
• Keep a pattern the API enforces when Python cannot read it.
• Honor format when generating string values for Open API 3.1.
• Generate hostname and idn-hostname values that validators accept.
• Generate string values satisfying every pattern and format in a conjunction.
• Generate strings honoring contentEncoding and contentMediaType under Draft 7.
• Generate sendable header and cookie values for schemas with keywords beyond type.
• Generate valid data for oneOf / anyOf branches whose discriminator property is nullable.
• Unsatisfiable negative tests for operations whose path parameters have no constraint to violate.
• Name the API operation that cannot be generated when its schema is unsatisfiable.
• Hypothesis warning about an overly large representation when generating unrestricted JSON values.
• Send true/false/null for booleans and nulls nested in array query parameters.
• Negative test data differing between runs, and sometimes failing to generate, for the same seed.
• Bodies exceeding maxProperties when a captured resource value is injected.

Schema handling

• Resolve a reference naming the schema's own $id in place, without fetching it.
• Schema error on references inside a schema whose $id is a bare fragment like #/definitions/text.
• Intermittent "Path parameter is not defined" on specs split across many external files. #4414
• Report schemas rejected by their JSON Schema draft as a schema error.
• Report a pattern the validator cannot compile as an invalid regular expression.
• Internal warning text shown for unreadable patternProperties regexes and patterns containing a quote.
• Run aborting with an internal error on non-string parameter names like true.
• Internal error on truncated runtime expressions like $response. in Open API links.
• Read unquoted on, off, yes and no in YAML documents as strings, per YAML 1.2.

Coverage phase

• Stalling and using gigabytes on a pattern with optional parts and maxLength.
• Endless recursion and runtime errors on reference cycles through allOf, oneOf, or anyOf.
• Rewriting booleans in a schema's own example into strings for every later case.
• Generating Unicode characters where the validator reads \d and \w as ASCII.
• Generating null for nullable schemas an allOf sibling restricts to objects.
• Emitting nothing for allOf schemas with no equivalent flat form.
• Dropping required from allOf branches that sit beside an unresolved $ref.
• Ignoring constraints beside a single-branch allOf, like additionalProperties: false.
• Sending read-only properties an allOf sibling forbids.
• False positive positive_data_acceptance for values a sibling not excludes.
• Ignoring constraints beside anyOf / oneOf in bodies, like items or additionalProperties.
• Spurious tracebacks printed on exit after interruption.
• Skipping a path parameter's only negative value, leaving the operation without negative cases.
• Dropping the remaining wrong-type cases for a parameter once one type had no violation to send.
• Generation hanging on a maxLength violation for a pattern whose repeated group spans two lengths.
• Missing negative cases for parameter combinations when a parameter's schema uses $ref. #4499
• False positive unsupported_method when a templated path returns 404 instead of 405. #4503

Others

• Internal error filtering GraphQL operations by operation-id.
• Ignoring phase-level config like phases.fuzzing.generation.modes.
• False positive positive_data_acceptance for not clauses in schemas using references.
• False positive positive_data_acceptance for credential-granting operations answering 400 or 422.
• Runtime error in negative_data_rejection for empty array path parameters.
• Disable unlisted custom checks when --checks selects only specific checks.
• --suppress-health-check with a subset of checks re-enabling the rest in stateful tests.
• Report oversized minimum examples as a health check failure on recent Hypothesis versions.
• Stop worker threads when the event stream is abandoned instead of running the phase to the end.
• RuntimeError: generator ignored GeneratorExit when an interrupt arrives while the event stream closes.

🏎️ Performance

• New data generation engine: up to 2x faster fuzzing and coverage on large schemas.
• Up to 8x lower peak memory on large schemas. #4305
• Cache canonical schema forms and generation strategies across operations.
• Coverage phase peak memory on large schemas cut from gigabytes to hundreds of megabytes.
• Coverage phase up to 7x faster on schemas reusing the same pattern across operations.
• Coverage phase up to 13x faster on pattern strings with maxLength above 8192.
• Coverage phase skips repeating a value generation attempt that already came up empty.
• Coverage phase up to 1000x faster on large arrays whose items carry a pattern.
• Coverage phase up to 9x lower peak memory and 4x faster on arrays with maxItems above 15.
• Coverage phase up to 40x lower peak memory on operations with large deeply nested request bodies.
• Link injection up to 8x faster on schemas where inference finds many links per response.
• Coverage phase up to 2x faster on schemas with many shared component definitions.
• Response conformance failures up to 15x faster to report on schemas with many definitions.
• Coverage phase up to 100x faster on pattern strings whose quantifier sits inside a group.
• Coverage phase up to 9x faster on schemas with a pattern no value can violate.
• Coverage phase up to 8x faster on schemas whose string parameters accept any text.
• Coverage phase up to 30x faster on pattern strings with a high minLength.
• Coverage phase up to 10x faster generating wrong-type values for query, path and header parameters.
• Up to 7x lower memory use building state machines for schemas with thousands of links.

🔧 Changed

• Drop the hypothesis-jsonschema dependency.

🏎️ Performance

• Faster strategy construction for string, integer, and anyOf schemas.

🔧 Changed

• INTERNAL: Data generation for string, integer, and anyOf schemas built from the jsonschema-rs canonical form.

