schemathesis 4.3.10__tar.gz → 4.3.12__tar.gz

{schemathesis-4.3.10 → schemathesis-4.3.12}/CHANGELOG.md

@@ -1,6 +1,29 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.10...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.12...HEAD) - TBD
+
+## [4.3.12](https://github.com/schemathesis/schemathesis/compare/v4.3.11...v4.3.12) - 2025-10-25
+
+### :wrench: Changed
+
+- Infer links based on common REST patterns.
+- Remove orphaned resources during dependency analysis.
+- Allow randomly skipping non-body links to test invalid scenarios.
+- Use `query`, `header` & `cookie` in dependency inference.
+- Increased exploration rate for optional parameters in stateful testing.
+
+## [4.3.11](https://github.com/schemathesis/schemathesis/compare/v4.3.10...v4.3.11) - 2025-10-24
+
+### :bug: Fixed
+
+- Do not conservatively consider all recursive references as infinite ones in the examples phase.
+- Mishandled a case of infinite recursion in the example phase.
+- Improve API spec detection for malformed JSON inputs.
+- Internal error on empty `allOf` in the examples phase.
+
+### :wrench: Changed
+
+- Make `tomli` optional for Python 3.11+. [#3199](https://github.com/schemathesis/schemathesis/issues/3199)
 
 ## [4.3.10](https://github.com/schemathesis/schemathesis/compare/v4.3.9...v4.3.10) - 2025-10-22
 
@@ -234,7 +257,7 @@
 - False positive `API accepted schema-violating request` caused by passing security-related header via CLI during the stateful phase.
 
 ## [4.0.25](https://github.com/schemathesis/schemathesis/compare/v4.0.24...v4.0.25) - 2025-08-10
-  
+
 ### :bug: Fixed
 
 - `workers = "auto"` being incorrectly rejected in configuration files. [#3015](https://github.com/schemathesis/schemathesis/issues/3015)
@@ -316,7 +339,7 @@ These improvements come from removing unnecessary memory allocations in unnecess
 ### :bug: Fixed
 
 - Generating negative test cases incorrectly marked as invalid if `anyOf` or `oneOf` are present. [#2975](https://github.com/schemathesis/schemathesis/issues/2975)
-- Set correct data generation mode for stateful test cases if after adding stateful data, a negative test case becomes positive. [#2983](https://github.com/schemathesis/schemathesis/issues/2983) 
+- Set correct data generation mode for stateful test cases if after adding stateful data, a negative test case becomes positive. [#2983](https://github.com/schemathesis/schemathesis/issues/2983)
 
 ## [4.0.16](https://github.com/schemathesis/schemathesis/compare/v4.0.15...v4.0.16) - 2025-07-31
 
@@ -375,7 +398,7 @@ These improvements come from removing unnecessary memory allocations in unnecess
 
 ### :wrench: Changed
 
-- Display cURL code samples on more network errors. [#2940](https://github.com/schemathesis/schemathesis/issues/2940) 
+- Display cURL code samples on more network errors. [#2940](https://github.com/schemathesis/schemathesis/issues/2940)
 
 ## [4.0.9](https://github.com/schemathesis/schemathesis/compare/v4.0.8...v4.0.9) - 2025-07-13
 
@@ -387,7 +410,7 @@ These improvements come from removing unnecessary memory allocations in unnecess
 
 - Do not display API probing result in the test phases summary.
 - Do not display API probing errors in CLI output. Treat errors as a missing capability.
-- Display cURL code samples on more network errors. [#2940](https://github.com/schemathesis/schemathesis/issues/2940) 
+- Display cURL code samples on more network errors. [#2940](https://github.com/schemathesis/schemathesis/issues/2940)
 
 ## [4.0.8](https://github.com/schemathesis/schemathesis/compare/v4.0.7...v4.0.8) - 2025-07-12
 
@@ -464,7 +487,7 @@ These improvements come from removing unnecessary memory allocations in unnecess
 
 ### :bug: Fixed
 
-- **CLI**: Combining `--include-*` & `--exclude-*`. [#2894](https://github.com/schemathesis/schemathesis/issues/2894) 
+- **CLI**: Combining `--include-*` & `--exclude-*`. [#2894](https://github.com/schemathesis/schemathesis/issues/2894)
 - Combining CLI filter options with config file-based filtering.
 
