schemathesis 4.3.16__tar.gz → 4.3.17__tar.gz

{schemathesis-4.3.16 → schemathesis-4.3.17}/.github/workflows/build.yml

@@ -35,13 +35,13 @@ jobs:
 
       - uses: astral-sh/setup-uv@v7
 
-      - run: uvx pre-commit run --all-files
+      - run: uvx prek run --all-files
 
   tests:
     strategy:
       matrix:
         os: [ubuntu-22.04, windows-2022]
-        python: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
       fail-fast: false
 
     name: Tests (Python ${{ matrix.python }} on ${{ matrix.os }} ${{ matrix.tox_env }})

{schemathesis-4.3.16 → schemathesis-4.3.17}/.github/workflows/memory-benchmark.yml

@@ -19,7 +19,7 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: '3.13'
+          python-version: '3.14'
 
       - uses: astral-sh/setup-uv@v7
 

{schemathesis-4.3.16 → schemathesis-4.3.17}/.github/workflows/test-corpus.yml

@@ -19,7 +19,7 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.11"
+          python-version: "3.14"
 
       - uses: astral-sh/setup-uv@v7
 
@@ -36,7 +36,7 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.11"
+          python-version: "3.14"
 
       - uses: astral-sh/setup-uv@v7
 
@@ -53,7 +53,7 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.11"
+          python-version: "3.14"
 
       - uses: astral-sh/setup-uv@v7
 

{schemathesis-4.3.16 → schemathesis-4.3.17}/.github/workflows/test-hypothesis.yml

@@ -17,7 +17,7 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.11"
+          python-version: "3.14"
 
       - uses: astral-sh/setup-uv@v7
 

{schemathesis-4.3.16 → schemathesis-4.3.17}/.github/workflows/update-pre-commit.yml

@@ -17,7 +17,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@v7
 
-      - run: uvx pre-commit autoupdate
+      - run: uvx prek autoupdate
 
       - name: Open pull request
         uses: peter-evans/create-pull-request@v7

{schemathesis-4.3.16 → schemathesis-4.3.17}/.pre-commit-config.yaml

@@ -33,7 +33,7 @@ repos:
         additional_dependencies: [types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.2
+    rev: v0.14.3
     hooks:
       - id: ruff-format
       - id: ruff-check

{schemathesis-4.3.16 → schemathesis-4.3.17}/CHANGELOG.md

@@ -1,6 +1,27 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.16...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.17...HEAD) - TBD
+
+## [4.3.17](https://github.com/schemathesis/schemathesis/compare/v4.3.16...v4.3.17) - 2025-11-02
+
+### :rocket: Added
+
+- Python 3.14 builds.
+
+### :bug: Fixed
+
+- Config-based auth, headers, test phases and generation settings not applied when using `schemathesis.pytest.from_fixture`.
+- Support for method-based tests with `schemathesis.pytest.from_fixture`.
+- Checks not loaded when using `schemathesis.pytest.from_fixture`, causing `AttributeError` when accessing `schemathesis.checks.*`.
+
+### :wrench: Changed
+
+- Improve error messages for exceptions in custom auth providers.
+- Refactor coverage phase metadata to use type-safe enums instead of string-based checks.
+
+### :racing_car: Performance
+
+- ~30% faster fuzzing & stateful phases due to aggressive caching of data generation strategies.
 
 ## [4.3.16](https://github.com/schemathesis/schemathesis/compare/v4.3.15...v4.3.16) - 2025-10-30
 

{schemathesis-4.3.16 → schemathesis-4.3.17}/CONTRIBUTING.md

@@ -7,12 +7,12 @@ Welcome! Thank you for considering contributing to Schemathesis. Your feedback a
 **For code contributions**: Make sure you have the following installed:
 
 - Python 3.9 or higher
-- `pre-commit`
+- `prek`
 - `tox`
 - `curl` (required by some integration tests; install via your OS package manager, e.g., `apt install curl` or `brew install curl`)
 
 ```bash
-uv pip install pre-commit tox
+uv pip install prek tox
 ```
 
 **For documentation contributions**: No specific prerequisites are required.
@@ -53,10 +53,10 @@ uv pip install -e ".[dev]"
 
 This will install all the necessary packages for development, including those for documentation and tests.
 