:bug: Fixed

• positive_data_acceptance hint counting properties declared under allOf/anyOf/oneOf as undocumented.
• Fuzz dictionaries and body overrides not applied to fields behind $ref. #4350
• config.*.update() ignoring invalid values and resetting flags it was not given.

:bug: Fixed

• Fuzz dictionaries not applied to body fields nested under oneOf/anyOf/allOf or if/then/else. #4347

:wrench: Changed

• INTERNAL: Canonicalization for enum, const, and bare type schemas moved to jsonschema-rs.

:rocket: Added

• Dynamic token authentication support for OAuth2 and OpenID Connect security schemes.
• Reactive auth refresh: refetch the token and replay a request on configured statuses (auth.dynamic.openapi.<scheme>.retry-on, @schemathesis.auth(retry_on=[401])).

:bug: Fixed

• Report dynamic authentication token-fetch failures without duplicated text or an internal traceback.
• Explain 401/403 responses from a dynamic authentication token endpoint as rejected credentials.
• Crash dictionary changed size during iteration with multiple workers under free-threaded Python.
• Crash on schemas embedding a JSON Schema resource that declares its own $schema dialect.
• False positive positive_data_acceptance for required array query parameters generated as empty.
• False positive negative_data_rejection for body schemas with additionalProperties: false. #4332
• Generation error for request bodies with prefixItems in OpenAPI 3.1 schemas.
• Crash Cannot sample from a length-zero sequence for array items with an empty enum.
• False positive positive_data_acceptance for array items with enum entries violating the item schema.
• Undercounted stateful link totals for schemas sharing a response definition across operations.
• Operations with unresolvable $refs silently skipped when dependency ordering applies.
• False missing_deserializer warning for media types whose own schema is unstructured.
• Skip reasons in the summary borrowed from operations that were tested in another phase.

:wrench: Changed

• Configuration errors shown without a traceback, under a Configuration Error heading.
• Group the missing_deserializer warning by media type, one line per operation.
• Report why operations were skipped: disabled phases, failure limit, interruption, or time limit.

:rocket: Added

• Reuse literal values from the application's Python source during generation. Disable via analysis.constants.enabled.
• Web Fuzzing Commons authentication via [auth.wfc].
• Automatic 429 retries honoring the Retry-After header with --rate-limit=auto. #1722
• checks.response_schema_conformance.validate-formats to disable format validation in response checks. #2481

:bug: Fixed

• False positive positive_data_acceptance for arrays with contains/minContains/maxContains in the coverage phase.
• False positive positive_data_acceptance for objects with dependentRequired/dependentSchemas in the coverage phase.
• False positive negative_data_rejection for objects combining additionalProperties with matching patternProperties.
• False positive positive_data_acceptance for path integers at the schema minimum. #4312
• Integers generated outside the range implied by format: int32/int64. #593
• Internal error on responses declaring an unknown or invalid charset.
• Generation error for numbers combining multipleOf with minimum and maximum in the coverage phase.
• False positive negative_data_rejection for const and propertyNames under Open API 3.0 in the coverage phase.
• Integers just below the int64 minimum accepted during schema validation.

:rocket: Performance

• Cache for GraphQL schema processing.

:bug: Fixed

• False positive use_after_free when PUT re-creates a resource after DELETE. #4286

:rocket: Performance

• jsonschema-rs upgraded to 0.47.0 with better validator build performance.

:bug: Fixed

• Intermittent internal traceback for arrays requiring items that can never be generated. #4282

:wrench: Changed

• Response schema conformance failures name the matched response status code. #4272

:bug: Fixed

• False positive negative_data_rejection for boolean query parameters mutated to coercible objects. #4254

:bug: Fixed

• False positive negative_data_rejection when a before_call hook overwrites an invalid parameter with a valid value. #4277

:rocket: Added

• Class-based checks that run per response and once after the whole run. #1147, #1689
• Record failing cases as crash files and replay them with st replay. #3006

:wrench: Changed

• Drop the junit-xml dependency; generate JUnit reports with the standard library.
• Drop the tenacity dependency in favor of the standard library.
• Drop the unnecessary httpx dependency.

:bug: Fixed

• False positive positive_data_acceptance for format: float numbers near exclusiveMinimum/exclusiveMaximum. #4267
• Crash for multipart format: binary bodies in positive_data_acceptance. #4268
• Sporadic Internal Error crash during schema loading.

:bug: Fixed

• False positive negative_data_rejection for boolean query/path parameters in the coverage phase. #4254
• False positive negative_data_rejection when an API key is sent as a query parameter. #4254
• False positive negative_data_rejection for boolean query/path parameters in the fuzzing phase. #4254

:bug: Fixed

• Encode spaces in path parameters as %20 instead of +. #4252

:bug: Fixed

• False positive response schema validation for nullable enums (type: [..., "null"] with enum). #4249

:bug: Fixed

• False positive positive_data_acceptance for array parameters with a percent-encoded ,/| separator. #4246

:racing_car: Performance

• Faster stateful dependency analysis on large schemas.

:bug: Fixed

• Infer stateful links for path parameters named after their collection (e.g. /sessions/{session}).

:racing_car: Performance

• Faster dependency analysis on large schemas.

