[dependabot]

Bumps schemathesis from 4.32.7 to 4.33.0.

Release notes

Sourced from schemathesis's releases.

Release 4.33.0

🚀 Added

• Coverage phase for GraphQL schemas.
• response_schema_conformance checks GraphQL data for missing, unrequested and mistyped fields.
• Fuzzing unary gRPC methods through server reflection or descriptor sets.
• XML request bodies follow Open API 3.2 nodeType (attribute, element, text, cdata).
• Cookie parameters follow Open API 3.2 style: cookie.
• response_schema_conformance checks JSON Lines and JSON Text Sequence responses against Open API 3.2 itemSchema.

🏎️ Performance

• Faster pytest collection with lower memory: coverage phase cases are built when a test runs.

🔧 Changed

• WFC reports declare report schema version 0.10.0, from WFC 0.13.0.

🐛 Fixed

Coverage phase

• Descriptions naming optional parameters the request does not send.
• Request body schemas modified when they declare examples.
• null values described as "Value null value".
• Locations for tuple array negatives missing the item index.
• Valid optional null query parameters sent as null in cases targeting a sibling.
• Values generated from not schemas described by the inner schema's scenario.
• Cases dropped when they differ only in their binary payload.
• Strings outside the configured generation.codec.
• Header and cookie values containing characters from exclude-header-characters.

Data generation

• Crash when generating unique arrays of binary strings.
• Generated strings failing pattern when combined with minLength / maxLength.
• Valid strings never generated for pattern with optional or repeated parts combined with length bounds.
• Open API 2.0 parameter x-example drawn twice as often in fuzzing.
• Example Objects in list-style examples used as the example itself.
• Negative cookie values outside RFC 6265 cookie-octets, causing false negative_data_rejection failures.
• Open API 3.2 Example Objects with dataValue or serializedValue sent as the example itself.
• Example Objects referenced via $ref ignored in bodies and responses, or crashing in external files.
• Example Objects reached through $ref chains ignored, or sent as the $ref object itself.

Request serialization

• Objects and arrays inside header and query parameter values sent as Python repr.
• xml settings ignored for schemas reached through $ref chains or declared beside a $ref.
• Reject unbound XML prefixes outside the element whose attribute declares their namespace.

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.33.0 - 2026-11-01

🚀 Added

• Coverage phase for GraphQL schemas.
• response_schema_conformance checks GraphQL data for missing, unrequested and mistyped fields.
• Fuzzing unary gRPC methods through server reflection or descriptor sets.
• XML request bodies follow Open API 3.2 nodeType (attribute, element, text, cdata).
• Cookie parameters follow Open API 3.2 style: cookie.
• response_schema_conformance checks JSON Lines and JSON Text Sequence responses against Open API 3.2 itemSchema.

🏎️ Performance

• Faster pytest collection with lower memory: coverage phase cases are built when a test runs.

🔧 Changed

• WFC reports declare report schema version 0.10.0, from WFC 0.13.0.

🐛 Fixed

Coverage phase

• Descriptions naming optional parameters the request does not send.
• Request body schemas modified when they declare examples.
• null values described as "Value null value".
• Locations for tuple array negatives missing the item index.
• Valid optional null query parameters sent as null in cases targeting a sibling.
• Values generated from not schemas described by the inner schema's scenario.
• Cases dropped when they differ only in their binary payload.
• Strings outside the configured generation.codec.
• Header and cookie values containing characters from exclude-header-characters.

Data generation

• Crash when generating unique arrays of binary strings.
• Generated strings failing pattern when combined with minLength / maxLength.
• Generated arrays failing maxContains, or not: {uniqueItems: true} alongside prefixItems / contains.
• Valid strings never generated for pattern with optional or repeated parts combined with length bounds.
• Open API 2.0 parameter x-example drawn twice as often in fuzzing.
• Example Objects in list-style examples used as the example itself.
• Negative cookie values outside RFC 6265 cookie-octets, causing false negative_data_rejection failures.
• Open API 3.2 Example Objects with dataValue or serializedValue sent as the example itself.
• Example Objects referenced via $ref ignored in bodies and responses, or crashing in external files.
• Example Objects reached through $ref chains ignored, or sent as the $ref object itself.

Request serialization

• Objects and arrays inside header and query parameter values sent as Python repr.
• xml settings ignored for schemas reached through $ref chains or declared beside a $ref.

... (truncated)

Commits

• 5fac3a5 chore: Release 4.33.0
• 2d9d6f1 docs: Update README
• 332957e fix: Quote the gRPC install hint and document the Docker and Action limitation
• 634432e fix: Crashes on undecodable gRPC raw bodies, unmasked or unfaithful grpcurl c...
• 86da71f docs: Update changelog
• 76e6965 fix: gRPC request timeouts reported as server errors when the deadline fires ...
• f214deb fix: gRPC operation and status names shown as HTTP method, path and status co...
• 5912584 fix: gRPC stateful testing ignoring learned requirements and non-UTF-8 names,...
• f2ba405 fix: False verdicts in gRPC response conformance and ignored_auth checks
• bd514c8 fix: gRPC oneof, enum alias, float and map-key validation rules generating re...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)