Skip to content

chore(deps): bump schemathesis from 4.24.3 to 4.25.2 in the python-minor-patch group across 1 directory - #247

Merged
brownjuly2003-code merged 4 commits into
mainfrom
dependabot/pip/python-minor-patch-23f990ecec
Sep 8, 2026
Merged

chore(deps): bump schemathesis from 4.24.3 to 4.25.2 in the python-minor-patch group across 1 directory#247
brownjuly2003-code merged 4 commits into
mainfrom
dependabot/pip/python-minor-patch-23f990ecec

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 1 update in the / directory: schemathesis.

Updates schemathesis from 4.24.3 to 4.25.2

Release notes

Sourced from schemathesis's releases.

Release 4.25.2

🔧 Changed

  • NDJSON report spells phase names and skip reasons as machine tokens (stateful, not_applicable).

🐛 Fixed

  • NDJSON report omitting each failure's title, severity and operation.
  • Credentials from --header, --auth, --proxy and the schema URL stored unsanitized in the recorded command.
  • Missing Allure entry in the Reports section of the CLI summary.
  • Coverage phase emitting a pattern-matching string as a multipleOf violation for union types.
  • Coverage phase emitting a value two oneOf branches admit when one keeps keywords beside $ref.
  • Coverage phase ignoring keywords beside $ref when generating values.
  • Coverage phase ignoring patternProperties entries matching a declared property name.

Release 4.25.1

🚀 Added

  • Support for validating httpx2 responses in Case.validate_response.

🔧 Changed

  • Suggest the server URL declared in the schema when the missing base_url error fires.
  • Mention warnings.fail-on in the --warnings help text.

🐛 Fixed

Coverage phase

  • Keeping false for const: 0 (and vice versa) when intersecting allowed values.
  • Emitting branch values that ignore a sibling anyOf/oneOf/allOf or the keywords beside them.
  • Emitting objects without a name one allOf branch requires and another forbids.
  • Duplicate positive cases for schemas combining anyOf/oneOf with keywords beside them.
  • Emitting a property's const that the rest of its schema rejects.
  • Emitting a oneOf value a second branch admits under the operation's draft.
  • Emitting enum/const members the operation's draft rejects.
  • Emitting example/default values the operation's draft rejects.
  • Judging anyOf/oneOf branch values against the parent in the wrong draft.
  • Crashing on multipleOf beside a numeric bound past 28 significant digits.
  • Emitting multipleOf steps no float can carry, landing back on the excluded bound.
  • Numeric exclusiveMinimum/exclusiveMaximum overriding a tighter minimum/maximum instead of combining.
  • Integer boundary values emitted as floats when the bound is written like 7.0.
  • Integer steps past float bounds taken in binary, not the decimal the validator reads.
  • Emitting an excluded integer bound when minimum/maximum repeats a large float exclusiveMinimum/exclusiveMaximum.
  • Emitting a float as a type violation for integer when number is allowed too.
  • Emitting a non-multiple for multipleOf past 2^53.
  • Emitting inf as a violation of a bound at the largest float.
  • Generating non-integer values for integers with a fractional multipleOf.

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.25.2 - 2026-08-24

🔧 Changed

  • NDJSON report spells phase names and skip reasons as machine tokens (stateful, not_applicable).

🐛 Fixed

  • NDJSON report omitting each failure's title, severity and operation.
  • Credentials from --header, --auth, --proxy and the schema URL stored unsanitized in the recorded command.
  • Missing Allure entry in the Reports section of the CLI summary.
  • Coverage phase emitting a pattern-matching string as a multipleOf violation for union types.
  • Coverage phase emitting a value two oneOf branches admit when one keeps keywords beside $ref.
  • Coverage phase ignoring keywords beside $ref when generating values.
  • Coverage phase ignoring patternProperties entries matching a declared property name.

4.25.1 - 2026-08-24

🚀 Added

  • Support for validating httpx2 responses in Case.validate_response.

🔧 Changed

  • Suggest the server URL declared in the schema when the missing base_url error fires.
  • Mention warnings.fail-on in the --warnings help text.

🐛 Fixed

Coverage phase

  • Keeping false for const: 0 (and vice versa) when intersecting allowed values.
  • Emitting branch values that ignore a sibling anyOf/oneOf/allOf or the keywords beside them.
  • Emitting objects without a name one allOf branch requires and another forbids.
  • Duplicate positive cases for schemas combining anyOf/oneOf with keywords beside them.
  • Emitting a property's const that the rest of its schema rejects.
  • Emitting a oneOf value a second branch admits under the operation's draft.
  • Emitting enum/const members the operation's draft rejects.
  • Emitting example/default values the operation's draft rejects.
  • Judging anyOf/oneOf branch values against the parent in the wrong draft.
  • Crashing on multipleOf beside a numeric bound past 28 significant digits.
  • Emitting multipleOf steps no float can carry, landing back on the excluded bound.
  • Numeric exclusiveMinimum/exclusiveMaximum overriding a tighter minimum/maximum instead of combining.
  • Integer boundary values emitted as floats when the bound is written like 7.0.
  • Integer steps past float bounds taken in binary, not the decimal the validator reads.
  • Emitting an excluded integer bound when minimum/maximum repeats a large float exclusiveMinimum/exclusiveMaximum.
  • Emitting a float as a type violation for integer when number is allowed too.
  • Emitting a non-multiple for multipleOf past 2^53.
  • Emitting inf as a violation of a bound at the largest float.
  • Generating non-integer values for integers with a fractional multipleOf.