:bug: Fixed

• False positive negative_data_rejection for array path parameters serializing to a valid comma-joined value. #4240

:bug: Fixed

• False positive negative_data_rejection with a globally-registered @schemathesis.auth handler setting a cookie. #4236

:bug: Fixed

• False positive negative_data_rejection when using @schemathesis.auth with a cookie security scheme. #4236
• False positive ignored_auth when a custom auth handler sets cookies via request headers. #4236

:bug: Fixed

• Response cookies leaking between generated test cases, causing false authentication failures.

:bug: Fixed

• Missing boundary negative in the coverage phase for boolean exclusiveMinimum / exclusiveMaximum.
• UnicodeEncodeError when failure or error output contains lone Unicode surrogate characters. #4229

:rocket: Added

• Chain GraphQL operations on non-id identifiers (fullPath, slug, ...) in stateful and fuzzing phases.

:racing_car: Performance

• Much lower peak memory and faster validation for schemas with very large maxLength / maxItems.
• Cache failed validator builds to avoid recompiling invalid patterns from large maxLength / maxItems values.
• Update hypothesis-graphql to 0.13.0 that brings up to 180x performance improvements for deeply nested GraphQL schemas.
• Update harfile to 0.5.0 for slightly better performance.
• Lower memory usage in long stateful runs.
• Faster, lower-memory stateful state machine construction for large schemas.

:bug: Fixed

• Excessive re-runs in stateful testing against APIs with mutable state.
• Stateful testing restarting on a single transient transport failure (e.g. dropped connection).
• Semantic value substitution overwriting const / enum fields with invalid data.

:wrench: Changed

• Mine additionalProperties: false from Pydantic extra_forbidden errors and the exception_detail validation envelope.

:racing_car: Performance

• Skip coverage generation for header and cookie parameters whose pattern requires a non-alphanumeric character.
• Faster operation ordering and case traversal in stateful testing for schemas with many operations.

:bug: Fixed

• Fuzzing phase marked as failed without any reported failure. #4209
• Generate maximum-length boundary cases for unanchored multi-part patterns with maxLength.
• Display the actual response time in milliseconds in max_response_time failures.

:wrench: Changed

• Re-raise original server exceptions in WSGI apps for distinct error deduplication. #1289

:racing_car: Performance

• Skip coverage generation for path parameters whose pattern requires /, {, or }.
• Skip unsatisfiable object-type coverage variants for path parameters.

:racing_car: Performance

• Skip coverage boundary-length variants that are structurally impossible for the declared pattern.

:bug: Fixed

• Apply tls-verify and tls-cert to dynamic auth token requests. #4199

:rocket: Added

• Override server variable defaults via [servers.variables] in config. #4166
• Form-encoded payloads for dynamic auth via payload_content_type. #4167

:racing_car: Performance

• ~50% lower coverage-phase wall on definition-heavy schemas.
• Cache repeated computations during the coverage phase.
• Faster schema bundling for specs with recursive references.

:bug: Fixed

• Emit an all-valid object baseline for properties declared next to a non-object type.
• Populate nested object templates referenced via $ref instead of generating null/{}.
• Honor servers[] declared at path-item and operation scopes. #4166
• Restore per-property negatives in coverage phase when an unsatisfiable optional property would otherwise sink the template draw.
• Emit minLength negatives for string schemas whose pattern requires more characters than minLength - 1.
• Emit minLength/maxLength negatives for string schemas whose format (e.g. email, uuid) makes the bounded length unsatisfiable.
• Cover the enum / const keywords when entries violate the declared type by emitting each entry as a negative case.
• Set Content-Type: application/json on JSON-serialized nested multipart/form-data parts.
• Emit a non-empty alphabetic string (e.g. AAA) as the string-type negative for non-string parameters so ?q= no longer collapses to absent on the wire.
• Skip report aggregation for crashed xdist workers instead of failing the whole controller with AttributeError.
• Emit maxLength negatives for string schemas whose format makes the exact length unsatisfiable when maxLength exceeds 100.
• False positive negative_data_rejection for integer enum entries under type: integer / type: number.

:rocket: Added

• Stateful tests damp reuse of extracted values from unreliable API links.
• Reuse response field values across operations without an inferred producer-consumer link.
• Persist error-feedback, auth, and 405 discoveries to .schemathesis/; probing replays them to skip rediscovery.
• Fuzz dictionaries: sample curated values during generation via [dictionaries.<name>] and [generation.dictionaries]. #2121
• Override body fields via [parameters] with body.<jsonpath> keys.

:racing_car: Performance

• Bound hypothesis-jsonschema caches; ~35% lower coverage-phase peak memory on long-running schemas.
• Cache schema generation across operations during the coverage phase.

