schemathesis 4.2.2__tar.gz → 4.3.1__tar.gz

{schemathesis-4.2.2 → schemathesis-4.3.1}/.github/workflows/build.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           python-version: 3.11
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v7
 
       - run: uvx pre-commit run --all-files
 
@@ -55,7 +55,7 @@ jobs:
         with:
           python-version: ${{ matrix.python }}
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v7
 
       - if: ${{ matrix.tox_env }}
         run: uvx --with="tox" --with="tox-gh-actions" --with="tox-uv" tox -e ${{ matrix.tox_env }}
@@ -86,7 +86,7 @@ jobs:
         with:
           python-version: "3.12"
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v7
 
       - run: uv tool install ".[dev]"
 

{schemathesis-4.2.2 → schemathesis-4.3.1}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.30.5
+        uses: github/codeql-action/init@v4.30.8
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.30.5
+        uses: github/codeql-action/autobuild@v4.30.8
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.30.5
+        uses: github/codeql-action/analyze@v4.30.8

{schemathesis-4.2.2 → schemathesis-4.3.1}/.github/workflows/codspeed.yml

@@ -19,7 +19,7 @@ jobs:
         with:
           python-version: "3.12"
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v7
 
       - name: Run benchmarks
         uses: CodSpeedHQ/action@v4

{schemathesis-4.2.2 → schemathesis-4.3.1}/.github/workflows/memory-benchmark.yml

@@ -21,7 +21,7 @@ jobs:
         with:
           python-version: '3.13'
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v7
 
       - run: uv pip install '.' 'memray==1.18.0' --system
 
@@ -33,14 +33,14 @@ jobs:
           path: memory-benchmark-results/
           retention-days: 30
 
-      - uses: peter-evans/find-comment@v3
+      - uses: peter-evans/find-comment@v4
         id: fc
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: 'github-actions[bot]'
           body-includes: Memory Benchmark Results
 
-      - uses: peter-evans/create-or-update-comment@v4
+      - uses: peter-evans/create-or-update-comment@v5
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}

{schemathesis-4.2.2 → schemathesis-4.3.1}/.github/workflows/release.yml

@@ -109,7 +109,7 @@ jobs:
         with:
           python-version: "3.10"
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v7
 
       - name: Build package
         run: uvx hatchling build

schemathesis-4.3.1/.github/workflows/test-corpus.yml

@@ -0,0 +1,60 @@
+name: Run corpus tests
+
+on:
+  schedule:
+    # Every day at 00:00
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+jobs:
+
+  corpus-default:
+    name: Default corpus tests
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+          submodules: true
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - uses: astral-sh/setup-uv@v7
+
+      - run: uvx --from=".[tests]" pytest test-corpus/test_corpus.py -n auto -k test_default --durations=20 --dist=worksteal
+
+  corpus-coverage:
+    name: Corpus tests for the coverage phase
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+          submodules: true
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - uses: astral-sh/setup-uv@v7
+
+      - run: uvx --from=".[tests]" pytest test-corpus/test_corpus.py -n auto -k test_coverage_phase --durations=20 --dist=worksteal
+
+  corpus-inference:
+    name: Corpus tests for dependency inference
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+          submodules: true
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - uses: astral-sh/setup-uv@v7
+
+      - run: uvx --from=".[tests]" pytest test-corpus/test_inference.py -n auto --durations=20 --dist=worksteal

{schemathesis-4.2.2 → schemathesis-4.3.1}/.github/workflows/test-hypothesis.yml

@@ -19,6 +19,6 @@ jobs:
         with:
           python-version: "3.11"
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v7
 
       - run: uvx --from=".[tests]" pytest -m hypothesis -m hypothesis_nested --hypothesis-profile CI test

{schemathesis-4.2.2 → schemathesis-4.3.1}/.github/workflows/update-pre-commit.yml

