schemathesis 4.0.16__tar.gz → 4.0.18__tar.gz

{schemathesis-4.0.16 → schemathesis-4.0.18}/CHANGELOG.md

@@ -1,12 +1,30 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.16...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.18...HEAD) - TBD
+
+## [4.0.18](https://github.com/schemathesis/schemathesis/compare/v4.0.17...v4.0.18) - 2025-08-02
+
+### :bug: Fixed
+
+- Correctly merge quantifiers into regular expressions with anchors and a single literal.
+- Internal error if a parameter schema contains `required` with a boolean value instead of an array.
+
+### :wrench: Changed
+
+- Do not show excessive warnings about unsupported regex in CLI during the coverage phase.
+
+## [4.0.17](https://github.com/schemathesis/schemathesis/compare/v4.0.16...v4.0.17) - 2025-08-02
+
+### :bug: Fixed
+
+- Generating negative test cases incorrectly marked as invalid if `anyOf` or `oneOf` are present. [#2975](https://github.com/schemathesis/schemathesis/issues/2975)
+- Set correct data generation mode for stateful test cases if after adding stateful data, a negative test case becomes positive. [#2983](https://github.com/schemathesis/schemathesis/issues/2983) 
 
 ## [4.0.16](https://github.com/schemathesis/schemathesis/compare/v4.0.15...v4.0.16) - 2025-07-31
 
 ### :bug: Fixed
 
-- Internal error if the stateful phase is used with `--generation-unique-inputs`. [#2977](https://github.com/schemathesis/schemathesis/issues/2977) 
+- Internal error if the stateful phase is used with `--generation-unique-inputs`. [#2977](https://github.com/schemathesis/schemathesis/issues/2977)
 - Do not show auth headers for cases when the test case was sent specifically without auth.
 - Do not show unnecessary auth warning if the only test that happened was for missing auth.
 

{schemathesis-4.0.16 → schemathesis-4.0.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.0.16
+Version: 4.0.18
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.0.16 → schemathesis-4.0.18}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.0.16"
+version = "4.0.18"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.0.16 → schemathesis-4.0.18}/src/schemathesis/generation/coverage.py

@@ -597,12 +597,49 @@ def cover_schema_iter(
                         with _ignore_unfixable():
                             canonical = canonicalish(schema)
                             yield from cover_schema_iter(nctx, canonical, seen)
-                elif key == "anyOf" or key == "oneOf":
+                elif key == "anyOf":
                     nctx = ctx.with_negative()
-                    # NOTE: Other sub-schemas are not filtered out
+                    validators = [jsonschema.validators.validator_for(sub_schema)(sub_schema) for sub_schema in value]
                     for idx, sub_schema in enumerate(value):
                         with nctx.at(idx):
-                            yield from cover_schema_iter(nctx, sub_schema, seen)
+                            for value in cover_schema_iter(nctx, sub_schema, seen):
+                                # Negative value for this schema could be a positive value for another one
+                                if is_valid_for_others(value.value, idx, validators):
+                                    continue
+                                yield value
+                elif key == "oneOf":
+                    nctx = ctx.with_negative()
+                    validators = [jsonschema.validators.validator_for(sub_schema)(sub_schema) for sub_schema in value]
+                    for idx, sub_schema in enumerate(value):
+                        with nctx.at(idx):
+                            for value in cover_schema_iter(nctx, sub_schema, seen):
+                                if is_invalid_for_oneOf(value.value, idx, validators):
+                                    yield value
+
+
+def is_valid_for_others(value: Any, idx: int, validators: list[jsonschema.Validator]) -> bool:
+    for vidx, validator in enumerate(validators):
+        if idx == vidx:
+            # This one is being negated
+            continue
+        if validator.is_valid(value):
+            return True
+    return False
+
+
+def is_invalid_for_oneOf(value: Any, idx: int, validators: list[jsonschema.Validator]) -> bool:
+    valid_count = 0
+    for vidx, validator in enumerate(validators):
+        if idx == vidx:
+            # This one is being negated
+            continue
+        if validator.is_valid(value):
+            valid_count += 1
+            # Should circuit - no need to validate more, it is already invalid
+            if valid_count > 1:
+                return True
+    # No matching at all - we successfully generated invalid value
+    return valid_count == 0
 
 
 def _get_properties(schema: dict | bool) -> dict | bool:

{schemathesis-4.0.16 → schemathesis-4.0.18}/src/schemathesis/generation/hypothesis/builder.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import asyncio
+import warnings
 from dataclasses import dataclass
 from enum import Enum
 from functools import wraps
@@ -311,25 +312,30 @@ def add_coverage(
         for container in LOCATION_TO_CONTAINER.values()
         if container in as_strategy_kwargs
     }
-    for case in _iter_coverage_cases(
-        operation=operation,
-        generation_modes=generation_modes,
-        generate_duplicate_query_parameters=generate_duplicate_query_parameters,
-        unexpected_methods=unexpected_methods,
-        generation_config=generation_config,
-    ):
-        if case.media_type and operation.schema.transport.get_first_matching_media_type(case.media_type) is None:
-            continue
-        adjust_urlencoded_payload(case)
-        auths.set_on_case(case, auth_context, auth_storage)
-        for container_name, value in overrides.items():
-            container = getattr(case, container_name)
-            if container is None:
-                setattr(case, container_name, value)
-            else:
-                container.update(value)
-
-        test = hypothesis.example(case=case)(test)
+
+    with warnings.catch_warnings():
+        warnings.filterwarnings(
+            "ignore", message=".*but this is not valid syntax for a Python regular expression.*", category=UserWarning
+        )
+        for case in _iter_coverage_cases(
+            operation=operation,
+            generation_modes=generation_modes,
+            generate_duplicate_query_parameters=generate_duplicate_query_parameters,
+            unexpected_methods=unexpected_methods,
+            generation_config=generation_config,
+        ):
+            if case.media_type and operation.schema.transport.get_first_matching_media_type(case.media_type) is None:
+                continue
+            adjust_urlencoded_payload(case)
+            auths.set_on_case(case, auth_context, auth_storage)
+            for container_name, value in overrides.items():
+                container = getattr(case, container_name)
+                if container is None:
+                    setattr(case, container_name, value)
+                else:
+                    container.update(value)
+
+            test = hypothesis.example(case=case)(test)
     return test
 
 

{schemathesis-4.0.16 → schemathesis-4.0.18}/src/schemathesis/specs/openapi/converter.py

@@ -32,6 +32,21 @@ def to_json_schema(
         schema["format"] = "binary"
     if update_quantifiers:
         update_pattern_in_schema(schema)
+    # Sometimes `required` is incorrectly has a boolean value
+    properties = schema.get("properties")
+    if properties:
+        for name, subschema in properties.items():
+            if not isinstance(subschema, dict):
+                continue
+            is_required = subschema.get("required")
+            if is_required is True:
+                schema.setdefault("required", []).append(name)
+                del subschema["required"]
+            elif is_required is False:
+                if "required" in schema and name in schema["required"]:
+                    schema["required"].remove(name)
+                del subschema["required"]
+
     if schema_type == "object":
         if is_response_schema:
             # Write-only properties should not occur in responses

{schemathesis-4.0.16 → schemathesis-4.0.18}/src/schemathesis/specs/openapi/patterns.py

@@ -81,6 +81,11 @@ def _handle_parsed_pattern(parsed: list, pattern: str, min_length: int | None, m
             inner_pattern = "."
         else:
             inner_pattern = pattern[leading_anchor_length:-trailing_anchor_length]
+        # Single literal has the length of 1, but quantifiers could be != 1, which means we can't merge them
+        if op == LITERAL and (
+            (min_length is not None and min_length > 1) or (max_length is not None and max_length < 1)
+        ):
+            return pattern
         return leading_anchor + _update_quantifier(op, value, inner_pattern, min_length, max_length) + trailing_anchor
     elif (
         len(parsed) > 3

{schemathesis-4.0.16 → schemathesis-4.0.18}/src/schemathesis/specs/openapi/stateful/__init__.py

@@ -4,6 +4,7 @@ from dataclasses import dataclass
 from functools import lru_cache
 from typing import TYPE_CHECKING, Any, Callable, Iterator
 
+import jsonschema
 from hypothesis import strategies as st
 from hypothesis.stateful import Bundle, Rule, precondition, rule
 