:bug: Fixed

• Schema loading crash for external $ref paths containing URI-reserved characters (e.g. paths/{id}/op.yaml). #4152
• Out-of-memory in coverage phase on wide, deeply-nested OpenAPI schemas (e.g. AWS Glue, Microsoft Graph).
• Surface a clean schema error for body $ref strings without a / separator.
• Crash when --report-allure-path (or reports.allure.path) cannot be used as a filesystem path.
• RecursionError in coverage phase on multi-branch allOf schemas that canonicalish cannot simplify.
• Restore stateful chain coverage for foreign-key consumers whose target resource is produced by another operation.
• Serialize Swagger 2.0 nested array-of-array query parameters using each level's collectionFormat.
• Emit empty-array negatives for minItems: 1 arrays when items is unsatisfiable.
• Emit string-too-long negatives for maxLength thresholds between 32 KB and 1 MB.
• Emit null variants for optional-nullable properties absent from the body template.
• Cover properties inherited via allOf when a sibling property uses a bundled $ref.
• Emit maxItems negatives for uniqueItems: true arrays whose items.enum domain is exhausted.
• Constrain Swagger 2.0 array query parameters with top-level enum to that domain via items.enum.
• Cover sibling properties when one optional property has a self-contradicting schema.
• Cover array properties when items is declared without type: array.
• Emit maxLength negatives even when the schema's pattern is intrinsically unsatisfiable.
• Emit pattern negatives for header and cookie parameters.
• Runtime Error in negative generation for FastAPI Optional[Enum] query parameters (anyOf with $ref and sibling enum).
• Serialize nested-object multipart form-data parts as JSON instead of Python repr.
• False positive positive_data_acceptance for body schemas with additionalProperties: false inherited via allOf.
• False positive positive_data_acceptance for maxItems: 0 arrays whose items schema is satisfiable.
• False positive positive_data_acceptance for not clauses whose violations breach other outer constraints.
• False positive positive_data_acceptance when a discriminator branch references a polymorphic schema.
• False positive positive_data_acceptance when sibling oneOf/anyOf constraints reference bundled $ref schemas.

:wrench: Changed

• Render negative_data_rejection mutation descriptions cleanly: no trailing at, readable original values.

:bug: Fixed

• Runtime Error on hook-driven revalidation of OpenAPI 3.1 parameters with prefixItems. #4099
• False positive negative_data_rejection when a before_call hook reassigns request parameters. #4101
• Pad negative-mode arrays to satisfy minItems so per-item violations fire instead of length violations.
• Send formData Swagger 2.0 parameters as form payloads when consumes only declares non-form media types.
• Generate positive body cases for schemas inheriting additionalProperties: false through deep allOf chains.
• Missing sqlite-libs in docker images.
• Emit non-empty XML element values for string fields so server-side keywords reach coverage.
• Cover each discriminator branch when the type tag literal differs from the schema name.

:bug: Fixed

• Serialize nested-object query parameters using recursive bracket notation.
• Detect Tomcat strict-decoder rejection when the response carries the default HTML error page.
• Cover both branches of non-body oneOf: [array, string] parameters by forcing non-empty strings.
• Pin Content-Type to the body media type when it is declared as an explicit header parameter.
• Crash in coverage phase on schemas with property names pattern/minLength/maxLength (e.g. Kubernetes CRDs).
• Crash in fuzzing phase on negative mutations of bundled $ref schemas carrying sibling validation keywords.
• Generate a positive coverage case for additionalProperties: {schema} on objects without explicit type: object.
• Emit a populated positive baseline for type: array parameters so item-level keywords reach coverage.
• Drop wildcard */* from Swagger 2.0 consumes so coverage requests carry a concrete Content-Type.
• Treat 409 Conflict as a valid rejection status for negative_data_rejection.
• Retry slow schema endpoints (read timeouts) under --wait-for-schema. #4058
• False positive negative_data_rejection on query-level additionalProperties mutations. #3730
• Resolve bundled $ref in positive_data_acceptance hint to avoid false "additional properties" suggestions.
• Generate positive body cases for schemas combining allOf with readOnly required properties.
• Emit a unique-array case alongside the duplicate for scalar parameters declaring uniqueItems.

:bug: Fixed

• Crash in coverage phase on multipart bodies whose schemas reference each other.
• Crash in coverage phase on application/x-www-form-urlencoded bodies declared as top-level arrays or scalars.
• Substitute path templates whose placeholder names contain dots or other non-identifier characters.
• Crash in fuzzing phase when multi-target negative mutations cleared a shared $ref body before required-path propagation.
• Keep producer operations as stateful roots when their request body carries a self-referential id field.

:rocket: Added

• Probe for strict URL decoders (Tomcat, common WAFs) and sanitize backslash/control chars from generated path strings when the server rejects them.

:bug: Fixed

• Skip stateful root rules for operations whose inputs reference producer-supplied resource fields.
• Accept skewed length distributions across sibling quantifiers when rewriting pattern against maxLength.
• Drop spec example/examples/default values that cannot be validated against the schema in positive coverage.
• Honour per-operation phases.stateful.enabled = false in the state machine.
• Treat field-level body must not be blank feedback as a body-required signal so generation stops emitting empty bodies.
• Recognise content as a single-property response wrapper during dependency inference.
• Skip use_after_free false positives when the DELETE itself returned a non-2xx status (server crash or 404).
• Propagate error-feedback observations on first occurrence so coverage reacts to examples-phase 4xx evidence immediately.

:racing_car: Performance

• Faster coverage-phase generation for formats the active JSON Schema draft does not validate.

:wrench: Changed

• Seed strategy draws in add_single_example unconditionally so example generation is deterministic.
• Recognize application/jwt, text/json, application/x-json as JSON media types.
• Sort failures alphabetically by operation label for stable output ordering.