@@ -15,7 +15,7 @@ jobs:
           fetch-depth: 1
           submodules: true
 
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@v7
 
       - run: uvx pre-commit autoupdate
 

{schemathesis-4.2.2 → schemathesis-4.3.1}/.pre-commit-config.yaml

@@ -33,11 +33,11 @@ repos:
         additional_dependencies: [types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.13.3
+    rev: v0.14.0
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.13.3
+    rev: v0.14.0
     hooks:
       - id: ruff-check

{schemathesis-4.2.2 → schemathesis-4.3.1}/CHANGELOG.md

@@ -1,6 +1,31 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.2.2...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.1...HEAD) - TBD
+
+## [4.3.1](https://github.com/schemathesis/schemathesis/compare/v4.3.0...v4.3.1) - 2025-10-14
+
+### :bug: Fixed
+
+- Path parameters with unsupported regex patterns now use sample values instead of failing generation during the coverage phase.
+
+### :wrench: Changed
+
+- Response schema validation errors now display the failing keyword first to prevent truncation.
+- Support more scenarios for dependency inference.
+
+### :racing_car: Performance
+
+- Up to 2x performance improvement for dependency inference.
+
+## [4.3.0](https://github.com/schemathesis/schemathesis/compare/v4.2.2...v4.3.0) - 2025-10-13
+
+### :rocket: Added
+
+- **Automatic API Operation Dependency Detection**: Schemathesis now automatically discovers dependencies between operations (e.g., `POST /users` -> `GET /users/{userId}`), enabling stateful testing without manual configuration. Currently detects path parameter dependencies; `query` / `body` parameter support coming in next release.
+
+### :bug: Fixed
+
+- Schema bundling on some recursive references leading to resolution error during testing.
 
 ## [4.2.2](https://github.com/schemathesis/schemathesis/compare/v4.2.1...v4.2.2) - 2025-10-11
 

{schemathesis-4.2.2 → schemathesis-4.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.2.2
+Version: 4.3.1
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.2.2 → schemathesis-4.3.1}/benches/schema.py

@@ -15,7 +15,9 @@ from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.transforms import deepclone
 from schemathesis.core.transport import Response
 from schemathesis.engine import events, from_schema
+from schemathesis.generation.hypothesis import setup
 from schemathesis.specs.openapi._hypothesis import get_parameters_strategy, make_positive_strategy
+from schemathesis.specs.openapi.stateful import dependencies
 
 CURRENT_DIR = pathlib.Path(__file__).parent.absolute()
 sys.path.append(str(CURRENT_DIR.parent))
@@ -23,6 +25,7 @@ CATALOG_DIR = CURRENT_DIR / "data"
 
 from corpus.tools import load_from_corpus, read_corpus_file  # noqa: E402
 
+setup()
 CONFIG = SchemathesisConfig()
 
 CORPUS_OPENAPI_30 = read_corpus_file("openapi-3.0")
@@ -56,6 +59,7 @@ BBCI_SCHEMA.config.generation.update(max_examples=1)
 BBCI_SCHEMA.config.seed = 42
 BBCI_SCHEMA.config.phases.update(phases=["examples", "fuzzing"])
 
+
 RESPONSE = Response(
     status_code=200,
     headers={},
@@ -244,6 +248,35 @@ def test_deepclone(benchmark, schema):
     benchmark(deepclone, schema)
 
 
+@pytest.mark.benchmark
+@pytest.mark.parametrize(
+    "schema",
+    [
+        BBCI_SCHEMA,
+        VMWARE_SCHEMA,
+        STRIPE_SCHEMA,
+    ],
+    ids=("bbci", "vmware", "stripe"),
+)
+def test_dependency_analysis(benchmark, schema):
+    benchmark(dependencies.analyze, schema)
+
+
+@pytest.mark.benchmark
+@pytest.mark.parametrize(
+    "schema",
+    [
+        BBCI_SCHEMA,
+        VMWARE_SCHEMA,
+        STRIPE_SCHEMA,
+    ],
+    ids=("bbci", "vmware", "stripe"),
+)
+def test_link_generation(benchmark, schema):
+    graph = dependencies.analyze(schema)
+    benchmark(lambda: list(graph.iter_links()))
+
+
 def _load_from_file(loader, json_string):
     return loader(json_string, config=CONFIG)
 