@@ -14,6 +15,7 @@ from schemathesis.engine.recorder import ScenarioRecorder
 from schemathesis.generation import GenerationMode
 from schemathesis.generation.case import Case
 from schemathesis.generation.hypothesis import strategies
+from schemathesis.generation.meta import ComponentInfo, ComponentKind
 from schemathesis.generation.stateful import STATEFUL_TESTS_LABEL
 from schemathesis.generation.stateful.state_machine import APIStateMachine, StepInput, StepOutput, _normalize_name
 from schemathesis.schemas import APIOperation
@@ -281,6 +283,15 @@ def into_step_input(
                     case.body = {**case.body, **new}
                 else:
                     case.body = new
+                if case.meta and case.meta.generation.mode == GenerationMode.NEGATIVE:
+                    # It is possible that the new body is now valid and the whole test case could be valid too
+                    for alternative in case.operation.body:
+                        if alternative.media_type == case.media_type:
+                            schema = alternative.as_json_schema(case.operation)
+                            if jsonschema.validators.validator_for(schema)(schema).is_valid(new):
+                                case.meta.components[ComponentKind.BODY] = ComponentInfo(mode=GenerationMode.POSITIVE)
+                                if all(info.mode == GenerationMode.POSITIVE for info in case.meta.components.values()):
+                                    case.meta.generation.mode = GenerationMode.POSITIVE
             return StepInput(case=case, transition=transition)
 
         return inner(output=_output)

schemathesis-4.0.18/test/cli/__snapshots__/test_commands/test_required_as_boolean[in-required-False].raw

@@ -0,0 +1,59 @@
+Exit code: 0
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ⏭   Examples (in 0.00s)
+
+     ⏭  1 skipped
+
+ ✅  Coverage (in 0.00s)
+
+     ✅ 1 passed
+
+ ✅  Fuzzing (in 0.00s)
+
+     ✅ 1 passed
+
+=================================== WARNINGS ===================================
+
+Schema validation mismatch: 1 operation mostly rejected generated data due to validation errors, indicating schema constraints don't match API validation
+
+  - POST /success
+
+💡 Check your schema constraints - API validation may be stricter than documented
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 1
+
+Test Phases:
+  ⏭  Examples
+  ✅ Coverage
+  ✅ Fuzzing
+  ⏭  Stateful (not applicable)
+
+Warnings:
+  ⚠️ Schema validation mismatch: 1 operation mostly rejected generated data
+
+Test cases:
+  N generated, N passed
+
+Seed: 42
+
+=========================== No issues found in 1.00s ===========================

schemathesis-4.0.18/test/cli/__snapshots__/test_commands/test_required_as_boolean[in-required-True].raw

@@ -0,0 +1,59 @@
+Exit code: 0
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ⏭   Examples (in 0.00s)
+
+     ⏭  1 skipped
+
+ ✅  Coverage (in 0.00s)
+
+     ✅ 1 passed
+
+ ✅  Fuzzing (in 0.00s)
+
+     ✅ 1 passed
+
+=================================== WARNINGS ===================================
+
+Schema validation mismatch: 1 operation mostly rejected generated data due to validation errors, indicating schema constraints don't match API validation
+
+  - POST /success
+
+💡 Check your schema constraints - API validation may be stricter than documented
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 1
+
+Test Phases:
+  ⏭  Examples
+  ✅ Coverage
+  ✅ Fuzzing
+  ⏭  Stateful (not applicable)
+
+Warnings:
+  ⚠️ Schema validation mismatch: 1 operation mostly rejected generated data
+
+Test cases:
+  N generated, N passed
+
+Seed: 42
+
+=========================== No issues found in 1.00s ===========================

schemathesis-4.0.18/test/cli/__snapshots__/test_commands/test_required_as_boolean[no-required-False].raw

@@ -0,0 +1,59 @@
+Exit code: 0
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ⏭   Examples (in 0.00s)
+
+     ⏭  1 skipped
+
+ ✅  Coverage (in 0.00s)
+
+     ✅ 1 passed
+
+ ✅  Fuzzing (in 0.00s)
+
+     ✅ 1 passed
+
+=================================== WARNINGS ===================================
+
+Schema validation mismatch: 1 operation mostly rejected generated data due to validation errors, indicating schema constraints don't match API validation
+
+  - POST /success
+
+💡 Check your schema constraints - API validation may be stricter than documented
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 1
+
+Test Phases:
+  ⏭  Examples
+  ✅ Coverage
+  ✅ Fuzzing
+  ⏭  Stateful (not applicable)
+
+Warnings:
+  ⚠️ Schema validation mismatch: 1 operation mostly rejected generated data
+
+Test cases:
+  N generated, N passed
+
+Seed: 42
+
+=========================== No issues found in 1.00s ===========================

schemathesis-4.0.18/test/cli/__snapshots__/test_commands/test_required_as_boolean[no-required-True].raw