:bug: Fixed

• Cover each discriminator-pinned oneOf branch when the branch is a $ref with sibling pin keywords.
• Honour example/examples/default on array items so curated values reach populated arrays instead of synthetic empty fills.
• Recover spec-declared example/examples/default values that carry readOnly-stripped properties by dropping those keys before validating.
• Cover numeric oneOf/anyOf branches when spec examples only match a sibling branch.
• Skip type-violation negatives for multipart/form-data string properties — stringification makes them wire-indistinguishable from enum violations.
• Honour if/then/else constraints in positive and negative coverage.
• Generate type-violation negatives for properties combining type and enum when canonicalization drops the explicit type.
• Drop sibling keys alongside $ref in OpenAPI 3.0 / Swagger 2.0 schemas.
• Respect maxProperties in positive coverage cases for additionalProperties schemas.
• Preserve required for allOf schemas combined with nullable $ref.
• Filter spec-provided examples and defaults when the schema uses Draft-4-only constructs.
• Drop positive coverage bodies that violate sibling anyOf/oneOf constraints.
• Emit empty-array minItems negatives for array schemas that also declare examples/example/default.
• Cover maxLength/minLength boundary strings for nullable string schemas (type: ["string", "null"]).
• Cover each items branch in positive coverage when the array has size constraints.
• Drop duplicate object bodies in positive coverage when scenarios collapse to the same value.
• Skip multipart/form-data property mutations whose stringified value still satisfies the schema.
• Cover falsy default and example spec hints (0, "", false, [], {}) in positive coverage.
• Surface per-property example/default into recursively-generated object templates instead of synthesising values that ignore them.
• Cover the numeric branch of type: ["string", "number", ...] schemas in positive coverage.
• Cover positive parameter values (e.g. enum query params) when the body is unsatisfiable.
• Negative coverage for propertyNames: emit objects with keys violating the sub-schema constraints.

:rocket: Added

Resource pool & captured IDs

• Capture identifiers from {<id>: <object>, ...} map-by-id GET responses (e.g. team / pod / cluster status maps).
• Capture every element of list-shaped responses into the pool, not just the first.
• Capture pool entries from custom wrappers, nested envelopes, and multi-array-root GET responses.
• Apply pool overlay to foreign-key fields nested inside request body objects.

Error feedback (4xx parsers)

• Refine generation from 4xx errors (Spring, Pydantic, DRF, Rails, Laravel, ASP.NET, Symfony, Zod, AJV, go-validator, Confluent, marshmallow, Flask-RESTful, Flask-RESTX, Litestar).

Adaptive operation handling

• Detect runtime auth requirements from 401/403 responses on operations the spec declares public.
• Skip operations that consistently return 405 Method Not Allowed and surface a method_not_allowed warning.

GraphQL

• GraphQL fuzzing: dispatch producer mutations first and reuse captured identifiers across test cases.
• GraphQL stateful phase: chained operation scenarios.

Configuration

• extra-data-sources config for the examples and coverage phases. #3972
• Document the JSON Schema for schemathesis.toml for editor autocompletion. #3971

:bug: Fixed

Coverage phase

• Skip pattern rewrites that collapse optional variable-length sub-groups to {0}.
• Skip {} as positive coverage body for schemas with minProperties but no required fields.
• Coverage positive cases from oneOf/anyOf branches violating a root-level constraint (e.g. type: object branch under type: array root) were yielded as valid.
• Positive-mode generation collapse for readOnly fields nested in allOf and listed in parent required.
• Honor minimum: 0 / maximum: 0 and Draft 4 boolean exclusiveMinimum / exclusiveMaximum in coverage-phase number generation.
• Positive-mode coverage skipped object schemas with annotations next to unsatisfiable optional properties.
• Skip parameter-mutation coverage cases when no positive body can be generated.
• Coverage near-boundary numbers drift from multipleOf due to IEEE-754 subtraction (e.g. 99999.99 - 0.01).
• Coverage boundary numbers fail validation when both bounds are exclusive (e.g. exclusiveMinimum: 0 + exclusiveMaximum: 1).
• Preserve minLength / maxLength when the pattern rewrite cannot encode them.
• Emit format: uuid negative cases in coverage on OpenAPI 3.0 / Swagger 2.0 schemas.
• Emit minProperties / maxProperties violations for object schemas alongside additionalProperties.

Resource pool & captured IDs

• Mismatched parent/child path parameters in pool draws for hierarchical operations.
• Recognize nested foreign-key body fields independently of the spec's paths ordering.
• Recognize body foreign-key fields nested behind allOf / oneOf / anyOf composition.
• Drop spec examples invalidated by inferred constraints from the example mixer.
• Pick up in-place mutations of bundled $ref targets when generating from cached schemas.
• Pool overlay corrupting nested object siblings during coverage generation.
• Stop re-feeding deleted resource identifiers to subsequent operations.
• False positive positive_data_acceptance when a runtime pool body variant was missing required fields. #3949

use_after_free check

• False positive use_after_free on a second DELETE - DELETE is idempotent (RFC 7231 §4.3.5).
• False positive use_after_free after a DELETE on a collection path with no path parameters.
• Include the prior DELETE in use_after_free reproduce when it is a sibling step.