 ## [4.0.0](https://github.com/schemathesis/schemathesis/compare/v4.0.0-beta.1...v4.0.0) - 2025-06-10
@@ -486,7 +509,7 @@ Check the [Migration Guide](https://github.com/schemathesis/schemathesis/blob/ma
 - Restore `Case.formatted_path`.
 - Update serialization error messages.
 - Update documentation links in error messages.
-- Improved failure messages for `ignored_auth`. [#2779](https://github.com/schemathesis/schemathesis/issues/2779) 
+- Improved failure messages for `ignored_auth`. [#2779](https://github.com/schemathesis/schemathesis/issues/2779)
 - Do not show the "Missing test data" warning if stateful testing has non-404 responses. [#2795](https://github.com/schemathesis/schemathesis/issues/2795)
 - Restore support for validating `requests` / `httpx` / `werkzeug` responses in `validate_response` and `is_response_valid`.
 - Rename `is_response_valid` to `is_valid_response` for consistency with other functions in the codebase.
@@ -543,7 +566,7 @@ This should be the final alpha release. Going forward, I'll focus on documentati
 
 ### :rocket: Added
 
-- A way to configure status codes for the `not_a_server_error` check. [#2539](https://github.com/schemathesis/schemathesis/issues/2539) 
+- A way to configure status codes for the `not_a_server_error` check. [#2539](https://github.com/schemathesis/schemathesis/issues/2539)
 - `@schemathesis.serializer` decorator as a way to serialize data of media types not supported by Schemathesis.
 
 ### :bug: Fixed
@@ -612,7 +635,7 @@ headers = { Authorization = "Bearer ${API_TOKEN}" }
 
 ### :bug: Fixed
 
-- **Coverage Phase**: 
+- **Coverage Phase**:
     - Do not generate empty path parameters.
     - Skip empty string examples for path parameters.
     - Generate default values if examples are incorrect or inappropriate for their location.
@@ -629,7 +652,7 @@ headers = { Authorization = "Bearer ${API_TOKEN}" }
 ### :wrench: Changed
 
 - Enable all available checks by default.
-- Do not fallback to GraphQL loading if schema location ends with `openapi.json` and similar filenames. [#2757](https://github.com/schemathesis/schemathesis/issues/2757) 
+- Do not fallback to GraphQL loading if schema location ends with `openapi.json` and similar filenames. [#2757](https://github.com/schemathesis/schemathesis/issues/2757)
 - **INTERNAL**: Ignore deprecation warnings from `jsonschema`.
 
 ### :fire: Removed
@@ -1661,7 +1684,7 @@ and complete changelog will follow.
 -   `APIStateMachine.format_rules` method to format transition rules in
     a human-readable format.
 
-``` 
+```
 POST /user
 └── 201
     ├── GET /users/{ids}
@@ -2541,7 +2564,7 @@ def test_api(case):
     generate unique test cases only. This feature is also available as a
     hook in `schemathesis.contrib.unique_data`.
 
--   A few decorators & functions that provide a simpler API to extend Schemathesis:  
+-   A few decorators & functions that provide a simpler API to extend Schemathesis:
     -   `schemathesis.auth()` for authentication providers;
     -   `schemathesis.check` for checks;
     -   `schemathesis.hook` & `BaseSchema.hook` for hooks;

{schemathesis-4.3.10 → schemathesis-4.3.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.3.10
+Version: 4.3.12
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md
@@ -46,7 +46,7 @@ Requires-Dist: pyyaml<7.0,>=5.1
 Requires-Dist: requests<3,>=2.22
 Requires-Dist: rich>=13.9.4
 Requires-Dist: starlette-testclient<1,>=0.4.1
-Requires-Dist: tomli>=2.2.1
+Requires-Dist: tomli>=2.2.1; python_version < '3.11'
 Requires-Dist: typing-extensions>=4.12.2
 Requires-Dist: werkzeug<4,>=0.16.0
 Provides-Extra: bench

{schemathesis-4.3.10 → schemathesis-4.3.12}/docs/reference/hooks.md

@@ -16,12 +16,13 @@ Hooks that execute during schema loading and operation initialization.
 
     All schema-level hooks return `None` and modify their arguments in-place.
 