-3. **Set Up Pre-commit Hooks**: Enable [pre-commit](https://pre-commit.com).
+3. **Set Up Pre-commit Hooks**: Enable [prek](https://github.com/j178/prek).
 
 ```bash
-pre-commit install
+prek install
 ```
 
 4. **Branching**: Create a new branch and switch to it. Target your pull request to the `master` branch of the main repository.

{schemathesis-4.3.16 → schemathesis-4.3.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.3.16
+Version: 4.3.17
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md
@@ -25,6 +25,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Software Development :: Testing
@@ -50,7 +51,7 @@ Requires-Dist: tomli>=2.2.1; python_version < '3.11'
 Requires-Dist: typing-extensions>=4.12.2
 Requires-Dist: werkzeug<4,>=0.16.0
 Provides-Extra: bench
-Requires-Dist: pytest-codspeed==2.2.1; extra == 'bench'
+Requires-Dist: pytest-codspeed==4.2.0; extra == 'bench'
 Provides-Extra: cov
 Requires-Dist: coverage-enable-subprocess; extra == 'cov'
 Requires-Dist: coverage[toml]>=5.3; extra == 'cov'
@@ -65,8 +66,8 @@ Requires-Dist: hypothesis-openapi<1,>=0.2; (python_version >= '3.10') and extra
 Requires-Dist: mkdocs-material; extra == 'dev'
 Requires-Dist: mkdocstrings[python]; extra == 'dev'
 Requires-Dist: pydantic>=1.10.2; extra == 'dev'
-Requires-Dist: pytest-asyncio<1.0,>=0.18.0; extra == 'dev'
-Requires-Dist: pytest-codspeed==2.2.1; extra == 'dev'
+Requires-Dist: pytest-asyncio<2.0,>=1.0; extra == 'dev'
+Requires-Dist: pytest-codspeed==4.2.0; extra == 'dev'
 Requires-Dist: pytest-httpserver<2.0,>=1.0; extra == 'dev'
 Requires-Dist: pytest-mock<4.0,>=3.7.0; extra == 'dev'
 Requires-Dist: pytest-trio<1.0,>=0.8; extra == 'dev'
@@ -85,7 +86,7 @@ Requires-Dist: fastapi>=0.86.0; extra == 'tests'
 Requires-Dist: flask<3.0,>=2.1.1; extra == 'tests'
 Requires-Dist: hypothesis-openapi<1,>=0.2; (python_version >= '3.10') and extra == 'tests'
 Requires-Dist: pydantic>=1.10.2; extra == 'tests'
-Requires-Dist: pytest-asyncio<1.0,>=0.18.0; extra == 'tests'
+Requires-Dist: pytest-asyncio<2.0,>=1.0; extra == 'tests'
 Requires-Dist: pytest-httpserver<2.0,>=1.0; extra == 'tests'
 Requires-Dist: pytest-mock<4.0,>=3.7.0; extra == 'tests'
 Requires-Dist: pytest-trio<1.0,>=0.8; extra == 'tests'

{schemathesis-4.3.16 → schemathesis-4.3.17}/benches/schema.py

@@ -16,7 +16,8 @@ from schemathesis.core.transforms import deepclone
 from schemathesis.core.transport import Response
 from schemathesis.engine import events, from_schema
 from schemathesis.generation.hypothesis import setup
-from schemathesis.specs.openapi._hypothesis import get_parameters_strategy, make_positive_strategy
+from schemathesis.generation.modes import GenerationMode
+from schemathesis.specs.openapi._hypothesis import get_parameters_strategy
 from schemathesis.specs.openapi.stateful import dependencies
 
 CURRENT_DIR = pathlib.Path(__file__).parent.absolute()
@@ -182,7 +183,7 @@ def _get_parameters_strategy(operations, config):
             ParameterLocation.PATH,
             ParameterLocation.QUERY,
         ]:
-            get_parameters_strategy(operation.ok(), make_positive_strategy, location, config)
+            get_parameters_strategy(operation.ok(), GenerationMode.POSITIVE, location, config)
 
 
 @pytest.mark.benchmark

{schemathesis-4.3.16 → schemathesis-4.3.17}/docs/faq.md

@@ -96,6 +96,27 @@ Schemathesis has the following limitations:
 
 If you encounter issues not listed here, please report them on our [GitHub issues page](https://github.com/schemathesis/schemathesis/issues).
 
