schemathesis 4.0.25__tar.gz → 4.0.26__tar.gz

{schemathesis-4.0.25 → schemathesis-4.0.26}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.29.5
+        uses: github/codeql-action/init@v3.29.8
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.29.5
+        uses: github/codeql-action/autobuild@v3.29.8
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.29.5
+        uses: github/codeql-action/analyze@v3.29.8

{schemathesis-4.0.25 → schemathesis-4.0.26}/.github/workflows/memory-benchmark.yml

@@ -33,14 +33,14 @@ jobs:
           path: memory-benchmark-results/
           retention-days: 30
 
-      - uses: peter-evans/find-comment@v2
+      - uses: peter-evans/find-comment@v3
         id: fc
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: 'github-actions[bot]'
           body-includes: Memory Benchmark Results
 
-      - uses: peter-evans/create-or-update-comment@v3
+      - uses: peter-evans/create-or-update-comment@v4
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}

{schemathesis-4.0.25 → schemathesis-4.0.26}/CHANGELOG.md

@@ -1,11 +1,25 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.25...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.26...HEAD) - TBD
 
-## [4.0.25](https://github.com/schemathesis/schemathesis/compare/v4.0.24...v4.0.25) - 2025-08-10
+## [4.0.26](https://github.com/schemathesis/schemathesis/compare/v4.0.25...v4.0.26) - 2025-08-12
+
+### :rocket: Added
+
+- Support the `const`, `additionalItems`, `dependencies`, `if`, `then`, `else`, `patternProperties`, `propertyNames`, `contains`, keywords in top-level parameter schemas.
+- **Coverage phase**: Generate values for empty schemas.
+- **Coverage phase**: Generate values for `not` keyword and `false` JSON Schemas.
 
 ### :bug: Fixed
 
+- **Coverage phase**: Error 'Path parameter is not defined' if the parameter schema is empty.
+- Properly assign the "stateful" phase value in metadata of test cases generated during the stateful phase.
+- False positive `API accepted schema-violating request` caused by passing security-related header via CLI during the stateful phase.
+
+## [4.0.25](https://github.com/schemathesis/schemathesis/compare/v4.0.24...v4.0.25) - 2025-08-10
+  
+### :bug: Fixed
+
 - `workers = "auto"` being incorrectly rejected in configuration files. [#3015](https://github.com/schemathesis/schemathesis/issues/3015)
 
 ### :wrench: Changed

{schemathesis-4.0.25 → schemathesis-4.0.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.0.25
+Version: 4.0.26
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.0.25 → schemathesis-4.0.26}/benches/memory/measure.py

@@ -14,7 +14,7 @@ def run_memray(schema_path: str, args: list[str]) -> dict[str, Any]:
         cmd = (
             ["memray", "run", "--force", "-o", memray_output, "-m", "schemathesis.cli", "run"]
             + args
-            + ["-u http://127.0.0.1:8000", schema_path]
+            + ["-u http://127.0.0.1:8000", "--seed=1", schema_path]
         )
 
         subprocess.run(

{schemathesis-4.0.25 → schemathesis-4.0.26}/benches/memory/scenarios.json

@@ -15,6 +15,14 @@
         "--phases=coverage",
         "--continue-on-failure"
       ]
+    },
+    {
+      "name": "stateful_users",
+      "schema": "stateful_users.yaml",
+      "args": [
+        "--phases=stateful",
+        "--continue-on-failure"
+      ]
     }
   ]
 }