Validation false positives

• False positive negative_data_rejection for integer/number query parameters when an array element is a numeric string. #3931
• False positive negative_data_rejection on 405 responses from routing-level rejection.
• False positive negative_data_rejection for body schemas combining $ref with sibling keywords.
• False positive response_headers_conformance for Swagger 2.0 array headers serialised via collectionFormat.

Reports & output

• JUnit and Allure reports marked all test cases as skipped when a schema had no inline examples, even though Coverage or Fuzzing phases ran successfully afterwards. #3738
• Preserve trailing test events when producer threads exit at a phase boundary.

Other

• Panic during response validation for schemas with very large {0,N} regex quantifiers (e.g. {0,404600}).
• Runtime Error from invalid Schema Object when every required parameter of a set is excluded from generation.
• Set filename on binary multipart/form-data parts; use encoding.headers.Content-Disposition if present, field name otherwise. #3951
• Reject . and .. path-parameter values; URL normalisation routes the request to a different operation.

:wrench: Changed

Resource & foreign-key recognition

• Recognize more path parameters as resource identifiers.
• Recognize camelCase foreign-key field names (locationId, userUuid, orderId).
• Recognize plural foreign-key array fields (site_ids, userUuids, session_guids).
• Treat _name-suffixed body fields as attributes when no path or schema backs the inferred resource (first_name, last_name).
• Rebind body and query self-FK slots to the path-derived parent when the parent has the same field.
• Prefer same-module variants for spec-suffixed duplicates (Group / Group1, Member / Member1).
• Steer path slots to the same-module resource the operation actually returns when the suffix matcher would pick a cross-module candidate.

Stateful & output

• Tolerate per-operation transport failures in the stateful phase; abort only when several operations fail.
• Group consecutive same-title failures (e.g. multiple schema violations on one response) under a single header with a violation count.

Generation

• Negative-mode fuzzing distributes mutations across all schema depths.

Schema & dependencies

• Remove direct dependency on jsonschema.
• Recognize application/jose+jwe as JSON media type.

:racing_car: Performance

• Up to 2x faster schema processing on large specs (Stripe, VMware, OSIsoft) and ~40% faster CLI startup.
• ~75% lower peak memory for large scenarios when writing NDJSON reports.
• Cap shell-escaped values in reproduce-curl commands at 64 KB with an inline truncation marker.
• Avoid unnecessary function digest calculations when Hypothesis database is disabled.

:rocket: Added

• Capture path-parameter values from successful 2xx requests for reuse during fuzzing.
• Capture request-body field values from successful 2xx requests for reuse during fuzzing.
• Coverage phase records request identifiers into the runtime resource pool for reuse in later phases.
• Use identifiers from the runtime resource pool for resource-bound parameters and body fields during the coverage phase.
• Use captured body-field values to fill resource-bound fields in the examples phase.
• Enable the runtime resource pool for producers that return empty response bodies.
• Chain st fuzz scenarios via inferred and schema Links, biased 80% toward link-driven steps.
• Pick correlated identifiers for nested-resource operations during the coverage phase.
• Dependency inference recognizes <resource>Name-style body fields on collection paths (e.g. POST /products {productName: ...}).
• Dependency inference recognizes more identifier-style path parameters (e.g. username, containerGroupName).
• Dependency inference treats POST /resource/{name} as a producer when the response has no body.
• Dependency inference treats POST /collection {idField: ...} as a producer when the response has no body.
• Dependency inference recognizes GET /collection returning an array of identifier strings.
• Dependency inference recognizes plural {ids} path parameters (e.g. GET /persons/{ids}).
• Seed the runtime resource pool with identifier values from a Bearer JWT or HTTP Basic username.

:bug: Fixed

• False positive negative_data_rejection for body-level type mutations on multipart/form-data endpoints. #3801
• False positive negative_data_rejection for body fields with format: binary or format: byte.
• Crash on schemas with non-schema values inside properties (e.g. an integer where a sub-schema is expected).
• Cascading generation failures after one schema corrupted shared hypothesis-jsonschema constants in the same process.
• Crash on $ref with sibling keywords when exploring the Python API outside the pytest runner.
• HypothesisRefResolutionError when a $ref and its target both have distinct anyOf lists.
• Report malformed sub-schemas (e.g. description: null) as a clean schema error.
• Unsatisfiable for arrays with allOf of multiple contains requiring distinct const values.
• Operation scheduling respects RESTful method priority even when all operations collapse into one layer.
• Draft-03 schemas surface as a clean InvalidSchema instead of a generic InvalidArgument from the strategy generator.
• False InfiniteRecursiveReference on cycles breakable through patternProperties.
• False InfiniteRecursiveReference on cycles breakable through oneOf/anyOf, top-level allOf, or unused definitions.
• False positives from \p{X} Unicode property escapes inside character classes (e.g. [\p{Alnum}_]+).
• Translate POSIX character classes (e.g. [[:alnum:]_]) to Python equivalents instead of misparsing them.
• Silent character-set widening when \p{X} patterns combine with PCRE class-set operators (||, &&) or nested classes.
• Runtime Error in negative generation for OpenAPI 3.1 schemas with prefixItems. #3842
• Honor discriminator pin in oneOf/anyOf validation under Draft 4 (OpenAPI 2.0/3.0).
• Spurious FlakyStrategyDefinition from st fuzz when the time limit trips mid-scenario.
• Crash in the examples phase when a body example contained format: binary data alongside captured pool values.
• Resource-pool variants for path/query/header parameters skip values that violate the destination schema.
• Bodies missing required fields when a captured value is overlaid on a schema without type: object.
• Boolean path parameters rewritten to integer 1 when the path also contains an integer parameter.
• Examples violating their own schema surfacing as POSITIVE generation cases.
• Duplicate required header entries when a spec parameter and a security scheme share a header name.
• NDJSON reports truncated after the first event from a threaded requests import race in the writer.