+## Why is Schemathesis skipping my Authorization header?
+
+Schemathesis **intentionally** removes or modifies authentication in some test cases. This is security testing, not a bug.
+
+**Why this happens:**
+
+Schemathesis verifies that your API properly validates authentication by testing with:
+- No authentication credentials
+- Incorrect authentication credentials
+
+This helps catch authentication bypass vulnerabilities where APIs accept requests they should reject.
+
+**When you'll see this:**
+
+- The `ignored_auth` check makes additional requests without auth or with invalid credentials
+- Some test cases in the coverage phase may omit required headers including Authorization
+- You'll see failures if your API accepts requests it should reject
+
+!!! important ""
+    The majority of test cases still use your provided authentication normally. Only specific security-focused tests intentionally modify it.
+
 ## Can I use Schemathesis with Allure?
 
 Yes, through JUnit XML export. Allure can generate rich visual reports from Schemathesis test results.

{schemathesis-4.3.16 → schemathesis-4.3.17}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.3.16"
+version = "4.3.17"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]
@@ -27,6 +27,7 @@ classifiers = [
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
   "Programming Language :: Python :: Implementation :: CPython",
   "Programming Language :: Python :: Implementation :: PyPy",
   "Topic :: Software Development :: Testing",
@@ -61,7 +62,7 @@ tests = [
   "Flask>=2.1.1,<3.0",
   "hypothesis-openapi>=0.2,<1; python_version >= '3.10'",
   "pydantic>=1.10.2",
-  "pytest-asyncio>=0.18.0,<1.0",
+  "pytest-asyncio>=1.0,<2.0",
   "pytest-httpserver>=1.0,<2.0",
   "pytest-mock>=3.7.0,<4.0",
   "pytest-trio>=0.8,<1.0",
@@ -72,7 +73,7 @@ tests = [
   "trustme>=0.9.0,<1.0",
 ]
 cov = ["coverage-enable-subprocess", "coverage[toml]>=5.3"]
-bench = ["pytest-codspeed==2.2.1"]
+bench = ["pytest-codspeed==4.2.0"]
 docs = ["mkdocs-material", "mkdocstrings[python]"]
 dev = ["schemathesis[tests,cov,bench,docs]"]
 

{schemathesis-4.3.16 → schemathesis-4.3.17}/src/schemathesis/auths.py

@@ -17,7 +17,7 @@ from typing import (
     runtime_checkable,
 )
 
-from schemathesis.core.errors import IncorrectUsage
+from schemathesis.core.errors import AuthenticationError, IncorrectUsage
 from schemathesis.core.marks import Mark
 from schemathesis.filters import FilterSet, FilterValue, MatcherFunc, attach_filter_chain
 from schemathesis.generation.case import Case
@@ -128,6 +128,7 @@ class CachingAuthProvider(Generic[Auth]):
 
     def get(self, case: Case, context: AuthContext) -> Auth | None:
         """Get cached auth value."""
+        __tracebackhide__ = True
         cache_entry = self._get_cache_entry(case, context)
         if cache_entry is None or self.timer() >= cache_entry.expires:
             with self._refresh_lock:
@@ -136,7 +137,11 @@ class CachingAuthProvider(Generic[Auth]):
                     # Another thread updated the cache
                     return cache_entry.data
                 # We know that optional auth is possible only inside a higher-level wrapper
-                data: Auth = self.provider.get(case, context)  # type: ignore[assignment]
+                try:
+                    data: Auth = self.provider.get(case, context)  # type: ignore[assignment]
+                except Exception as exc:
+                    provider_name = self.provider.__class__.__name__
+                    raise AuthenticationError(provider_name, "get", str(exc)) from exc
                 self._set_cache_entry(data, case, context)
                 return data
         return cache_entry.data
@@ -270,11 +275,25 @@ class SelectiveAuthProvider(Generic[Auth]):
     filter_set: FilterSet
 