-## Data-Generation Hooks
+## Data Generation Hooks
 
 Control how test data is generated for each request component.
 
 | Hook Pattern | Signature | Purpose | Return |
 |--------------|-----------|---------|---------|
+| **before_generate_{component}** | `(ctx, strategy: SearchStrategy) -> SearchStrategy` | Modify generation strategy | Modified strategy |
 | **filter_{component}** | `(ctx, value: Any) -> bool` | Exclude generated values | `True` to keep, `False` to reject |
 | **map_{component}** | `(ctx, value: Any) -> Any` | Transform generated values | Modified value |
 | **flatmap_{component}** | `(ctx, value: Any) -> SearchStrategy` | Generate dependent values | New strategy based on input |

{schemathesis-4.3.10 → schemathesis-4.3.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.3.10"
+version = "4.3.12"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]
@@ -49,7 +49,7 @@ dependencies = [
   "requests>=2.22,<3",
   "rich>=13.9.4",
   "starlette-testclient>=0.4.1,<1",
-  "tomli>=2.2.1",
+  "tomli>=2.2.1; python_version < '3.11'",
   "typing-extensions>=4.12.2",
   "werkzeug>=0.16.0,<4",
 ]

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/cli/commands/__init__.py

@@ -1,10 +1,10 @@
 from __future__ import annotations
 
+import sys
 from dataclasses import dataclass
 from typing import Any
 
 import click
-from tomli import TOMLDecodeError
 
 from schemathesis.cli.commands.data import Data
 from schemathesis.cli.commands.run import run as run_command
@@ -16,6 +16,11 @@ from schemathesis.config import ConfigError, SchemathesisConfig
 from schemathesis.core.errors import HookError, format_exception
 from schemathesis.core.version import SCHEMATHESIS_VERSION
 
+if sys.version_info < (3, 11):
+    from tomli import TOMLDecodeError
+else:
+    from tomllib import TOMLDecodeError
+
 CONTEXT_SETTINGS = {"help_option_names": ["-h", "--help"]}
 
 

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/cli/commands/run/loaders.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import os
 import warnings
+from json import JSONDecodeError
 from typing import TYPE_CHECKING, Any, Callable
 
 from schemathesis import graphql, openapi
@@ -35,7 +36,10 @@ def should_try_more(exc: LoaderError) -> bool:
     import requests
     from yaml.reader import ReaderError
 
-    if isinstance(exc.__cause__, ReaderError) and "characters are not allowed" in str(exc.__cause__):
+    if (isinstance(exc.__cause__, ReaderError) and "characters are not allowed" in str(exc.__cause__)) or (
+        isinstance(exc.__cause__, JSONDecodeError)
+        and ('"swagger"' in exc.__cause__.doc or '"openapi"' in exc.__cause__.doc)
+    ):
         return False
 
     # We should not try other loaders for cases when we can't even establish connection

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/config/__init__.py

@@ -1,12 +1,11 @@
 from __future__ import annotations
 
 import os
+import sys
 from dataclasses import dataclass
 from os import PathLike
 from random import Random
 
-import tomli
-
 from schemathesis.config._checks import (
     CheckConfig,
     ChecksConfig,
@@ -29,6 +28,11 @@ from schemathesis.config._phases import (
 from schemathesis.config._projects import ProjectConfig, ProjectsConfig, SchemathesisWarning, get_workers_count
 from schemathesis.config._report import DEFAULT_REPORT_DIRECTORY, ReportConfig, ReportFormat, ReportsConfig
 
+if sys.version_info < (3, 11):
+    import tomli
+else:
+    import tomllib as tomli
+
 __all__ = [
     "SchemathesisConfig",
     "ConfigError",

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/generation/coverage.py

@@ -9,7 +9,6 @@ from itertools import combinations
 
 from schemathesis.core.jsonschema.bundler import BUNDLE_STORAGE_KEY
 from schemathesis.core.jsonschema.keywords import ALL_KEYWORDS
-from schemathesis.generation.hypothesis.strategies import combine
 
 try:
     from json.encoder import _make_iterencode  # type: ignore[attr-defined]
@@ -81,7 +80,7 @@ STRATEGIES_FOR_TYPE = {
 def get_strategy_for_type(ty: str | list[str]) -> st.SearchStrategy:
     if isinstance(ty, str):
         return STRATEGIES_FOR_TYPE[ty]
-    return combine([STRATEGIES_FOR_TYPE[t] for t in ty if t in STRATEGIES_FOR_TYPE])
+    return st.one_of(STRATEGIES_FOR_TYPE[t] for t in ty if t in STRATEGIES_FOR_TYPE)
 