@@ -0,0 +1,59 @@
+Exit code: 0
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ⏭   Examples (in 0.00s)
+
+     ⏭  1 skipped
+
+ ✅  Coverage (in 0.00s)
+
+     ✅ 1 passed
+
+ ✅  Fuzzing (in 0.00s)
+
+     ✅ 1 passed
+
+=================================== WARNINGS ===================================
+
+Schema validation mismatch: 1 operation mostly rejected generated data due to validation errors, indicating schema constraints don't match API validation
+
+  - POST /success
+
+💡 Check your schema constraints - API validation may be stricter than documented
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 1
+
+Test Phases:
+  ⏭  Examples
+  ✅ Coverage
+  ✅ Fuzzing
+  ⏭  Stateful (not applicable)
+
+Warnings:
+  ⚠️ Schema validation mismatch: 1 operation mostly rejected generated data
+
+Test cases:
+  N generated, N passed
+
+Seed: 42
+
+=========================== No issues found in 1.00s ===========================

schemathesis-4.0.18/test/cli/__snapshots__/test_commands/test_required_as_boolean[not-in-required-False].raw

@@ -0,0 +1,59 @@
+Exit code: 0
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ⏭   Examples (in 0.00s)
+
+     ⏭  1 skipped
+
+ ✅  Coverage (in 0.00s)
+
+     ✅ 1 passed
+
+ ✅  Fuzzing (in 0.00s)
+
+     ✅ 1 passed
+
+=================================== WARNINGS ===================================
+
+Schema validation mismatch: 1 operation mostly rejected generated data due to validation errors, indicating schema constraints don't match API validation
+
+  - POST /success
+
+💡 Check your schema constraints - API validation may be stricter than documented
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 1
+
+Test Phases:
+  ⏭  Examples
+  ✅ Coverage
+  ✅ Fuzzing
+  ⏭  Stateful (not applicable)
+
+Warnings:
+  ⚠️ Schema validation mismatch: 1 operation mostly rejected generated data
+
+Test cases:
+  N generated, N passed
+
+Seed: 42
+
+=========================== No issues found in 1.00s ===========================

schemathesis-4.0.18/test/cli/__snapshots__/test_commands/test_required_as_boolean[not-in-required-True].raw

@@ -0,0 +1,59 @@
+Exit code: 0
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ⏭   Examples (in 0.00s)
+
+     ⏭  1 skipped
+
+ ✅  Coverage (in 0.00s)
+
+     ✅ 1 passed
+
+ ✅  Fuzzing (in 0.00s)
+
+     ✅ 1 passed
+
+=================================== WARNINGS ===================================
+
+Schema validation mismatch: 1 operation mostly rejected generated data due to validation errors, indicating schema constraints don't match API validation
+
+  - POST /success
+
+💡 Check your schema constraints - API validation may be stricter than documented
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 1
+
+Test Phases:
+  ⏭  Examples
+  ✅ Coverage
+  ✅ Fuzzing
+  ⏭  Stateful (not applicable)
+
+Warnings:
+  ⚠️ Schema validation mismatch: 1 operation mostly rejected generated data
+
+Test cases:
+  N generated, N passed
+
+Seed: 42
+
+=========================== No issues found in 1.00s ===========================

{schemathesis-4.0.16 → schemathesis-4.0.18}/test/cli/test_commands.py

@@ -557,6 +557,50 @@ async def test_multiple_files_schema(ctx, openapi_2_app, cli, hypothesis_max_exa
     assert isinstance(payload["photoUrls"], list)
 
 
+@pytest.mark.parametrize("required", [True, False])
+@pytest.mark.parametrize(
+    "kwargs",
+    [
+        {},
+        {"required": []},
+        {"required": ["region"]},
+    ],
+    ids=["no-required", "not-in-required", "in-required"],
+)
+def test_required_as_boolean(ctx, cli, snapshot_cli, openapi3_base_url, required, kwargs):
+    # Happens in the wild, even though it is incorrect
+    schema_path = ctx.openapi.write_schema(
+        {
+            "/success": {
+                "post": {
+                    "requestBody": {
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "properties": {
+                                        "region": {
+                                            "required": required,
+                                            "type": "string",
+                                        },
+                                    },
+                                    "type": "object",
+                                    **kwargs,
+                                }
+                            }
+                        },
+                        "required": True,
+                    },
+                    "responses": {"200": {"description": "OK"}},
+                }
+            }
+        }
+    )
+    assert (
+        cli.run(str(schema_path), f"--url={openapi3_base_url}", "-c not_a_server_error", "--max-examples=5")
+        == snapshot_cli
+    )
+
+
 def test_no_useless_traceback(ctx, cli, snapshot_cli, openapi3_base_url):
     schema_path = ctx.openapi.write_schema(
         {