schemathesis 4.0.0a8__tar.gz → 4.0.0a10__tar.gz

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/.github/workflows/build.yml

@@ -64,7 +64,7 @@ jobs:
         run: uvx --with="tox" --with="tox-gh-actions" --with="tox-uv" tox
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5.4.0
+        uses: codecov/codecov-action@v5.4.2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.28.13
+        uses: github/codeql-action/init@v3.28.17
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.28.13
+        uses: github/codeql-action/autobuild@v3.28.17
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.28.13
+        uses: github/codeql-action/analyze@v3.28.17

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/.pre-commit-config.yaml

@@ -32,12 +32,12 @@ repos:
         additional_dependencies: [types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.2
+    rev: v0.11.8
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.2
+    rev: v0.11.8
     hooks:
       - id: ruff
 

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/CHANGELOG.md

@@ -1,6 +1,31 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.0-alpha.8...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.0-alpha.10...HEAD) - TBD
+
+## [4.0.0-alpha.10](https://github.com/schemathesis/schemathesis/compare/v4.0.0-alpha.9...v4.0.0-alpha.10) - 2025-05-07
+
+### :bug: Fixed
+
+- Generate negative test cases for large nested arrays during the coverage phase.
+- Generate strings larger than 10000 characters during the coverage phase.
+- Internal error on building a JUnit report if the same failures appear multiple times across multiple test phases. [#2814](https://github.com/schemathesis/schemathesis/issues/2814)
+
+## [4.0.0-alpha.9](https://github.com/schemathesis/schemathesis/compare/v4.0.0-alpha.8...v4.0.0-alpha.9) - 2025-05-06
+
+### :wrench: Changed
+
+- Support basic canonicalisation of regex patterns. For example, `[\\W\\w]` could be replaced with `.` in some scenarios.
+
+### :bug: Fixed
+
+- Missing reference resolution scope when serializing `multipart` payloads. [#2776](https://github.com/schemathesis/schemathesis/issues/2776)
+- Compatibility with hypothesis >= 6.131.4. [#2797](https://github.com/schemathesis/schemathesis/issues/2797)
+- Cover more nested `enum` values during the coverage phase.
+- Avoid extremely slow generation of large strings combined with `patterns` during the coverage phase.
+- Generate objects during the coverage phase even if `"type": "object"` is not present.
+- Generate empty strings in more cases during the coverage phase.
+- Generate nested `items` during the coverage phase.
+- Generate large arrays during the coverage phase.
 
 ## [4.0.0-alpha.8](https://github.com/schemathesis/schemathesis/compare/v4.0.0-alpha.7...v4.0.0-alpha.8) - 2025-04-05
 

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.0.0a8
+Version: 4.0.0a10
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://schemathesis.readthedocs.io/en/stable/changelog.html

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/docs/reference/configuration.md

@@ -3,7 +3,7 @@
 This reference covers all the configuration options available in `schemathesis.toml`. The settings are organized into two main categories:
 
 - **Global**: These control CLI behavior, output formatting, and overall test execution. They are defined at the top level and affect the CLI invocation.
-- **Per-Project**: These let you customize configurations for individual API projects. If project-level settings are placed at the top level (without a `[project.<name>]` namespace), they are used as defaults for any tested project.
+- **Per-Project**: These let you customize configurations for individual API projects. If project-level settings are placed at the top level (without a `[[project]]` namespace), they are used as defaults for any tested project.
 
 ## Configuration Resolution
 
@@ -13,7 +13,7 @@ Schemathesis applies settings in the following hierarchy (from highest to lowest
 2. Operation-specific phase settings
 3. Global phase settings (e.g., `[phases.fuzzing]`)
 4. Operation-level settings (e.g., `[[operations]]`)
-5. Project-level settings (e.g., `[[projects]]`)
+5. Project-level settings (e.g., `[[project]]`)
 6. Global settings
 
 ## Environment Variable Substitution
@@ -93,6 +93,19 @@ parameters = { "path.user_id" = 42, "query.user_id" = 100 }
     suppress-health-check = ["too_slow", "data_too_large"]
     ```
 
+#### `seed`
+
+!!! note ""
+
+    **Type:** `Integer`  
+    **Default:** `null`  
+
+    Random seed for reproducible test runs. Setting the same seed value will result in the same sequence of generated test cases.
+
+    ```toml
+    seed = 42
+    ```
+
 #### `max-failures`
 
 !!! note ""
@@ -168,7 +181,7 @@ parameters = { "path.user_id" = 42, "query.user_id" = 100 }
 
 ### Output
 
-#### `output.sanitize`
+#### `output.sanitization.enabled`
 
 !!! note ""
 
@@ -178,22 +191,106 @@ parameters = { "path.user_id" = 42, "query.user_id" = 100 }
     Controls automatic sanitization of output data to obscure sensitive information.
 