 
 FORMAT_STRATEGIES = {**BUILT_IN_STRING_FORMATS, **get_default_format_strategies(), **STRING_FORMATS}

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/generation/hypothesis/builder.py

@@ -35,7 +35,7 @@ from schemathesis.core.transport import prepare_urlencoded
 from schemathesis.core.validation import has_invalid_characters, is_latin_1_encodable
 from schemathesis.generation import GenerationMode, coverage
 from schemathesis.generation.case import Case
-from schemathesis.generation.hypothesis import examples, setup, strategies
+from schemathesis.generation.hypothesis import examples, setup
 from schemathesis.generation.hypothesis.examples import add_single_example
 from schemathesis.generation.hypothesis.given import GivenInput
 from schemathesis.generation.meta import (
@@ -112,9 +112,7 @@ def create_test(
         **config.as_strategy_kwargs,
     }
     generation = config.project.generation_for(operation=operation)
-    strategy = strategies.combine(
-        [operation.as_strategy(generation_mode=mode, **strategy_kwargs) for mode in generation.modes]
-    )
+    strategy = st.one_of(operation.as_strategy(generation_mode=mode, **strategy_kwargs) for mode in generation.modes)
 
     hypothesis_test = create_base_test(
         test_function=test_func,

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/generation/stateful/state_machine.py

@@ -37,16 +37,20 @@ class StepInput:
 
     case: Case
     transition: Transition | None  # None for initial steps
-    # Whether this transition was actually applied
+    # What parameters were actually applied
     # Data extraction failures can prevent it, as well as transitions can be skipped in some cases
     # to improve discovery of bugs triggered by non-stateful inputs during stateful testing
-    is_applied: bool
+    applied_parameters: list[str]
 
-    __slots__ = ("case", "transition", "is_applied")
+    __slots__ = ("case", "transition", "applied_parameters")
 
     @classmethod
     def initial(cls, case: Case) -> StepInput:
-        return cls(case=case, transition=None, is_applied=False)
+        return cls(case=case, transition=None, applied_parameters=[])
+
+    @property
+    def is_applied(self) -> bool:
+        return bool(self.applied_parameters)
 
 
 @dataclass
@@ -69,8 +73,9 @@ class ExtractedParam:
 
     definition: Any
     value: Result[Any, Exception]
+    is_required: bool
 
-    __slots__ = ("definition", "value")
+    __slots__ = ("definition", "value", "is_required")
 
 
 @dataclass

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/openapi/loaders.py

@@ -303,10 +303,11 @@ def _load_yaml(content: str) -> dict[str, Any]:
     try:
         return deserialize_yaml(content)
     except yaml.YAMLError as exc:
-        kind = LoaderErrorKind.SYNTAX_ERROR
-        message = SCHEMA_SYNTAX_ERROR
-        extras = [entry for entry in str(exc).splitlines() if entry]
-        raise LoaderError(kind, message, extras=extras) from exc
+        raise LoaderError(
+            LoaderErrorKind.SYNTAX_ERROR,
+            SCHEMA_SYNTAX_ERROR,
+            extras=[entry for entry in str(exc).splitlines() if entry],
+        ) from exc
 
 
 SCHEMA_INVALID_ERROR = "The provided API schema does not appear to be a valid OpenAPI schema"

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/schemas.py

@@ -16,6 +16,8 @@ from typing import (
 )
 from urllib.parse import quote, unquote, urljoin, urlsplit, urlunsplit
 
+from hypothesis import strategies as st
+
 from schemathesis import transport
 from schemathesis.config import ProjectConfig
 from schemathesis.core import NOT_SET, NotSet, media_types
@@ -25,7 +27,6 @@ from schemathesis.core.result import Ok, Result
 from schemathesis.core.transport import Response
 from schemathesis.generation import GenerationMode
 from schemathesis.generation.case import Case
-from schemathesis.generation.hypothesis import strategies
 from schemathesis.generation.hypothesis.given import GivenInput, given_proxy
 from schemathesis.generation.meta import CaseMetadata
 from schemathesis.hooks import HookDispatcherMark, _should_skip_hook
@@ -458,7 +459,7 @@ class BaseSchema(Mapping):
             for operation in self.get_all_operations()
             if isinstance(operation, Ok)
         ]
-        return strategies.combine(_strategies)
+        return st.one_of(_strategies)
 
     def find_operation_by_label(self, label: str) -> APIOperation | None:
         raise NotImplementedError
@@ -500,7 +501,7 @@ class APIOperationMap(Mapping):
         _strategies = [
             operation.as_strategy(generation_mode=generation_mode, **kwargs) for operation in self._data.values()
         ]
-        return strategies.combine(_strategies)
+        return st.one_of(_strategies)
 
