schemathesis 4.0.25__tar.gz → 4.1.0__tar.gz

{schemathesis-4.0.25 → schemathesis-4.1.0}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.29.5
+        uses: github/codeql-action/init@v3.29.8
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.29.5
+        uses: github/codeql-action/autobuild@v3.29.8
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.29.5
+        uses: github/codeql-action/analyze@v3.29.8

{schemathesis-4.0.25 → schemathesis-4.1.0}/.github/workflows/memory-benchmark.yml

@@ -33,14 +33,14 @@ jobs:
           path: memory-benchmark-results/
           retention-days: 30
 
-      - uses: peter-evans/find-comment@v2
+      - uses: peter-evans/find-comment@v3
         id: fc
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: 'github-actions[bot]'
           body-includes: Memory Benchmark Results
 
-      - uses: peter-evans/create-or-update-comment@v3
+      - uses: peter-evans/create-or-update-comment@v4
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}

{schemathesis-4.0.25 → schemathesis-4.1.0}/.pre-commit-config.yaml

@@ -33,11 +33,11 @@ repos:
         additional_dependencies: [types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.8
+    rev: v0.12.9
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.8
+    rev: v0.12.9
     hooks:
       - id: ruff-check

{schemathesis-4.0.25 → schemathesis-4.1.0}/CHANGELOG.md

@@ -1,9 +1,41 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.25...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.1.0...HEAD) - TBD
 
-## [4.0.25](https://github.com/schemathesis/schemathesis/compare/v4.0.24...v4.0.25) - 2025-08-10
+## [4.1.0](https://github.com/schemathesis/schemathesis/compare/v4.0.26...v4.1.0) - 2025-08-17
+
+### :rocket: Added
+
+- **Automatic Link Inference**: Schemathesis now automatically generates OpenAPI links by analyzing `Location` headers from API responses. [#2953](https://github.com/schemathesis/schemathesis/issues/2953) 
+- `--max-redirects` CLI & config file option. [#712](https://github.com/schemathesis/schemathesis/issues/712)
+- `enabled` config file option to disable all test phases. [#2951](https://github.com/schemathesis/schemathesis/issues/2951)
+- Support PyPy3 on best effort basis without running tests in CI due to long running time. [#1079](https://github.com/schemathesis/schemathesis/issues/1079)
+
+### :bug: Fixed
+
+- Ignored `codec` for header generation.
+- Properly try to load schema as YAML if the `Content-Type` header is unknown.
+
+### :wrench: Changed
 
+- `before_call` hooks now accept `kwargs` as a regular parameter instead of `**kwargs`. There is a backward compatibility shim for existing hooks with `**kwargs` signatures. The old calling convention will be removed in Schemathesis 5.0. [#3028](https://github.com/schemathesis/schemathesis/issues/3028)
+
+## [4.0.26](https://github.com/schemathesis/schemathesis/compare/v4.0.25...v4.0.26) - 2025-08-12
+
+### :rocket: Added
+
+- Support the `const`, `additionalItems`, `dependencies`, `if`, `then`, `else`, `patternProperties`, `propertyNames`, `contains`, keywords in top-level parameter schemas.
+- **Coverage phase**: Generate values for empty schemas.
+- **Coverage phase**: Generate values for `not` keyword and `false` JSON Schemas.
+
+### :bug: Fixed
+
+- **Coverage phase**: Error 'Path parameter is not defined' if the parameter schema is empty.
+- Properly assign the "stateful" phase value in metadata of test cases generated during the stateful phase.
+- False positive `API accepted schema-violating request` caused by passing security-related header via CLI during the stateful phase.
+
+## [4.0.25](https://github.com/schemathesis/schemathesis/compare/v4.0.24...v4.0.25) - 2025-08-10
+  
 ### :bug: Fixed
 
 - `workers = "auto"` being incorrectly rejected in configuration files. [#3015](https://github.com/schemathesis/schemathesis/issues/3015)

{schemathesis-4.0.25 → schemathesis-4.1.0}/MIGRATION.md

@@ -111,6 +111,7 @@ schemathesis run --phases=examples,coverage <SCHEMA_URL>
 - `schemathesis.HeaderConfig`. Use config file instead.
 - `schemathesis.runner`. The Schemathesis engine is not a public API anymore.
 - `add_case` hook.
+- `process_call_kwargs` hook. Use `before_call` instead.
 - `SCHEMA_ANALYSIS` experimental feature. Parts of this feature will be open sourced in the future.
 - `as_requests_kwargs` / `as_werkzeug_kwargs`. Use `as_transport_kwargs` instead.
 

