chore(deps): bump schemathesis from 3.38.9 to 4.25.2

[dependabot]

Bumps schemathesis from 3.38.9 to 4.25.2.

Release notes

Sourced from schemathesis's releases.

Release 4.25.2

🔧 Changed

• NDJSON report spells phase names and skip reasons as machine tokens (stateful, not_applicable).

🐛 Fixed

• NDJSON report omitting each failure's title, severity and operation.
• Credentials from --header, --auth, --proxy and the schema URL stored unsanitized in the recorded command.
• Missing Allure entry in the Reports section of the CLI summary.
• Coverage phase emitting a pattern-matching string as a multipleOf violation for union types.
• Coverage phase emitting a value two oneOf branches admit when one keeps keywords beside $ref.
• Coverage phase ignoring keywords beside $ref when generating values.
• Coverage phase ignoring patternProperties entries matching a declared property name.

Release 4.25.1

🚀 Added

• Support for validating httpx2 responses in Case.validate_response.

🔧 Changed

• Suggest the server URL declared in the schema when the missing base_url error fires.
• Mention warnings.fail-on in the --warnings help text.

🐛 Fixed

Coverage phase

• Keeping false for const: 0 (and vice versa) when intersecting allowed values.
• Emitting branch values that ignore a sibling anyOf/oneOf/allOf or the keywords beside them.
• Emitting objects without a name one allOf branch requires and another forbids.
• Duplicate positive cases for schemas combining anyOf/oneOf with keywords beside them.
• Emitting a property's const that the rest of its schema rejects.
• Emitting a oneOf value a second branch admits under the operation's draft.
• Emitting enum/const members the operation's draft rejects.
• Emitting example/default values the operation's draft rejects.
• Judging anyOf/oneOf branch values against the parent in the wrong draft.
• Crashing on multipleOf beside a numeric bound past 28 significant digits.
• Emitting multipleOf steps no float can carry, landing back on the excluded bound.
• Numeric exclusiveMinimum/exclusiveMaximum overriding a tighter minimum/maximum instead of combining.
• Integer boundary values emitted as floats when the bound is written like 7.0.
• Integer steps past float bounds taken in binary, not the decimal the validator reads.
• Emitting an excluded integer bound when minimum/maximum repeats a large float exclusiveMinimum/exclusiveMaximum.
• Emitting a float as a type violation for integer when number is allowed too.
• Emitting a non-multiple for multipleOf past 2^53.
• Emitting inf as a violation of a bound at the largest float.
• Generating non-integer values for integers with a fractional multipleOf.

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.25.2 - 2026-08-24

🔧 Changed

• NDJSON report spells phase names and skip reasons as machine tokens (stateful, not_applicable).

🐛 Fixed

• NDJSON report omitting each failure's title, severity and operation.
• Credentials from --header, --auth, --proxy and the schema URL stored unsanitized in the recorded command.
• Missing Allure entry in the Reports section of the CLI summary.
• Coverage phase emitting a pattern-matching string as a multipleOf violation for union types.
• Coverage phase emitting a value two oneOf branches admit when one keeps keywords beside $ref.
• Coverage phase ignoring keywords beside $ref when generating values.
• Coverage phase ignoring patternProperties entries matching a declared property name.

4.25.1 - 2026-08-24

🚀 Added

• Support for validating httpx2 responses in Case.validate_response.

🔧 Changed

• Suggest the server URL declared in the schema when the missing base_url error fires.
• Mention warnings.fail-on in the --warnings help text.

🐛 Fixed

Coverage phase

• Keeping false for const: 0 (and vice versa) when intersecting allowed values.
• Emitting branch values that ignore a sibling anyOf/oneOf/allOf or the keywords beside them.
• Emitting objects without a name one allOf branch requires and another forbids.
• Duplicate positive cases for schemas combining anyOf/oneOf with keywords beside them.
• Emitting a property's const that the rest of its schema rejects.
• Emitting a oneOf value a second branch admits under the operation's draft.
• Emitting enum/const members the operation's draft rejects.
• