chore(deps): bump schemathesis from 4.22.4 to 4.24.0 in the python-minor-patch group across 1 directory

[dependabot]

Bumps the python-minor-patch group with 1 update in the / directory: schemathesis.

Updates schemathesis from 4.22.4 to 4.24.0

Release notes

Sourced from schemathesis's releases.

Release 4.24.0

🚀 Added

• Dynamic token authentication support for OAuth2 and OpenID Connect security schemes.
• Reactive auth refresh: refetch the token and replay a request on configured statuses (auth.dynamic.openapi.<scheme>.retry-on, @schemathesis.auth(retry_on=[401])).

🐛 Fixed

• Report dynamic authentication token-fetch failures without duplicated text or an internal traceback.
• Explain 401/403 responses from a dynamic authentication token endpoint as rejected credentials.
• Crash dictionary changed size during iteration with multiple workers under free-threaded Python.
• Crash on schemas embedding a JSON Schema resource that declares its own $schema dialect.
• False positive positive_data_acceptance for required array query parameters generated as empty.
• False positive negative_data_rejection for body schemas with additionalProperties: false. #4332
• Generation error for request bodies with prefixItems in OpenAPI 3.1 schemas.
• Crash Cannot sample from a length-zero sequence for array items with an empty enum.
• False positive positive_data_acceptance for array items with enum entries violating the item schema.
• Undercounted stateful link totals for schemas sharing a response definition across operations.
• Operations with unresolvable $refs silently skipped when dependency ordering applies.
• False missing_deserializer warning for media types whose own schema is unstructured.
• Skip reasons in the summary borrowed from operations that were tested in another phase.

🔧 Changed

• Configuration errors shown without a traceback, under a Configuration Error heading.
• Group the missing_deserializer warning by media type, one line per operation.
• Report why operations were skipped: disabled phases, failure limit, interruption, or time limit.

Release 4.23.0

🚀 Added

• Reuse literal values from the application's Python source during generation. Disable via analysis.constants.enabled.
• Web Fuzzing Commons authentication via [auth.wfc].
• Automatic 429 retries honoring the Retry-After header with --rate-limit=auto. #1722
• checks.response_schema_conformance.validate-formats to disable format validation in response checks. #2481

🐛 Fixed

• False positive positive_data_acceptance for arrays with contains/minContains/maxContains in the coverage phase.
• False positive positive_data_acceptance for objects with dependentRequired/dependentSchemas in the coverage phase.
• False positive negative_data_rejection for objects combining additionalProperties with matching patternProperties.
• False positive positive_data_acceptance for path integers at the schema minimum. #4312
• Integers generated outside the range implied by format: int32/int64. #593
• Internal error on responses declaring an unknown or invalid charset.
• Generation error for numbers combining multipleOf with minimum and maximum in the coverage phase.
• False positive negative_data_rejection for const and propertyNames under Open API 3.0 in the coverage phase.
• Integers just below the int64 minimum accepted during schema validation.

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.24.0 - 2026-07-19

🚀 Added

• Dynamic token authentication support for OAuth2 and OpenID Connect security schemes.
• Reactive auth refresh: refetch the token and replay a request on configured statuses (auth.dynamic.openapi.<scheme>.retry-on, @schemathesis.auth(retry_on=[401])).

🐛 Fixed

• Report dynamic authentication token-fetch failures without duplicated text or an internal traceback.
• Explain 401/403 responses from a dynamic authentication token endpoint as rejected credentials.
• Crash dictionary changed size during iteration with multiple workers under free-threaded Python.
• Crash on schemas embedding a JSON Schema resource that declares its own $schema dialect.
• False positive positive_data_acceptance for required array query parameters generated as empty.
• False positive negative_data_rejection for body schemas with additionalProperties: false. #4332
• Generation error for request bodies with prefixItems in OpenAPI 3.1 schemas.
• Crash Cannot sample from a length-zero sequence for array items with an empty enum.
• False positive positive_data_acceptance for array items with enum entries violating the item schema.
• Undercounted stateful link totals for schemas sharing a response definition across operations.
• Operations with unresolvable $refs silently skipped when dependency ordering applies.
• False missing_deserializer warning for media types whose own schema is unstructured.
• Skip reasons in the summary borrowed from operations that were tested in another phase.

🔧 Changed

• Configuration errors shown without a traceback, under a Configuration Error heading.
• Group the missing_deserializer warning by media type, one line per operation.
• Report why operations were skipped: disabled phases, failure limit, interruption, or time limit.

4.23.0 - 2026-07-16

🚀 Added

• Reuse literal values from the application's Python source during generation. Disable via analysis.constants.enabled.
• Web Fuzzing Commons authentication via [auth.wfc].
• Automatic 429 retries honoring the Retry-After header with --rate-limit=auto. #1722
• checks.response_schema_conformance.validate-formats to disable format validation in response checks. #2481

🐛 Fixed

• False positive positive_data_acceptance for arrays with contains/minContains/maxContains in the coverage phase.
• False positive positive_data_acceptance for objects with dependentRequired/dependentSchemas in the coverage phase.
• False positive negative_data_rejection for objects combining additionalProperties with matching patternProperties.
• False positive positive_data_acceptance for path integers at the schema minimum. #4312
• Integers generated outside the range implied by format: int32/int64. #593
• Internal error on responses declaring an unknown or invalid charset.
• Generation error for numbers combining multipleOf with minimum and maximum in the coverage phase.
• False positive negative_data_rejection for const and propertyNames under Open API 3.0 in the coverage phase.
• Integers just below the int64 minimum accepted during schema validation.

... (truncated)

Commits

• 510d89b chore: Release 4.24.0
• c6d0e54 chore: Report why operations were skipped: disabled phases, failure limit, in...
• 23df950 fix: Skip reasons in the summary borrowed from operations that were tested in...
• 1193cee test: Make tests independent of execution order
• a5f782a fix: Operations with unresolvable $refs silently skipped when dependency or...
• 7ae345f fix: False missing_deserializer warning for media types whose own schema is...
• 11cc0d7 chore: Update pre-commit
• 22f92ae fix: Undercounted stateful link totals for schemas sharing a response definit...
• 3eac989 fix: Crash on schemas embedding a nested JSON Schema resource that declares i...
• e8ec69b fix: False positive negative_data_rejection for body schemas with `addition...
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 110 total / 25.67 per week
• Lead time for changes: avg 0.59h / median 0.0h
• Change failure rate: 75.45% (83/110)
• MTTR: 20.13h across 5 incident(s)