 
 P = TypeVar("P", bound=OperationParameter)

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/specs/openapi/adapter/security.py

@@ -7,7 +7,7 @@ if TYPE_CHECKING:
     from schemathesis.core.compat import RefResolver
     from schemathesis.specs.openapi.adapter.protocol import SpecificationAdapter
 
-ORIGINAL_SECURITY_TYPE_KEY = "x-original-securuty-type"
+ORIGINAL_SECURITY_TYPE_KEY = "x-original-security-type"
 
 
 @dataclass

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/specs/openapi/examples.py

@@ -12,7 +12,6 @@ from hypothesis_jsonschema import from_schema
 from schemathesis.config import GenerationConfig
 from schemathesis.core.compat import RefResolutionError, RefResolver
 from schemathesis.core.errors import InfiniteRecursiveReference, UnresolvableReference
-from schemathesis.core.jsonschema import references
 from schemathesis.core.jsonschema.bundler import BUNDLE_STORAGE_KEY
 from schemathesis.core.transforms import deepclone
 from schemathesis.core.transport import DEFAULT_RESPONSE_TIMEOUT
@@ -216,11 +215,11 @@ def _resolve_bundled(
         if isinstance(reference, str):
             # Check if this reference is already in the current path
             if reference in reference_path:
-                # Try to remove recursive references to avoid infinite recursion
-                remaining_references = references.sanitize(schema)
-                if reference in remaining_references:
-                    cycle = list(reference_path[reference_path.index(reference) :])
-                    raise InfiniteRecursiveReference(reference, cycle)
+                # Real infinite recursive references are caught at the bundling stage.
+                # This recursion happens because of how the example phase generates data - it explores everything,
+                # so it is the easiest way to break such cycles
+                cycle = list(reference_path[reference_path.index(reference) :])
+                raise InfiniteRecursiveReference(reference, cycle)
 
             new_path = reference_path + (reference,)
 
@@ -238,7 +237,11 @@ def _expand_subschemas(
     *, schema: dict[str, Any] | bool, resolver: RefResolver, reference_path: tuple[str, ...]
 ) -> Generator[tuple[dict[str, Any] | bool, tuple[str, ...]], None, None]:
     """Expand schema and all its subschemas."""
-    schema, current_path = _resolve_bundled(schema, resolver, reference_path)
+    try:
+        schema, current_path = _resolve_bundled(schema, resolver, reference_path)
+    except InfiniteRecursiveReference:
+        return
+
     yield (schema, current_path)
 
     if isinstance(schema, dict):
@@ -250,13 +253,19 @@ def _expand_subschemas(
                     yield (subschema, current_path)
 
         # For allOf, merge all alternatives
-        if "allOf" in schema:
+        if "allOf" in schema and schema["allOf"]:
             subschema = deepclone(schema["allOf"][0])
-            subschema, _ = _resolve_bundled(subschema, resolver, current_path)
+            try:
+                subschema, expanded_path = _resolve_bundled(subschema, resolver, current_path)
+            except InfiniteRecursiveReference:
+                return
 
             for sub in schema["allOf"][1:]:
                 if isinstance(sub, dict):
-                    sub, _ = _resolve_bundled(sub, resolver, current_path)
+                    try:
+                        sub, _ = _resolve_bundled(sub, resolver, current_path)
+                    except InfiniteRecursiveReference:
+                        return
                     for key, value in sub.items():
                         if key == "properties":
                             subschema.setdefault("properties", {}).update(value)
@@ -269,7 +278,7 @@ def _expand_subschemas(
                         else:
                             subschema[key] = value
 