schemathesis-4.0.26/benches/memory/schemas/stateful_users.yaml

@@ -0,0 +1,372 @@
+openapi: 3.0.3
+info:
+  title: Stateful User Management API
+  version: 1.0.0
+  description: Simple API with OpenAPI links for stateful testing
+
+paths:
+  /users:
+    post:
+      operationId: createUser
+      summary: Create a new user
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - username
+                - email
+              properties:
+                username:
+                  type: string
+                  minLength: 3
+                  maxLength: 50
+                email:
+                  type: string
+                  format: email
+                age:
+                  type: integer
+                  minimum: 18
+                  maximum: 120
+      responses:
+        '201':
+          description: User created successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/User'
+          links:
+            GetUser:
+              operationId: getUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Get created user by ID
+            UpdateUser:
+              operationId: updateUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Update created user
+            DeleteUser:
+              operationId: deleteUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Delete created user
+
+    get:
+      operationId: listUsers
+      summary: List all users
+      parameters:
+        - name: limit
+          in: query
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 100
+            default: 10
+        - name: offset
+          in: query
+          schema:
+            type: integer
+            minimum: 0
+            default: 0
+      responses:
+        '200':
+          description: List of users
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  users:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/User'
+                  total:
+                    type: integer
+          links:
+            GetFirstUser:
+              operationId: getUser
+              parameters:
+                userId: '$response.body#/users/0/id'
+              description: Get first user from list
+
+  /users/{userId}:
+    parameters:
+      - name: userId
+        in: path
+        required: true
+        schema:
+          type: string
+          format: uuid
+
+    get:
+      operationId: getUser
+      summary: Get user by ID
+      responses:
+        '200':
+          description: User found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/User'
+          links:
+            UpdateThisUser:
+              operationId: updateUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Update this user
+            DeleteThisUser:
+              operationId: deleteUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Delete this user
+            GetUserPosts:
+              operationId: getUserPosts
+              parameters:
+                userId: '$response.body#/id'
+              description: Get posts by this user
+        '404':
+          description: User not found
+
+    put:
+      operationId: updateUser
+      summary: Update user
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                username:
+                  type: string
+                  minLength: 3
+                  maxLength: 50
+                email:
+                  type: string
+                  format: email
+                age:
+                  type: integer
+                  minimum: 18
+                  maximum: 120
+                status:
+                  type: string
+                  enum: ['active', 'inactive', 'suspended']
+      responses:
+        '200':
+          description: User updated
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/User'
+          links:
+            VerifyUpdate:
+              operationId: getUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Verify the update by getting user
+        '404':
+          description: User not found
+
+    delete:
+      operationId: deleteUser
+      summary: Delete user
+      responses:
+        '204':
+          description: User deleted successfully
+        '404':
+          description: User not found
+
+  /users/{userId}/posts:
+    parameters:
+      - name: userId
+        in: path
+        required: true
+        schema:
+          type: string
+          format: uuid
+
+    get:
+      operationId: getUserPosts
+      summary: Get posts by user
+      responses:
+        '200':
+          description: User posts
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  posts:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/Post'
+          links:
+            GetFirstPost:
+              operationId: getPost
+              parameters:
+                postId: '$response.body#/posts/0/id'
+              description: Get first post details
+
+    post:
+      operationId: createPost
+      summary: Create a post for user
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - title
+                - content
+              properties:
+                title:
+                  type: string
+                  minLength: 1
+                  maxLength: 200
+                content:
+                  type: string
+                  minLength: 1
+                  maxLength: 5000
+      responses:
+        '201':
+          description: Post created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Post'
+          links:
+            GetCreatedPost:
+              operationId: getPost
+              parameters:
+                postId: '$response.body#/id'
+              description: Get the created post
+            UpdateCreatedPost:
+              operationId: updatePost
+              parameters:
+                postId: '$response.body#/id'
+              description: Update the created post
+            DeleteCreatedPost:
+              operationId: deletePost
+              parameters:
+                postId: '$response.body#/id'
+              description: Delete the created post
+
+  /posts/{postId}:
+    parameters:
+      - name: postId
+        in: path
+        required: true
+        schema:
+          type: string
+          format: uuid
+
+    get:
+      operationId: getPost
+      summary: Get post by ID
+      responses:
+        '200':
+          description: Post found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Post'
+          links:
+            GetPostAuthor:
+              operationId: getUser
+              parameters:
+                userId: '$response.body#/authorId'
+              description: Get the post author
+
+    put:
+      operationId: updatePost
+      summary: Update post
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                title:
+                  type: string
+                  minLength: 1
+                  maxLength: 200
+                content:
+                  type: string
+                  minLength: 1
+                  maxLength: 5000
+      responses:
+        '200':
+          description: Post updated
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Post'
+
+    delete:
+      operationId: deletePost
+      summary: Delete post
+      responses:
+        '204':
+          description: Post deleted
+        '404':
+          description: Post not found
+
+components:
+  schemas:
+    User:
+      type: object
+      required:
+        - id
+        - username
+        - email
+      properties:
+        id:
+          type: string
+          format: uuid
+        username:
+          type: string
+        email:
+          type: string
+          format: email
+        age:
+          type: integer
+        status:
+          type: string
+          enum: ['active', 'inactive', 'suspended']
+          default: 'active'
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time
+
+    Post:
+      type: object
+      required:
+        - id
+        - title
+        - content
+        - authorId
+      properties:
+        id:
+          type: string
+          format: uuid
+        title:
+          type: string
+        content:
+          type: string
+        authorId:
+          type: string
+          format: uuid
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time