     def get(self, case: Case, context: AuthContext) -> Auth | None:
+        __tracebackhide__ = True
         if self.filter_set.match(context):
-            return self.provider.get(case, context)
+            try:
+                return self.provider.get(case, context)
+            except AuthenticationError:
+                # Already wrapped, re-raise as-is
+                raise
+            except Exception as exc:
+                # Need to unwrap to get the actual provider class name
+                provider = self.provider
+                # Unwrap caching providers
+                while isinstance(provider, (CachingAuthProvider, KeyedCachingAuthProvider)):
+                    provider = provider.provider
+                provider_name = provider.__class__.__name__
+                raise AuthenticationError(provider_name, "get", str(exc)) from exc
         return None
 
     def set(self, case: Case, data: Auth, context: AuthContext) -> None:
+        __tracebackhide__ = True
         self.provider.set(case, data, context)
 
 
@@ -418,6 +437,7 @@ class AuthStorage(Generic[Auth]):
 
     def set(self, case: Case, context: AuthContext) -> None:
         """Set authentication data on a generated test case."""
+        __tracebackhide__ = True
         if not self.is_defined:
             raise IncorrectUsage("No auth provider is defined.")
         for provider in self.providers:
@@ -433,6 +453,7 @@ def set_on_case(case: Case, context: AuthContext, auth_storage: AuthStorage | No
 
     If there is no auth defined, then this function is no-op.
     """
+    __tracebackhide__ = True
     if auth_storage is not None:
         auth_storage.set(case, context)
     elif case.operation.schema.auth.is_defined:

{schemathesis-4.3.16 → schemathesis-4.3.17}/src/schemathesis/cli/commands/run/handlers/output.py

@@ -20,13 +20,14 @@ from schemathesis.config import ProjectConfig, ReportFormat, SchemathesisWarning
 from schemathesis.core.errors import LoaderError, LoaderErrorKind, format_exception, split_traceback
 from schemathesis.core.failures import MessageBlock, Severity, format_failures
 from schemathesis.core.output import prepare_response_payload
+from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.result import Ok
 from schemathesis.core.version import SCHEMATHESIS_VERSION
 from schemathesis.engine import Status, events
 from schemathesis.engine.phases import PhaseName, PhaseSkipReason
 from schemathesis.engine.phases.probes import ProbeOutcome
 from schemathesis.engine.recorder import Interaction, ScenarioRecorder
-from schemathesis.generation.meta import CoveragePhaseData
+from schemathesis.generation.meta import CoveragePhaseData, CoverageScenario
 from schemathesis.generation.modes import GenerationMode
 from schemathesis.schemas import ApiStatistic
 
@@ -1079,7 +1080,9 @@ class OutputHandler(EventHandler):
             return bool(
                 case.meta
                 and isinstance(case.meta.phase.data, CoveragePhaseData)
-                and case.meta.phase.data.description == "Missing `Authorization` at header"
+                and case.meta.phase.data.scenario == CoverageScenario.MISSING_PARAMETER
+                and case.meta.phase.data.parameter == "Authorization"
+                and case.meta.phase.data.parameter_location == ParameterLocation.HEADER
             )
 
         if SchemathesisWarning.MISSING_AUTH in warnings:

{schemathesis-4.3.16 → schemathesis-4.3.17}/src/schemathesis/core/errors.py

@@ -325,6 +325,27 @@ class IncorrectUsage(SchemathesisError):
     """Indicates incorrect usage of Schemathesis' public API."""
 
 
+class AuthenticationError(SchemathesisError):
+    """Error during authentication provider execution.
+
+    This error wraps exceptions that occur when obtaining or setting
+    authentication data via custom auth providers.
+    """
+
+    def __init__(self, provider_name: str, method: str, message: str) -> None:
+        self.provider_name = provider_name
+        self.method = method
+        self.message = message
+        super().__init__(
+            f"Error in '{provider_name}.{method}()': {message}\n\n"
+            f"Common causes:\n"
+            f"  - Auth endpoint returned an error response\n"
+            f"  - Response format doesn't match expectations (text vs JSON)\n"
+            f"  - Network or connection issues\n"
+            f"  - Logic error in the authentication provider implementation"
+        )
+
+
 class NoLinksFound(IncorrectUsage):
     """Raised when no valid links are available for stateful testing."""
 