:wrench: Changed

• Include meta in NDJSON reports.
• Probe each path with undeclared HTTP methods once per path instead of once per declared operation.

:bug: Fixed

• auth API on LazySchema to match BaseSchema. #3797

:rocket: Added

• schemathesis.openapi.require_security_scheme() for scoping auth providers to specific OpenAPI security schemes. #3745

:bug: Fixed

• Query parameters not serialized when style/explode are omitted from the spec, ignoring OpenAPI 3.0 defaults.
• Use the matching registered serializer for multipart fields with encoding.contentType. #3785
• before_call hook setting a missing required header in the coverage phase had no effect. #3784
• Request timeouts reported as a check failure when a replay made them flaky.

positive_data_acceptance false positives

• example values violating constraints (examples phase):

  • When an object schema-level example has a property violating a nested format constraint (e.g. date-time without timezone).
  • When a parameter-level example value violates its declared schema type.
  • When a schema-level parameter example violates the parameter's own constraints (e.g. pattern).
  • When a response-derived parameter example violates the parameter's schema constraints.
  • When a response-derived parameter example violates the parameter's format constraint.
  • When a property example violates its field's own type (also applies to the coverage phase).
  • For content-encoded header parameters with object examples.
  • For property examples violating anyOf/oneOf constraints via bundled $refs.
  • For array body properties with minItems > 1 and object items.
  • When assembled body violates the schema (e.g. allOf with additionalProperties: false).
  • When a required property has an unsatisfiable schema.

• Composition (allOf / oneOf / anyOf / $ref) in the coverage phase:

  • For oneOf branches with nested multi-$ref allOf.
  • For oneOf body schemas where generated values satisfy multiple branches simultaneously.
  • For oneOf body schemas where a branch requires fields only defined in the parent schema.
  • When an anyOf branch has const: null but a sibling type constraint excludes null.
  • When a multi-level allOf chain causes required properties from a base schema to be generated as null.
  • For body schemas with $ref + additionalProperties: false and pattern/minLength/maxLength constraints.

• enum vs sibling constraints (coverage phase):

  • For required array properties with an unsatisfiable enum constraint.
  • For body properties where all enum values violate a sibling constraint (e.g. maxLength).
  • When an enum contains values violating the declared type (e.g. YAML-parsed false for type: string).
  • When enum contains values violating the declared type in template body generation.

• Structural required / properties mismatches:

  • When a nested required field is unsatisfiable, making the parent object invalid (coverage phase).
  • When required lists fields absent from properties (examples phase).
  • When a nested object schema has required properties absent from properties (coverage phase).
  • When a property has type: object alongside items (coverage phase).
  • When a property has a boolean false schema (coverage phase).
  • For type: string properties that also declare properties: {} (coverage phase).

• Pattern / keyword combinations (coverage phase):

  • For string parameters with pattern containing alternation inside a quantified group (e.g. ([a-z]|-[a-z])*).
  • For string fields with format: uuid and optional-hyphen pattern.
  • When a schema has pattern alongside a non-string type (e.g. number).
  • When propertyNames restricts object keys and additionalProperties is present. #3771
  • For body properties with format constraints in negative mode.

negative_data_rejection false positives

• pattern + length-constraint interaction:

  • For string fields with pattern + maxLength where maxLength was silently lost into an unanchored regex quantifier.
  • For string fields where pattern has an inner quantifier (e.g. ^[a-z]([-a-z]*[a-z])?$) and maxLength is present.
  • When a pattern optional group wraps variable-length content and maxLength is present (coverage phase).
  • When pattern with nested quantifiers caused maxLength/minLength to be silently dropped from the schema.
  • For pattern fields ending with \x1c–\x1f control characters (coverage phase).

• Wire-identical type mutations:

  • For application/x-www-form-urlencoded and application/xml body properties where type mutations are wire-identical (e.g. integer stringifies to a valid string).
  • For application/x-www-form-urlencoded body properties whose schema contains $ref to bundled definitions.
  • For application/x-www-form-urlencoded body properties with nested array/object mutations whose serialized form satisfies the schema.

• Schema-shape edge cases (coverage phase):

  • When additionalProperties is a schema object and required has exactly 2 fields.
  • When a schema has 15 or more properties and exactly 2 required fields.
  • For body objects with additionalProperties: {}.
  • For nullable string properties with maxLength, minLength, or format constraints.
  • When a string property has both enum and maxLength/minLength.
  • For body properties with type: integer and inapplicable minLength/maxLength constraints.
  • For multipart/form-data fields with format: binary and nullable: true. #3777
  • For maxItems array constraints with complex nested item schemas.

Runtime errors in negative_data_rejection

• When a query, header, or cookie parameter pattern produces a large DFA (e.g. \S{1,8192}).
• When a parameter schema has a pattern that jsonschema_rs rejects (e.g. {,3} as an incomplete quantifier).

