[dependabot]

Updates the requirements on schemathesis to permit the latest version.

Release notes

Sourced from schemathesis's releases.

Release 4.32.2

🏎️ Performance

• ~10% faster coverage phase on deeply nested request bodies.
• ~5% faster stateful phase when operations reuse values captured from earlier responses.

🐛 Fixed

st fuzz

• Send a single listed identifier when st fuzz follows links from list responses.
• st fuzz --mode=negative crash on operations with nothing to negate.
• List written reports when st fuzz stops on a fatal error like an unreachable schema.
• Keep st fuzz running past Inconsistent data generation errors caused by changing server state.

Stateful testing

• Use captured values for body fields under digit-named properties.
• Link inference from response URLs running when location-headers is not in inference.algorithms.
• Crash and wrong link bodies for request body properties named with non-ASCII digits like ².

Coverage phase

• Invalid positive bodies in the coverage phase for allOf branches with patternProperties beside additionalProperties.
• Duplicate coverage-phase default case equal to example when examples is also declared.
• Duplicate requests in the coverage phase for operations with a request body.

Data generation

• RecursionError during generation for arrays whose items or contains refer back to an enclosing schema.
• Failed Health Check for request bodies with several $-anchored pattern strings. #5491
• Failed Health Check for strings whose pattern is stricter than their format. #5491
• Match custom payload strategies to concrete media types selected from wildcard request declarations.

Request serialization

• Serialize XML array items that declare their own prefix and namespace.
• Malformed XML or wrong tags for prefixed nested properties and array items shared via $ref.
• Missing boundary in multipart/mixed request Content-Type headers.

Checks

• False positive negative_data_rejection for path and query parameters whose sent text is valid.
• False positive negative_data_rejection when configured auth refilled a negated auth header.
• False results in response_headers_conformance for OpenAPI 3.1 type lists and 1_0-style numbers.
• False positive response_headers_conformance for object-typed response headers.
• False positive ignored_auth when the invalid-auth probe dropped the case's other headers.
• ValueError crash in use_after_free and ensure_resource_availability for non-ASCII digit Age headers.

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.32.2 - 2026-10-20

🏎️ Performance

• ~10% faster coverage phase on deeply nested request bodies.
• ~5% faster stateful phase when operations reuse values captured from earlier responses.

🐛 Fixed

st fuzz

• Send a single listed identifier when st fuzz follows links from list responses.
• st fuzz --mode=negative crash on operations with nothing to negate.
• List written reports when st fuzz stops on a fatal error like an unreachable schema.
• Keep st fuzz running past Inconsistent data generation errors caused by changing server state.

Stateful testing

• Use captured values for body fields under digit-named properties.
• Link inference from response URLs running when location-headers is not in inference.algorithms.
• Crash and wrong link bodies for request body properties named with non-ASCII digits like ².

Coverage phase

• Invalid positive bodies in the coverage phase for allOf branches with patternProperties beside additionalProperties.
• Duplicate coverage-phase default case equal to example when examples is also declared.
• Duplicate requests in the coverage phase for operations with a request body.

Data generation

• RecursionError during generation for arrays whose items or contains refer back to an enclosing schema.
• Failed Health Check for request bodies with several $-anchored pattern strings. #5491
• Failed Health Check for strings whose pattern is stricter than their format. #5491
• Match custom payload strategies to concrete media types selected from wildcard request declarations.

Request serialization

• Serialize XML array items that declare their own prefix and namespace.
• Malformed XML or wrong tags for prefixed nested properties and array items shared via $ref.
• Missing boundary in multipart/mixed request Content-Type headers.

Checks

• False positive negative_data_rejection for path and query parameters whose sent text is valid.
• False positive negative_data_rejection when configured auth refilled a negated auth header.
• False results in response_headers_conformance for OpenAPI 3.1 type lists and 1_0-style numbers.
• False positive response_headers_conformance for object-typed response headers.
• False positive ignored_auth when the invalid-auth probe dropped the case's other headers.
• ValueError crash in use_after_free and ensure_resource_availability for non-ASCII digit Age headers.

... (truncated)

Commits

• dea658b chore: Release 4.32.2
• 826bfcc docs: Update changelog
• c240633 fix: Unchecked retried 429 responses outside stateful testing with `--rate-...
• 695b66e chore: Update tracecov to 0.25.4
• 83304d1 fix: Show the 429 response for failures on waited-out rate limits with `--rat...
• 659608e fix: Configured User-Agent missing from case.headers in before_call hoo...
• dc23d5a fix: Missing Identity: line in JUnit and Allure failure reports
• 18ed502 fix: Duplicate coverage-phase default case equal to example when `example...
• a418f0b ci: run CodSpeed simulation benchmarks on Python 3.14
• 258bf55 fix: False positive response_headers_conformance for object-typed response ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)