schemathesis-4.3.1/docs/explanations/stateful.md

@@ -0,0 +1,250 @@
+# Understanding Stateful Testing
+
+Learn how Schemathesis's stateful testing works, when to use it, and how it fits into your testing strategy.
+
+## What is Stateful Testing?
+
+Stateful testing chains API calls together using real data from responses, rather than testing each operation independently.
+
+**Without stateful testing:**
+
+```
+POST /users → Creates user → Test passes ✓
+GET /users/123 → Uses random ID → 404 Not Found ✗
+DELETE /users/456 → Uses random ID → 404 Not Found ✗
+```
+
+Each operation tested alone. Random data doesn't match real resources.
+
+**With stateful testing:**
+
+```
+POST /users → Creates user → Returns ID: 789 ✓
+GET /users/789 → Uses actual ID from POST → 200 OK ✓
+DELETE /users/789 → Uses actual ID from POST → 200 OK ✓
+```
+
+Operations chained together. Real IDs from real responses.
+
+**Why this matters:**
+
+- Tests realistic workflows (create -> read -> update -> delete)
+- Finds bugs that only appear when operations interact
+- Validates your API works as a whole, not just individual endpoints
+
+## How It Works
+
+Schemathesis analyzes your OpenAPI schema to understand how operations connect.
+
+**Step 1: Find resources**
+
+Identifies what your API produces:
+
+```yaml
+POST /users → Creates "User" resource
+POST /orders → Creates "Order" resource
+```
+
+**Step 2: Match parameters**
+
+Links parameters to resources:
+
+```yaml
+GET /users/{userId} → Needs "userId" from User resource
+GET /orders/{orderId} → Needs "orderId" from Order resource
+```
+
+**Step 3: Connect operations**
+
+Chains operations that share resources:
+```
+POST /users (creates User with id=123)
+  ↓ pass id as userId
+GET /users/{userId} (needs User)
+  ↓ pass id as userId
+PUT /users/{userId} (needs User)
+  ↓ pass id as userId
+DELETE /users/{userId} (needs User)
+```
+
+**Step 4: Generate test scenarios**
+
+Runs random workflows:
+
+- Create user -> Get user -> Update user -> Delete user
+- Create user -> Create order for that user -> Get order
+- Create user -> Delete user -> Get user
+
+**This happens automatically** when you enable stateful testing.
+
+## Connecting Operations
+
+Stateful testing needs to know how operations relate. For example, `POST /users` creates a user, and `GET /users/{userId}` needs that user's ID.
+
+Schemathesis discovers these connections in three ways:
+
+### 1. Automatic Schema Analysis
+
+Analyzes your OpenAPI schema to detect connections.
+
+**Example:** Your schema has:
+
+```yaml
+paths:
+  /users:
+    post:
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                properties:
+                  id: {type: string}
+                  email: {type: string}
+  
+  /users/{userId}:
+    get:
+      parameters:
+        - name: userId
+          in: path
+```
+
+Schemathesis detects the following relationships:
+
+- `POST /users` creates a `User` resource with fields `id` and `email`.
+- `GET /users/{userId}` requires a `userId` path parameter.
+- It infers that `userId` corresponds to the `id` field returned by the POST response.
+- Therefore, it can build a sequence: `POST /users` -> `GET /users/{userId}`.
+
+**Works for:**
+
+- Path parameters: `userId`, `user_id`, `{id}` in `/users/{id}`
+- Nested resources: `/users/{userId}/posts`
+- Pagination: `{"data": [...]}`, `{"items": [...]}`
+- Schema composition: `allOf`, `oneOf`, `anyOf`
+
+!!! warning "Current limitation"