{schemathesis-4.3.16 → schemathesis-4.3.17}/src/schemathesis/engine/errors.py

@@ -16,6 +16,7 @@ from hypothesis import HealthCheck
 
 from schemathesis import errors
 from schemathesis.core.errors import (
+    AuthenticationError,
     InfiniteRecursiveReference,
     InvalidTransition,
     SerializationNotPossible,
@@ -105,6 +106,7 @@ class EngineErrorInfo:
             RuntimeErrorKind.HYPOTHESIS_UNSUPPORTED_GRAPHQL_SCALAR: "Unknown GraphQL Scalar",
             RuntimeErrorKind.SERIALIZATION_UNBOUNDED_PREFIX: "XML serialization error",
             RuntimeErrorKind.SERIALIZATION_NOT_POSSIBLE: "Serialization not possible",
+            RuntimeErrorKind.AUTHENTICATION_ERROR: "Authentication Error",
         }.get(self._kind, "Runtime Error")
 
     @property
@@ -165,6 +167,9 @@ class EngineErrorInfo:
 
     @cached_property
     def traceback(self) -> str:
+        # For AuthenticationError, show only the original exception's traceback
+        if isinstance(self._error, AuthenticationError) and self._error.__cause__ is not None:
+            return format_exception(self._error.__cause__, with_traceback=True)
         return format_exception(self._error, with_traceback=True)
 
     def format(self, *, bold: Callable[[str], str] = str, indent: str = "    ") -> str:
@@ -254,6 +259,9 @@ class RuntimeErrorKind(str, enum.Enum):
     CONNECTION_OTHER = "connection_other"
     NETWORK_OTHER = "network_other"
 
+    # Authentication issues
+    AUTHENTICATION_ERROR = "authentication_error"
+
     # Hypothesis issues
     HYPOTHESIS_UNSATISFIABLE = "hypothesis_unsatisfiable"
     HYPOTHESIS_UNSUPPORTED_GRAPHQL_SCALAR = "hypothesis_unsupported_graphql_scalar"
@@ -281,6 +289,10 @@ def _classify(*, error: Exception) -> RuntimeErrorKind:
     import requests
     from hypothesis import HealthCheck
 
+    # Authentication errors
+    if isinstance(error, AuthenticationError):
+        return RuntimeErrorKind.AUTHENTICATION_ERROR
+
     # Network-related errors
     if isinstance(error, requests.RequestException):
         if isinstance(error, requests.exceptions.SSLError):

{schemathesis-4.3.16 → schemathesis-4.3.17}/src/schemathesis/engine/phases/unit/__init__.py

@@ -11,7 +11,7 @@ import warnings
 from queue import Queue
 from typing import TYPE_CHECKING, Any
 
-from schemathesis.core.errors import InvalidSchema
+from schemathesis.core.errors import AuthenticationError, InvalidSchema
 from schemathesis.core.result import Ok
 from schemathesis.engine import Status, events
 from schemathesis.engine.phases import PhaseName, PhaseSkipReason
@@ -182,7 +182,7 @@ def worker_task(
                                 as_strategy_kwargs=as_strategy_kwargs,
                             ),
                         )
-                    except (InvalidSchema, InvalidArgument) as exc:
+                    except (InvalidSchema, InvalidArgument, AuthenticationError) as exc:
                         on_error(exc, method=operation.method, path=operation.path)
                         continue
 

{schemathesis-4.3.16 → schemathesis-4.3.17}/src/schemathesis/engine/phases/unit/_executor.py

@@ -19,6 +19,7 @@ from schemathesis.core.compat import BaseExceptionGroup
 from schemathesis.core.control import SkipTest
 from schemathesis.core.errors import (
     SERIALIZERS_SUGGESTION_MESSAGE,
+    AuthenticationError,
     InternalError,
     InvalidHeadersExample,
     InvalidRegexPattern,
@@ -173,6 +174,9 @@ def run_test(
         # We need more clear error message here
         status = Status.ERROR
         yield non_fatal_error(build_unsatisfiable_error(operation, with_tip=False))
+    except AuthenticationError as exc:
+        status = Status.ERROR
+        yield non_fatal_error(exc)
     except KeyboardInterrupt:
         yield scenario_finished(Status.INTERRUPTED)
         yield events.Interrupted(phase=phase)