     ```toml
-    [output]
-    sanitize = false
+    [output.sanitization]
+    enabled = false
+    ```
+
+#### `output.sanitization.keys-to-sanitize`
+
+!!! note ""
+
+    **Type**: `List[String]`  
+    **Default**: List of common sensitive keys (auth tokens, passwords, etc.)  
+
+    Specific keys that will be automatically sanitized in output data.
+
+    ```toml
+    [output.sanitization]
+    keys-to-sanitize = ["password", "token", "auth"]
+    ```
+
+#### `output.sanitization.sensitive-markers`
+
+!!! note ""
+
+    **Type**: `List[String]`  
+    **Default**: `["token", "key", "secret", "password", "auth", "session", "passwd", "credential"]`  
+
+    Substrings that indicate a key might contain sensitive information requiring sanitization.
+
+    ```toml
+    [output.sanitization]
+    sensitive-markers = ["secret", "auth", "key"]
+    ```
+
+#### `output.sanitization.replacement`
+
+!!! note ""
+
+    **Type**: `String`  
+    **Default**: `"[Filtered]"`  
+
+    The text used to replace sensitive data in output.
+
+    ```toml
+    [output.sanitization]
+    replacement = "***REDACTED***"
     ```
 
-#### `output.truncate`
+#### `output.truncation.enabled`
 
 !!! note ""
 
     **Type**: `Boolean`  
     **Default**: `true`  
 
-    Truncates long output in error messages for improved readability.
+    Controls whether large output data should be truncated.
+
+    ```toml
+    [output.truncation]
+    enabled = false
+    ```
+
+#### `output.truncation.max-payload-size`
+
+!!! note ""
+
+    **Type**: `Integer`  
+    **Default**: `512`  
+
+    Maximum size in bytes for payloads before truncation occurs.
 
     ```toml
-    [output]
-    truncate = false
+    [output.truncation]
+    max-payload-size = 1024
+    ```
+
+#### `output.truncation.max-lines`
+
+!!! note ""
+
+    **Type**: `Integer`  
+    **Default**: `10`  
+
+    Maximum number of lines to display for multi-line output.
+
+    ```toml
+    [output.truncation]
+    max-lines = 20
+    ```
+
+#### `output.truncation.max-width`
+
+!!! note ""
+
+    **Type**: `Integer`  
+    **Default**: `80`  
+
+    Maximum width in characters for each line before horizontal truncation.
+
+    ```toml
+    [output.truncation]
+    max-width = 100
     ```
 
 ## Project Settings
@@ -211,7 +308,7 @@ These settings can only be applied at the project level.
 
     ```toml
     # Optionally under a named project
-    # [[projects]]
+    # [[project]]
     base-url = "https://api.example.com"
     ```
 
@@ -229,7 +326,7 @@ These settings can only be applied at the project level.
     hooks = "myproject.tests.hooks"
     
     # Or project-specific hooks
-    # [[projects]]
+    # [[project]]
     # hooks = "myproject.payments.hooks"
     ```
 
@@ -329,6 +426,20 @@ These settings can only be applied at the project level.
     unexpected-methods = ["PATCH"]
     ```
 
+#### `phases.<phase>.checks`
+
+!!! note "" 
+
+    **Type**: `Object`  
+    **Default**: `{}`  
+
+    Phase-specific overrides for checks.
+
+    ```toml
+    [phases.coverage.checks]
+    not_a_server_error.enabled = false
+    ```
+
 ### Authentication
 
 #### `auth.basic`
@@ -625,20 +736,6 @@ The following settings control how Schemathesis generates test data for your API
     max-examples = 200
     ```
 
-#### `generation.seed`
-
-!!! note ""
-
-    **Type:** `Integer`  
-    **Default:** `null`  
-
-    Random seed for reproducible test runs. Setting the same seed value will result in the same sequence of generated test cases.
-
-    ```toml
-    [generation]
-    seed = 42
-    ```
-
 #### `generation.no-shrink`
 
 !!! note ""
@@ -681,6 +778,21 @@ The following settings control how Schemathesis generates test data for your API
     allow-x00 = false
     ```
 