Crashes

• Crash generating curl command when a negative coverage case has a primitive body (e.g. integer form-urlencoded schema).
• Crash in the coverage phase for application/x-www-form-urlencoded requests with format: binary body fields in negative mode.
• Crash in the examples phase when a property has an unsatisfiable schema (e.g. not: {}).
• Crash when a schema has boolean property keys (YAML artifact from bare on: fields) in the coverage phase.
• Crash in the coverage phase when a body with boolean property keys is serialized for deduplication in negative mode.

Schema-invalid generated bodies (coverage phase)

• Schema-invalid body when required names a property absent from properties in the coverage phase.
• Schema-invalid body when a Swagger 2.0 array parameter has enum at the array level with items also defined in the coverage phase.
• Schema-invalid positive body when a schema combines allOf (with required fields) and outer-level properties in the coverage phase.
• Schema-invalid positive body when a schema property's default or example fails format validation (e.g. "7.00:00:00" for format: duration) in the coverage phase.

:wrench: Changed

• Show compact path for body property violations instead of a verbose chain.

:bug: Fixed

• False positive negative_data_rejection for integer query parameters with type mutations. #3712
• False positive positive_data_acceptance for arrays with uniqueItems and enum items.

:bug: Fixed

• False positive negative_data_rejection for type: number body fields in fuzzing. #3697
• False positive negative_data_rejection for type: integer query parameters mutated to array. #3697
• Double JSON encoding for content: application/json query parameters in coverage phase. #3701
• Sibling keywords on $ref properties ignored in examples phase for OAS 3.1 schemas. #3698
• False positive positive_data_acceptance for headers with RFC 9110 control characters. #3696
• False positive positive_data_acceptance for path parameters containing null bytes. #3696
• JUnit XML missing unsupported_method failures from coverage phase. #3699

:rocket: Added

• st fuzz command for continuous multi-step API fuzzing across operation sequences.
• Structured generation for If-Match, If-None-Match, If-Modified-Since, If-Unmodified-Since, and Range headers.
• Apply filter_case and map_case hooks in the coverage phase. #3675
• schemathesis.pytest.parametrize() for testing multiple named schemas in a single test function. #1409
• Validate discriminator property values against known schema mappings in response_schema_conformance. #1589
• Pin discriminator property to the correct value when generating data for oneOf/anyOf schemas. #1589

:wrench: Changed

• Make --wait-for-schema retry on HTTP 503 responses. #3672
• Use native subtest status labels without redundant parameter suffixes in the pytest plugin.
• Allow reusing the same test function across multiple schemas via schema.parametrize().
• Report all distinct JSON Schema errors per response in response_schema_conformance and response_headers_conformance. #1174

:bug: Fixed

• Wrong length constraints for patterns with multi-character repeated groups.

:bug: Fixed

• deadline=None lost when @settings applied after @lazy_schema.parametrize().
• format: uuid now generates RFC 4122 compliant UUIDs. #2909

:bug: Fixed

• AttributeError on DoctestItem when schemathesis plugin is loaded. #3663
• Make dynamic auth ([auth.dynamic.openapi.<scheme>]) work with WSGI & ASGI transports. #3664

:bug: Fixed

• ModuleNotFoundError on xdist session end when the allure extra is not installed.

:rocket: Added

• Allure report integration. #2756
• Support for recording VCR, HAR, and JUnit XML reports from the pytest plugin via schema.config.reports. #701
• after_validate hook fires after all checks run on a response, carrying a list of CheckResult objects.
• Examples phase generates optional properties and one disjoint set per oneOf/anyOf branch. #2371

:bug: Fixed

• format: email fields generating values rejected by jsonschema_rs response validation.
• flatmap_* hooks raising RuntimeError in negative testing mode. #3652
• allow-extra-parameters = false now also suppresses unexpected properties in request bodies.
• Stateful checks (e.g. use_after_free) not triggering when run via schema.as_state_machine().
• InvalidSchema exceptions displayed an empty message in pytest output.

:wrench: Changed

• Suppress HypothesisWarning when overriding built-in string formats via schemathesis.openapi.format(). #3269

:rocket: Added

• [auth.dynamic.openapi.<scheme>] config block for token fetch authentication that allows for dynamic authentication without writing Python code. #3620
• Use captured response data in the examples phase. #638
• --request-retries to retry requests on network failures with exponential back-off.

:wrench: Changed

• Strip API version prefixes during dependency inference.
• Do not cross-link same-named resources from different API namespaces in during dependency inference.

:bug: Fixed

• apply_to / skip_for filter sets not updated between hook registrations, causing hooks registered after the first to silently receive the wrong filter set.
• Base URL truncated with an ellipsis in the startup summary on narrow terminals (e.g. CI environments). #3618
• Generated strings from regex patterns violating minLength/maxLength constraints in the coverage phase when update_quantifier cannot encode length into the pattern.

:bug: Fixed

• False positive positive_data_acceptance in the coverage phase for path parameters with minLength greater than 1.

:bug: Fixed

• Malformed request body media types (e.g. application.json instead of application/json) now report a clean "Schema Error" with the location in the schema instead of a raw Python traceback. #3615