{schemathesis-4.0.25 → schemathesis-4.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.0.25
+Version: 4.1.0
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md
@@ -26,12 +26,13 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Software Development :: Testing
 Requires-Python: >=3.9
 Requires-Dist: backoff<3.0,>=2.1.2
 Requires-Dist: click<9,>=8.0
 Requires-Dist: colorama<1.0,>=0.4
-Requires-Dist: harfile<1.0,>=0.3.0
+Requires-Dist: harfile<1.0,>=0.3.1
 Requires-Dist: httpx<1.0,>=0.22.0
 Requires-Dist: hypothesis-graphql<1,>=0.11.1
 Requires-Dist: hypothesis-jsonschema<0.24,>=0.23.1

{schemathesis-4.0.25 → schemathesis-4.1.0}/benches/memory/measure.py

@@ -14,7 +14,7 @@ def run_memray(schema_path: str, args: list[str]) -> dict[str, Any]:
         cmd = (
             ["memray", "run", "--force", "-o", memray_output, "-m", "schemathesis.cli", "run"]
             + args
-            + ["-u http://127.0.0.1:8000", schema_path]
+            + ["-u http://127.0.0.1:8000", "--seed=1", schema_path]
         )
 
         subprocess.run(

{schemathesis-4.0.25 → schemathesis-4.1.0}/benches/memory/scenarios.json

@@ -15,6 +15,14 @@
         "--phases=coverage",
         "--continue-on-failure"
       ]
+    },
+    {
+      "name": "stateful_users",
+      "schema": "stateful_users.yaml",
+      "args": [
+        "--phases=stateful",
+        "--continue-on-failure"
+      ]
     }
   ]
 }

schemathesis-4.1.0/benches/memory/schemas/stateful_users.yaml

@@ -0,0 +1,372 @@
+openapi: 3.0.3
+info:
+  title: Stateful User Management API
+  version: 1.0.0
+  description: Simple API with OpenAPI links for stateful testing
+
+paths:
+  /users:
+    post:
+      operationId: createUser
+      summary: Create a new user
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - username
+                - email
+              properties:
+                username:
+                  type: string
+                  minLength: 3
+                  maxLength: 50
+                email:
+                  type: string
+                  format: email
+                age:
+                  type: integer
+                  minimum: 18
+                  maximum: 120
+      responses:
+        '201':
+          description: User created successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/User'
+          links:
+            GetUser:
+              operationId: getUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Get created user by ID
+            UpdateUser:
+              operationId: updateUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Update created user
+            DeleteUser:
+              operationId: deleteUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Delete created user
+
+    get:
+      operationId: listUsers
+      summary: List all users
+      parameters:
+        - name: limit
+          in: query
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 100
+            default: 10
+        - name: offset
+          in: query
+          schema:
+            type: integer
+            minimum: 0
+            default: 0
+      responses:
+        '200':
+          description: List of users
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  users:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/User'
+                  total:
+                    type: integer
+          links:
+            GetFirstUser:
+              operationId: getUser
+              parameters:
+                userId: '$response.body#/users/0/id'
+              description: Get first user from list
+
+  /users/{userId}:
+    parameters:
+      - name: userId
+        in: path
+        required: true
+        schema:
+          type: string
+          format: uuid
+
+    get:
+      operationId: getUser
+      summary: Get user by ID
+      responses:
+        '200':
+          description: User found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/User'
+          links:
+            UpdateThisUser:
+              operationId: updateUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Update this user
+            DeleteThisUser:
+              operationId: deleteUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Delete this user
+            GetUserPosts:
+              operationId: getUserPosts
+              parameters:
+                userId: '$response.body#/id'
+              description: Get posts by this user
+        '404':
+          description: User not found
+
+    put:
+      operationId: updateUser
+      summary: Update user
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                username:
+                  type: string
+                  minLength: 3
+                  maxLength: 50
+                email:
+                  type: string
+                  format: email
+                age:
+                  type: integer
+                  minimum: 18
+                  maximum: 120
+                status:
+                  type: string
+                  enum: ['active', 'inactive', 'suspended']
+      responses:
+        '200':
+          description: User updated
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/User'
+          links:
+            VerifyUpdate:
+              operationId: getUser
+              parameters:
+                userId: '$response.body#/id'
+              description: Verify the update by getting user
+        '404':
+          description: User not found
+
+    delete:
+      operationId: deleteUser
+      summary: Delete user
+      responses:
+        '204':
+          description: User deleted successfully
+        '404':
+          description: User not found
+
+  /users/{userId}/posts:
+    parameters:
+      - name: userId
+        in: path
+        required: true
+        schema:
+          type: string
+          format: uuid
+
+    get:
+      operationId: getUserPosts
+      summary: Get posts by user
+      responses:
+        '200':
+          description: User posts
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  posts:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/Post'
+          links:
+            GetFirstPost:
+              operationId: getPost
+              parameters:
+                postId: '$response.body#/posts/0/id'
+              description: Get first post details
+
+    post:
+      operationId: createPost
+      summary: Create a post for user
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - title
+                - content
+              properties:
+                title:
+                  type: string
+                  minLength: 1
+                  maxLength: 200
+                content:
+                  type: string
+                  minLength: 1
+                  maxLength: 5000
+      responses:
+        '201':
+          description: Post created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Post'
+          links:
+            GetCreatedPost:
+              operationId: getPost
+              parameters:
+                postId: '$response.body#/id'
+              description: Get the created post
+            UpdateCreatedPost:
+              operationId: updatePost
+              parameters:
+                postId: '$response.body#/id'
+              description: Update the created post
+            DeleteCreatedPost:
+              operationId: deletePost
+              parameters:
+                postId: '$response.body#/id'
+              description: Delete the created post
+
+  /posts/{postId}:
+    parameters:
+      - name: postId
+        in: path
+        required: true
+        schema:
+          type: string
+          format: uuid
+
+    get:
+      operationId: getPost
+      summary: Get post by ID
+      responses:
+        '200':
+          description: Post found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Post'
+          links:
+            GetPostAuthor:
+              operationId: getUser
+              parameters:
+                userId: '$response.body#/authorId'
+              description: Get the post author
+
+    put:
+      operationId: updatePost
+      summary: Update post
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                title:
+                  type: string
+                  minLength: 1
+                  maxLength: 200
+                content:
+                  type: string
+                  minLength: 1
+                  maxLength: 5000
+      responses:
+        '200':
+          description: Post updated
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Post'
+
+    delete:
+      operationId: deletePost
+      summary: Delete post
+      responses:
+        '204':
+          description: Post deleted
+        '404':
+          description: Post not found
+
+components:
+  schemas:
+    User:
+      type: object
+      required:
+        - id
+        - username
+        - email
+      properties:
+        id:
+          type: string
+          format: uuid
+        username:
+          type: string
+        email:
+          type: string
+          format: email
+        age:
+          type: integer
+        status:
+          type: string
+          enum: ['active', 'inactive', 'suspended']
+          default: 'active'
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time
+
+    Post:
+      type: object
+      required:
+        - id
+        - title
+        - content
+        - authorId
+      properties:
+        id:
+          type: string
+          format: uuid
+        title:
+          type: string
+        content:
+          type: string
+        authorId:
+          type: string
+          format: uuid
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time