-            yield (subschema, current_path)
+            yield (subschema, expanded_path)
 
 
 def extract_inner_examples(examples: dict[str, Any] | list, schema: BaseOpenAPISchema) -> Generator[Any, None, None]:
@@ -353,7 +362,10 @@ def extract_from_schema(
 ) -> Generator[Any, None, None]:
     """Extract all examples from a single schema definition."""
     # This implementation supports only `properties` and `items`
-    schema, current_path = _resolve_bundled(schema, resolver, reference_path)
+    try:
+        schema, current_path = _resolve_bundled(schema, resolver, reference_path)
+    except InfiniteRecursiveReference:
+        return
 
     if "properties" in schema:
         variants = {}

{schemathesis-4.3.10 → schemathesis-4.3.12}/src/schemathesis/specs/openapi/stateful/__init__.py

@@ -8,6 +8,7 @@ import jsonschema
 from hypothesis import strategies as st
 from hypothesis.stateful import Bundle, Rule, precondition, rule
 
+from schemathesis.core import NOT_SET
 from schemathesis.core.errors import InvalidStateMachine, InvalidTransition
 from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.result import Ok
@@ -15,7 +16,6 @@ from schemathesis.core.transforms import UNRESOLVABLE
 from schemathesis.engine.recorder import ScenarioRecorder
 from schemathesis.generation import GenerationMode
 from schemathesis.generation.case import Case
-from schemathesis.generation.hypothesis import strategies
 from schemathesis.generation.meta import ComponentInfo, TestPhase
 from schemathesis.generation.stateful import STATEFUL_TESTS_LABEL
 from schemathesis.generation.stateful.state_machine import APIStateMachine, StepInput, StepOutput, _normalize_name
@@ -50,7 +50,7 @@ class OpenAPIStateMachine(APIStateMachine):
 # The proportion of negative tests generated for "root" transitions
 NEGATIVE_TEST_CASES_THRESHOLD = 10
 # How often some transition is skipped
-USE_TRANSITION_THRESHOLD = 85
+BASE_EXPLORATION_RATE = 0.15
 
 
 @dataclass
@@ -163,6 +163,7 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
     for target in operations:
         if target.label in transitions.operations:
             incoming = transitions.operations[target.label].incoming
+            config = schema.config.generation_for(operation=target, phase="stateful")
             if incoming:
                 for link in incoming:
                     bundle_name = f"{link.source.label} -> {link.status_code}"
@@ -170,7 +171,6 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
                         f"{link.source.label} -> {link.status_code} -> {link.name} -> {target.label}"
                     )
                     assert name not in rules, name
-                    config = schema.config.generation_for(operation=target, phase="stateful")
                     rules[name] = precondition(is_transition_allowed(bundle_name, link.source.label, target.label))(
                         transition(
                             name=name,
@@ -182,7 +182,6 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
                     )
             if target.label in roots.reliable or (not roots.reliable and target.label in roots.fallback):
                 name = _normalize_name(f"RANDOM -> {target.label}")
-                config = schema.config.generation_for(operation=target, phase="stateful")
                 if len(config.modes) == 1:
                     case_strategy = target.as_strategy(generation_mode=config.modes[0], phase=TestPhase.STATEFUL)
                 else:
@@ -250,50 +249,97 @@ def is_likely_root_transition(operation: APIOperation) -> bool:
 
 
 def into_step_input(
-    target: APIOperation, link: OpenApiLink, modes: list[GenerationMode]
+    *, target: APIOperation, link: OpenApiLink, modes: list[GenerationMode]
 ) -> Callable[[StepOutput], st.SearchStrategy[StepInput]]:
+    """A single transition between API operations."""
+
     def builder(_output: StepOutput) -> st.SearchStrategy[StepInput]:
         @st.composite  # type: ignore[misc]
         def inner(draw: st.DrawFn, output: StepOutput) -> StepInput:
+            random = draw(st.randoms(use_true_random=True))
+
+            def biased_coin(p: float) -> bool:
+                return random.random() < p
+
+            # Extract transition data from previous operation's output
             transition = link.extract(output)
 
-            kwargs: dict[str, Any] = {
-                container: {
-                    name: extracted.value.ok()
-                    for name, extracted in data.items()
-                    if isinstance(extracted.value, Ok) and extracted.value.ok() not in (None, UNRESOLVABLE)
-                }
-                for container, data in transition.parameters.items()
-            }
+            overrides: dict[str, Any] = {}
+            applied_parameters = []
+            for container, data in transition.parameters.items():
+                overrides[container] = {}
 