{schemathesis-4.0.25 → schemathesis-4.0.26}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.0.25"
+version = "4.0.26"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.0.25 → schemathesis-4.0.26}/src/schemathesis/engine/phases/unit/_executor.py

@@ -263,12 +263,7 @@ def setup_hypothesis_database_key(test: Callable, operation: APIOperation) -> No
 
     It increases the effectiveness of the Hypothesis database in the CLI.
     """
-    # Hypothesis's function digest depends on the test function signature. To reflect it for the web API case,
-    # we use all API operation parameters in the digest.
-    extra = operation.label.encode("utf8")
-    for parameter in operation.iter_parameters():
-        extra += parameter.serialize(operation).encode("utf8")
-    test.hypothesis.inner_test._hypothesis_internal_add_digest = extra  # type: ignore
+    test.hypothesis.inner_test._hypothesis_internal_add_digest = operation.label.encode("utf8")  # type: ignore
 
 
 def get_invalid_regular_expression_message(warnings: list[WarningMessage]) -> str | None:

{schemathesis-4.0.25 → schemathesis-4.0.26}/src/schemathesis/generation/coverage.py

@@ -321,7 +321,7 @@ class HashSet:
 
 
 def _cover_positive_for_type(
-    ctx: CoverageContext, schema: dict, ty: str | None
+    ctx: CoverageContext, schema: dict, ty: str | None, seen: HashSet | None = None
 ) -> Generator[GeneratedValue, None, None]:
     if ty == "object" or ty == "array":
         template_schema = _get_template_schema(schema, ty)
@@ -369,6 +369,9 @@ def _cover_positive_for_type(
                 yield from _positive_object(ctx, schema, cast(dict, template))
         elif "properties" in schema or "required" in schema:
             yield from _positive_object(ctx, schema, cast(dict, template))
+        elif "not" in schema and isinstance(schema["not"], (dict, bool)):
+            nctx = ctx.with_negative()
+            yield from cover_schema_iter(nctx, schema["not"], seen)
 
 
 @contextmanager
@@ -397,9 +400,12 @@ def cover_schema_iter(
 ) -> Generator[GeneratedValue, None, None]:
     if seen is None:
         seen = HashSet()
-    if isinstance(schema, bool):
+    if schema == {} or schema is True:
         types = ["null", "boolean", "string", "number", "array", "object"]
         schema = {}
+    elif schema is False:
+        types = []
+        schema = {"not": {}}
     else:
         types = schema.get("type", [])
     push_examples_to_properties(schema)
@@ -615,6 +621,9 @@ def cover_schema_iter(
                             for value in cover_schema_iter(nctx, sub_schema, seen):
                                 if is_invalid_for_oneOf(value.value, idx, validators):
                                     yield value
+                elif key == "not" and isinstance(value, (dict, bool)):
+                    pctx = ctx.with_positive()
+                    yield from cover_schema_iter(pctx, value, seen)
 
 
 def is_valid_for_others(value: Any, idx: int, validators: list[jsonschema.Validator]) -> bool:
@@ -690,6 +699,7 @@ def _ensure_valid_headers_schema(schema: dict[str, Any]) -> dict[str, Any]:
 def _positive_string(ctx: CoverageContext, schema: dict) -> Generator[GeneratedValue, None, None]:
     """Generate positive string values."""
     # Boundary and near boundary values
+    schema = {"type": "string", **schema}
     min_length = schema.get("minLength")
     if min_length == 0:
         min_length = None
@@ -791,6 +801,7 @@ def closest_multiple_greater_than(y: int, x: int) -> int:
 def _positive_number(ctx: CoverageContext, schema: dict) -> Generator[GeneratedValue, None, None]:
     """Generate positive integer values."""
     # Boundary and near boundary values
+    schema = {"type": "number", **schema}
     minimum = schema.get("minimum")
     maximum = schema.get("maximum")
     exclusive_minimum = schema.get("exclusiveMinimum")

{schemathesis-4.0.25 → schemathesis-4.0.26}/src/schemathesis/generation/hypothesis/builder.py