+
+#### `generation.exclude-header-characters`
+
+!!! note ""
+
+    **Type:** `String`  
+    **Default:** `\r\n`  
+
+    All characters from the given strings will be excluded from generated header values.
+
+    ```toml
+    [generation]
+    exclude-header-characters = "\r\nABC"
+    ```
+
 #### `generation.codec`
 
 !!! note ""

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/docs/using/configuration.md

@@ -83,7 +83,7 @@ The basic setting corresponds to the `--auth` CLI option, while bearer tokens ca
 
 !!! tip "Operation-specific Authentication"
 
-    You can also override auth on the [per-operation basic](#operation-specific-authentication).
+    You can also override auth on the [per-operation basis](#operation-specific-authentication).
 
 ### OpenAPI Security Schemes
 
@@ -443,6 +443,8 @@ request-timeout = 5.0
 phases.fuzzing.generation.max-examples = 200 
 # Reduce examples for stateful tests
 phases.stateful.generation.max-examples = 30
+# Disable a check for examples tests
+phases.examples.checks.not_a_server_error.enabled = false
 ```
 ### Resolution Order for Phase-Operation Settings
 
@@ -540,10 +542,10 @@ Schemathesis lets you configure multiple API projects in one file—a handy feat
 
 ### Defining Projects
 
-Define projects in the `[[projects]]` section by matching the API's title:
+Define projects in `[[project]]` tables by matching the API's title:
 
 ```toml
-[[projects]]
+[[project]]
 # Projects are matched by the API schema's `info.title``
 title = "Payment Processing API"
 base-url = "https://payments.example.com"
@@ -556,14 +558,14 @@ Schemathesis checks the `info.title` field of the API schema to apply the corres
 Override global defaults with project-specific settings:
 
 ```toml
-[[projects]]
+[[project]]
 title = "Payment Processing API"
 base-url = "https://payments.example.com"
 workers = 4
 generation.max-examples = 200
 hooks = "test.config.hooks.example"
 
-[[projects]]
+[[project]]
 title = "User Management API"
 base-url = "https://users.example.com"
 workers = 2
@@ -574,15 +576,15 @@ workers = 2
 Customize operations within a project:
 
 ```toml
-[[projects]]
+[[project]]
 title = "Payment Processing API"
 
-[[projects.operations]]
+[[project.operations]]
 include-name = "POST /payments"
 generation.max-examples = 80
 headers = { "X-Idempotency-Key" = "${IDEMPOTENCY_KEY}" }
 
-[[projects.operations]]
+[[project.operations]]
 include-tag = "slow"
 request-timeout = 10.0
 ```
@@ -603,20 +605,20 @@ When using projects, settings are applied in this order:
 generation.max-examples = 50
 workers = 2
 
-[[projects]]
+[[project]]
 title = "Payment Processing API"
 base-url = "https://payments.example.com"
 generation.max-examples = 100
 
 # Operations for payments
-[[projects.operations]]
+[[project.operations]]
 include-name = "POST /payments"
 generation.max-examples = 200
 parameters = { amount = [10, 100, 1000] }
 checks.positive_data_acceptance.expected-statuses = [200, 201]
 
 # Users project settings
-[[projects]]
+[[project]]
 title = "User Management API"
 base-url = "https://users.example.com"
 ```

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.0.0-alpha.8"
+version = "4.0.0-alpha.10"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/src/schemathesis/cli/commands/run/handlers/junitxml.py

@@ -23,7 +23,7 @@ class JunitXMLHandler(EventHandler):
             label = event.recorder.label
             test_case = self.get_or_create_test_case(label)
             test_case.elapsed_sec += event.elapsed_time
-            if event.status == Status.FAILURE:
+            if event.status == Status.FAILURE and label in ctx.statistic.failures:
                 add_failure(test_case, ctx.statistic.failures[label].values(), ctx)
             elif event.status == Status.SKIP and event.skip_reason is not None:
                 test_case.add_skipped_info(output=event.skip_reason)

{schemathesis-4.0.0a8 → schemathesis-4.0.0a10}/src/schemathesis/core/__init__.py

@@ -4,6 +4,7 @@ import enum
 from dataclasses import dataclass
 
 SCHEMATHESIS_TEST_CASE_HEADER = "X-Schemathesis-TestCaseId"
+INTERNAL_BUFFER_SIZE = 32 * 1024
 
 
 class NotSet: ...