-            if (
-                transition.request_body is not None
-                and isinstance(transition.request_body.value, Ok)
-                and transition.request_body.value.ok() is not UNRESOLVABLE
-                and not link.merge_body
-                and draw(st.integers(min_value=0, max_value=99)) < USE_TRANSITION_THRESHOLD
-            ):
-                kwargs["body"] = transition.request_body.value.ok()
+                for name, extracted in data.items():
+                    # Skip if extraction failed or returned unusable value
+                    if not isinstance(extracted.value, Ok) or extracted.value.ok() in (None, UNRESOLVABLE):
+                        continue
 
-            is_applied = bool(kwargs)
+                    param_key = f"{container}.{name}"
 
-            cases = strategies.combine(
-                [target.as_strategy(generation_mode=mode, phase=TestPhase.STATEFUL, **kwargs) for mode in modes]
-            )
-            case = draw(cases)
+                    # Calculate exploration rate based on parameter characteristics
+                    exploration_rate = BASE_EXPLORATION_RATE
+
+                    # Path parameters are critical for routing - use link values more often
+                    if container == "path_parameters":
+                        exploration_rate *= 0.5
+
+                    # Required parameters should follow links more often, optional ones explored more
+                    # Path params are always required, so they get both multipliers
+                    if extracted.is_required:
+                        exploration_rate *= 0.5
+                    else:
+                        # Explore optional parameters more to avoid only testing link-provided values
+                        exploration_rate *= 3.0
+
+                    if biased_coin(1 - exploration_rate):
+                        overrides[container][name] = extracted.value.ok()
+                        applied_parameters.append(param_key)
+
+            # Get the extracted body value
             if (
                 transition.request_body is not None
                 and isinstance(transition.request_body.value, Ok)
                 and transition.request_body.value.ok() is not UNRESOLVABLE
-                and link.merge_body
-                and draw(st.integers(min_value=0, max_value=99)) < USE_TRANSITION_THRESHOLD
             ):
-                new = transition.request_body.value.ok()
-                if isinstance(case.body, dict) and isinstance(new, dict):
-                    case.body = {**case.body, **new}
+                request_body = transition.request_body.value.ok()
+            else:
+                request_body = NOT_SET
+
+            # Link suppose to replace the entire extracted body
+            if request_body is not NOT_SET and not link.merge_body and biased_coin(1 - BASE_EXPLORATION_RATE):
+                overrides["body"] = request_body
+                if isinstance(overrides["body"], dict):
+                    applied_parameters.extend(f"body.{field}" for field in overrides["body"])
                 else:
-                    case.body = new
-                is_applied = True
+                    applied_parameters.append("body")
+
+            cases = st.one_of(
+                [target.as_strategy(generation_mode=mode, phase=TestPhase.STATEFUL, **overrides) for mode in modes]
+            )
+            case = draw(cases)
+            if request_body is not NOT_SET and link.merge_body:
+                if isinstance(request_body, dict):
+                    selected_fields = {}
+
+                    for field_name, field_value in request_body.items():
+                        if field_value is UNRESOLVABLE:
+                            continue
+
+                        if biased_coin(1 - BASE_EXPLORATION_RATE):
+                            selected_fields[field_name] = field_value
+                            applied_parameters.append(f"body.{field_name}")
+
+                    if selected_fields:
+                        if isinstance(case.body, dict):
+                            case.body = {**case.body, **selected_fields}
+                        else:
+                            # Can't merge into non-dict, replace entirely
+                            case.body = selected_fields
+                elif biased_coin(1 - BASE_EXPLORATION_RATE):
+                    case.body = request_body
+                    applied_parameters.append("body")
+
+                # Re-validate generation mode after merging body
                 if case.meta and case.meta.generation.mode == GenerationMode.NEGATIVE:
                     # It is possible that the new body is now valid and the whole test case could be valid too
                     for alternative in case.operation.body:
@@ -305,7 +351,7 @@ def into_step_input(
                                 )
                                 if all(info.mode == GenerationMode.POSITIVE for info in case.meta.components.values()):
                                     case.meta.generation.mode = GenerationMode.POSITIVE
-            return StepInput(case=case, transition=transition, is_applied=is_applied)
+            return StepInput(case=case, transition=transition, applied_parameters=applied_parameters)
 
         return inner(output=_output)