... (truncated)

Commits
  • 510bf7b chore: Release 4.25.2
  • c88a80d fix: Coverage phase ignoring patternProperties entries matching a declared ...
  • 8b934ba chore: NDJSON report spells phase names and skip reasons as machine tokens
  • f63aeac fix: Coverage phase ignoring keywords beside $ref when generating values
  • bd986ac fix: Coverage phase emitting a value two oneOf branches admit when one keep...
  • 3e02e72 fix: Coverage phase emitting a pattern-matching string as a multipleOf vi...
  • d583dac fix: Missing Allure entry in the Reports section of the CLI summary
  • a4f7646 fix: Credentials from --header, --auth, --proxy and the schema URL stor...
  • 098b239 fix: NDJSON report omitting each failure's title, severity and operation
  • 2cf28f4 chore: Release 4.25.1
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 24, 2026
@github-actions

github-actions Bot commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown

DORA Metrics

  • Window: last 30 days
  • Branch: main
  • Deployment frequency: 15 total / 3.5 per week
  • Lead time for changes: avg 0.08h / median 0.0h
  • Change failure rate: 60.0% (9/15)
  • MTTR: 79.52h across 11 incident(s)

@dependabot dependabot Bot changed the title chore(deps): bump schemathesis from 4.24.3 to 4.25.0 in the python-minor-patch group chore(deps): bump schemathesis from 4.24.3 to 4.25.2 in the python-minor-patch group across 1 directory Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/python-minor-patch-23f990ecec branch from 1c472fa to 0160af9 Compare August 31, 2026 03:12
@dependabot
chore(deps): bump schemathesis
a947ca2 
Bumps the python-minor-patch group with 1 update in the / directory: [schemathesis](https://github.com/schemathesis/schemathesis).


Updates `schemathesis` from 4.24.3 to 4.25.2
- [Release notes](https://github.com/schemathesis/schemathesis/releases)
- [Changelog](https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md)
- [Commits](schemathesis/schemathesis@v4.24.3...v4.25.2)

---
updated-dependencies:
- dependency-name: schemathesis
  dependency-version: 4.25.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/python-minor-patch-23f990ecec branch from 0160af9 to a947ca2 Compare September 7, 2026 03:10
JuliaEdom and others added 3 commits September 7, 2026 22:42
@JuliaEdom
Merge remote-tracking branch 'origin/main' into dependabot/pip/python…
fded666 
…-minor-patch-23f990ecec
@JuliaEdom @claude
chore(deps): retire the jsonschema-rs pin that blocked schemathesis 4.25
186ae74 
Dependabot has proposed schemathesis 4.25.2 since 2026-09-07 and the PR
could not resolve, let alone merge: `uv lock` fails outright.

  Because schemathesis==4.25.2 depends on jsonschema-rs>=0.51.0,<0.52.0
  and jsonschema-rs<0.50, we can conclude that schemathesis==4.25.2
  cannot be used.

The `jsonschema-rs<0.50` half is ours. schemathesis 4.24.x declared
jsonschema-rs>=0.49.0 with no ceiling while calling
CanonicalSchema.is_satisfiable, which jsonschema-rs 0.50.0 removed, so
tests/contract failed with AttributeError on 0.50.x. The pin in
[tool.uv] constraint-dependencies held the transitive resolution back
"until schemathesis fixes its range upstream".

It has. 4.25.x declares jsonschema-rs>=0.51.0,<0.52.0 -- an exact
supported pairing rather than an open floor -- and the call that broke is
gone: schemathesis 4.25.2 contains no reference to `is_satisfiable`
anywhere (0 hits across the installed package; jsonschema-rs 0.51.0 still
exposes CanonicalSchema, still without that method). Our ceiling and
theirs are now disjoint, so the pin no longer protects anything -- it is
the only thing blocking the bump.

Removed, with the reason it existed and the reason it went kept in place,
since a bare deletion invites someone to re-add it the next time a
transitive resolution surprises them.

uv.lock: schemathesis 4.24.3 -> 4.25.2, jsonschema-rs 0.49.9 -> 0.51.0,
hypothesis-jsonschema dropped (4.25 no longer depends on it).
requirements-docker.lock is unchanged -- schemathesis is in the `contract`
extra, which the cloud/postgres export does not include.

Verified locally: `uv lock --check` passes (255 packages),
`uv export ... -o requirements-docker.lock` leaves no diff,
scripts/validate_project_claims.py OK, and the pyproject/contract ratchets
pass (38 passed across test_contract_dependencies,
test_contract_workflow, test_cross_package_install_contract,
test_audit_quality_gates, test_env_preflight_and_ci_pinning). The run
that matters for the pairing is CI's `contract` job, which is what caught
the 0.50.0 breakage in the first place.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ybRVCaL1Lyd9d5kFTndh3
@brownjuly2003-code
Merge branch 'main' into dependabot/pip/python-minor-patch-23f990ecec
e23b758
@brownjuly2003-code
brownjuly2003-code merged commit 3517599 into main Sep 8, 2026
30 checks passed
@brownjuly2003-code
brownjuly2003-code deleted the dependabot/pip/python-minor-patch-23f990ecec branch September 8, 2026 08:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@brownjuly2003-code @JuliaEdom