+    Only path parameters are supported as inputs to API operations; query, header, and body are coming soon.
+
+### 2. Location Header Learning
+
+While running tests, Schemathesis can also learn new connections dynamically by observing `Location` headers in responses.
+
+If your API returns a `Location` header when creating resources, Schemathesis automatically discovers follow-up operations for that resource.
+
+```http
+POST /users → 201 Created
+Location: /users/123
+
+# Learns: GET /users/123, PUT /users/123, DELETE /users/123
+```
+
+This mechanism requires your API to return a valid `Location` header in `201 Created` responses.
+
+### 3. Manual OpenAPI Links
+
+When you want full control or need to specify non-path relationships, you can define explicit connections using [OpenAPI Links](https://spec.openapis.org/oas/v3.1.0#link-object).
+
+```yaml
+paths:
+  /users:
+    post:
+      responses:
+        '201':
+          links:
+            GetUser:
+              operationId: getUser
+              parameters:
+                userId: '$response.body#/id'
+```
+
+This explicitly tells Schemathesis that the `userId` parameter in the `getUser` operation should be populated from the `id` field in the response body of the `POST /users` operation.
+
+**Use manual links when**:
+
+- Automatic schema analysis misses a connection
+- You need to map query, header, or body parameters
+- You want precise, explicit control over operation relationships
+
+!!! note "All Three Work Together"
+    Schema analysis runs first, manual links override when present, and `Location` learning adds runtime discoveries.
+
+## How Schemathesis Extends OpenAPI Links
+
+### Regex Extraction from Headers and Query Parameters
+
+Standard OpenAPI links can extract string data from various places, but only exact values. Schemathesis adds regex support for pattern-based extraction for a part of a string:
+
+```yaml
+paths:
+  /users:
+    post:
+      responses:
+        '201':
+          headers:
+            Location:
+              schema:
+                type: string
+          links:
+            GetUserByUserId:
+              operationId: getUser
+              parameters:
+                userId: '$response.header.Location#regex:/users/(.+)'
+```
+
+**How it works:**
+
+- If `Location` header is `/users/42`, the `userId` parameter becomes `42`
+- The regex must be valid Python regex with exactly one capturing group
+- If regex doesn't match, the parameter is set to empty string
+
+### Enhanced RequestBody Support
+
+OpenAPI standard does not allow recursive expressions in `requestBody`:
+
+```yaml
+SetManagerId:
+  operationId: setUserManager
+  # only plain or embedded expression or literals
+  requestBody: "$response.body#/id"
+```
+
+Schemathesis allows for nested expressions:
+
+```json
+
+SetManagerId:
+  operationId: setUserManager
+  requestBody: {
+    "user_id": "$response.body#/id",
+    "metadata": {
+      "created_by": "$response.body#/author",
+      "tags": ["$response.body#/category", "static-value"]
+    }
+  }
+```
+
+If response body is `{"id": 123, "author": "alice", "category": "blog"}`, the request body becomes:
+
+```json
+{
+  "user_id": 123,
+  "metadata": {
+    "created_by": "alice",
+    "tags": ["blog", "static-value"]
+  }
+}
+```
+
+### Backwards Compatibility
+
+**OpenAPI 2.0 Support:** Use `x-links` extension with identical syntax:
+```yaml
+# OpenAPI 3.0
+links:
+  GetUser: ...
+
+# OpenAPI 2.0
+x-links:
+  GetUser: ...  # Same syntax, including regex support
+```