@@ -234,6 +234,22 @@ def add_examples(
     hook_dispatcher: HookDispatcher | None = None,
     **kwargs: Any,
 ) -> Callable:
+    for example in generate_example_cases(
+        test=test, operation=operation, fill_missing=fill_missing, hook_dispatcher=hook_dispatcher, **kwargs
+    ):
+        test = hypothesis.example(case=example)(test)
+
+    return test
+
+
+def generate_example_cases(
+    *,
+    test: Callable,
+    operation: APIOperation,
+    fill_missing: bool,
+    hook_dispatcher: HookDispatcher | None = None,
+    **kwargs: Any,
+) -> Generator[Case]:
     """Add examples to the Hypothesis test, if they are specified in the schema."""
     from hypothesis_jsonschema._canonicalise import HypothesisRefResolutionError
 
@@ -273,9 +289,7 @@ def add_examples(
                 InvalidHeadersExampleMark.set(original_test, invalid_headers)
                 continue
         adjust_urlencoded_payload(example)
-        test = hypothesis.example(case=example)(test)
-
-    return test
+        yield example
 
 
 def adjust_urlencoded_payload(case: Case) -> None:
@@ -298,6 +312,29 @@ def add_coverage(
     unexpected_methods: set[str],
     generation_config: GenerationConfig,
 ) -> Callable:
+    for case in generate_coverage_cases(
+        operation=operation,
+        generation_modes=generation_modes,
+        auth_storage=auth_storage,
+        as_strategy_kwargs=as_strategy_kwargs,
+        generate_duplicate_query_parameters=generate_duplicate_query_parameters,
+        unexpected_methods=unexpected_methods,
+        generation_config=generation_config,
+    ):
+        test = hypothesis.example(case=case)(test)
+    return test
+
+
+def generate_coverage_cases(
+    *,
+    operation: APIOperation,
+    generation_modes: list[GenerationMode],
+    auth_storage: AuthStorage | None,
+    as_strategy_kwargs: dict[str, Any],
+    generate_duplicate_query_parameters: bool,
+    unexpected_methods: set[str],
+    generation_config: GenerationConfig,
+) -> Generator[Case]:
     from schemathesis.specs.openapi.constants import LOCATION_TO_CONTAINER
 
     auth_context = auths.AuthContext(
@@ -309,7 +346,6 @@ def add_coverage(
         for container in LOCATION_TO_CONTAINER.values()
         if container in as_strategy_kwargs
     }
-
     with warnings.catch_warnings():
         warnings.filterwarnings(
             "ignore", message=".*but this is not valid syntax for a Python regular expression.*", category=UserWarning
@@ -331,9 +367,7 @@ def add_coverage(
                     setattr(case, container_name, value)
                 else:
                     container.update(value)
-
-            test = hypothesis.example(case=case)(test)
-    return test
+            yield case
 
 
 class Instant:

{schemathesis-4.0.25 → schemathesis-4.0.26}/src/schemathesis/generation/meta.py

@@ -12,6 +12,7 @@ class TestPhase(str, Enum):
     EXAMPLES = "examples"
     COVERAGE = "coverage"
     FUZZING = "fuzzing"
+    STATEFUL = "stateful"
 
 
 class ComponentKind(str, Enum):
@@ -34,15 +35,22 @@ class ComponentInfo:
 
 
 @dataclass
-class GeneratePhaseData:
+class FuzzingPhaseData:
     """Metadata specific to generate phase."""
 
     __slots__ = ()
 
 
 @dataclass
-class ExplicitPhaseData:
-    """Metadata specific to explicit phase."""
+class StatefulPhaseData:
+    """Metadata specific to stateful phase."""
+
+    __slots__ = ()
+
+
+@dataclass
+class ExamplesPhaseData:
+    """Metadata specific to examples phase."""
 
     __slots__ = ()
 
@@ -64,7 +72,7 @@ class PhaseInfo:
     """Phase-specific information."""
 
     name: TestPhase
-    data: CoveragePhaseData | ExplicitPhaseData | GeneratePhaseData
+    data: CoveragePhaseData | ExamplesPhaseData | FuzzingPhaseData | StatefulPhaseData
 
     __slots__ = ("name", "data")
 
@@ -84,8 +92,8 @@ class PhaseInfo:
         )
 
     @classmethod
-    def generate(cls) -> PhaseInfo:
-        return cls(name=TestPhase.FUZZING, data=GeneratePhaseData())
+    def fuzzing(cls) -> PhaseInfo:
+        return cls(name=TestPhase.FUZZING, data=FuzzingPhaseData())
 
 
 @dataclass