{schemathesis-4.0.25 → schemathesis-4.1.0}/docs/explanations/stateful.md

@@ -77,6 +77,43 @@ paths:
 - Create user → Create user's orders → Get order details
 - Create parent → Create children → Get parent with children
 
+### Automatic Link Inference
+
+Writing OpenAPI links manually for every operation relationship can be time-consuming and error-prone. Schemathesis can automatically infer many of these connections by analyzing `Location` headers from API responses during testing.
+
+**How it works:**
+
+1. **Data collection**: During earlier test phases, Schemathesis collects `Location` headers from API responses
+2. **Pattern analysis**: It analyzes these headers to understand how your API structures resource locations
+3. **Connection mapping**: Creates connections between operations - it learns how to extract parameters from `Location` headers and use them to call related operations
+4. **Stateful testing**: Uses this knowledge to chain operations together with real parameter values
+
+**Example:**
+
+**Phase 1 - Learning**: During fuzzing, Schemathesis observes:
+
+```http
+POST /users → 201 Created
+Location: /users/123
+```
+
+From this, it learns these connections:
+
+- `GET /users/{userId}` - can be called using `userId` extracted from `Location`
+- `PUT /users/{userId}` - can be called using `userId` extracted from `Location`
+- `GET /users/{userId}/posts` - can be called using `userId` extracted from `Location`
+
+**Phase 2 - Application**: During stateful testing, it uses this knowledge:
+
+```http
+POST /users → Location: /users/456 → automatically calls GET /users/456, PUT /users/456, etc.
+```
+
+This happens automatically when stateful testing is enabled - no additional configuration required.
+
+!!! note "Location Headers Required"
+    This feature requires your API to return `Location` headers pointing to created or updated resources.
+
 ## How Schemathesis Extends OpenAPI Links
 
 ### Regex Extraction from Headers and Query Parameters

{schemathesis-4.0.25 → schemathesis-4.1.0}/docs/guides/extending.md

@@ -217,7 +217,7 @@ For complex scenarios, modify the entire request:
 
 ```python
 @schemathesis.hook
-def before_call(ctx, case, **kwargs):
+def before_call(ctx, case, kwargs):
     """Modify the request just before it's sent"""
     # Add correlation ID for tracing
     case.headers["X-Correlation-ID"] = f"test-{uuid.uuid4()}"

{schemathesis-4.0.25 → schemathesis-4.1.0}/docs/reference/cli.md

@@ -318,6 +318,19 @@ The following options control how Schemathesis makes network requests to the API
     $ st run openapi.yaml --rate-limit 5/s
     ```
 
+#### `--max-redirects INTEGER`
+
+!!! note ""
+
+    **Type**: `Integer`  
+    **Range**: `>=0`  
+
+    Maximum number of redirects to follow for each network request during tests. Set to `0` to disable redirect following entirely.
+
+    ```console
+    $ st run openapi.yaml --max-redirects 5
+    ```
+
 #### `--request-timeout SECONDS`
 
 !!! note ""