{schemathesis-4.2.2 → schemathesis-4.3.1}/docs/reference/cli.md

@@ -500,7 +500,15 @@ These options control how Schemathesis generates test data for API testing:
     **Type**: `Integer`  
     **Range**: `≥1`  
 
-    Maximum number of test cases per API operation.
+    Maximum number of test cases generated per API operation. Must be greater than or equal to 1.
+
+    Schemathesis generates diverse examples based on your API schema, distributed across enabled generation modes (e.g., positive and negative test cases). See [Data Generation](../explanations/data-generation.md) for details.
+
+    This setting has different effects depending on the test phase:
+
+    - In **fuzzing** phase: Controls the maximum number of examples generated per API operation
+    - In **stateful** phase: Determines the maximum number of distinct API call sequences
+    - In **examples** and **coverage** phases: Has no effect, as these use predetermined test cases
 
     ```console
     $ st run openapi.yaml --max-examples 100

{schemathesis-4.2.2 → schemathesis-4.3.1}/docs/reference/configuration.md

@@ -468,7 +468,7 @@ These settings can only be applied at the project level.
     **Type**: `Array[String]`  
     **Default**: `[]`  
 
-    Lists the HTTP methods to use when generating test cases with methods not specified in the API during the **coverage** phase.  
+    Lists the HTTP methods to use when generating test cases with methods not specified in the API during the **coverage** phase.
     Schemathesis will limit negative testing of unexpected methods to those in the array; if omitted, all HTTP methods not specified in the spec are applied.
 
     ```toml
@@ -483,7 +483,7 @@ These settings can only be applied at the project level.
     **Type**: `Integer (≥2)`  
     **Default**: `null`  
 
-    Specifies the maximum number of stateful steps (i.e., transitions between states) to perform in the **stateful** phase. When set, Schemathesis will stop exploring new state transitions once this limit is reached, even if additional valid transitions are available.  
+    Specifies the maximum number of stateful steps (i.e., transitions between states) to perform in the **stateful** phase. When set, Schemathesis will stop exploring new state transitions once this limit is reached, even if additional valid transitions are available.
 
     ```toml
     [phases.stateful]
@@ -495,12 +495,14 @@ These settings can only be applied at the project level.
 !!! note ""
 
     **Type**: `Array[String]`  
-    **Default**: `["location-headers"]`  
+    **Default**: `["location-headers", "dependency-analysis"]`  
 
     Specifies which inference algorithms to use during the **stateful** phase. Schemathesis will use the specified algorithms to automatically analyze API responses and generate OpenAPI links for stateful testing.
 
     Available algorithms:
-    - `location-headers` - Analyzes `Location` headers to infer parameter extraction rules between operations
+
+    - `location-headers` - Analyzes `Location` headers to infer parameter extraction rules between operations.  
+    - `dependency-analysis` - Analyzes your OpenAPI schema to detect resource dependencies between operations.  
 
     Set to an empty array to disable automatic link inference entirely.
 
@@ -820,6 +822,8 @@ The following settings control how Schemathesis generates test data for your API
 
     Maximum number of test cases generated per API operation. Must be greater than or equal to 1.
 
+    Schemathesis generates diverse examples based on your API schema, distributed across enabled generation modes (e.g., positive and negative test cases). See [Data Generation](../explanations/data-generation.md) for details.
+
     This setting has different effects depending on the test phase:
 
     - In **fuzzing** phase: Controls the maximum number of examples generated per API operation

{schemathesis-4.2.2 → schemathesis-4.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.2.2"
+version = "4.3.1"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.2.2 → schemathesis-4.3.1}/src/schemathesis/config/__init__.py

@@ -19,7 +19,13 @@ from schemathesis.config._error import ConfigError
 from schemathesis.config._generation import GenerationConfig
 from schemathesis.config._health_check import HealthCheck
 from schemathesis.config._output import OutputConfig, SanitizationConfig, TruncationConfig
-from schemathesis.config._phases import CoveragePhaseConfig, PhaseConfig, PhasesConfig, StatefulPhaseConfig
+from schemathesis.config._phases import (
+    CoveragePhaseConfig,
+    InferenceAlgorithm,
+    PhaseConfig,
+    PhasesConfig,
+    StatefulPhaseConfig,
+)
 from schemathesis.config._projects import ProjectConfig, ProjectsConfig, SchemathesisWarning, get_workers_count
 from schemathesis.config._report import DEFAULT_REPORT_DIRECTORY, ReportConfig, ReportFormat, ReportsConfig
 
@@ -44,6 +50,7 @@ __all__ = [
     "PhasesConfig",
     "CoveragePhaseConfig",
     "StatefulPhaseConfig",
+    "InferenceAlgorithm",
     "ProjectsConfig",
     "ProjectConfig",
     "get_workers_count",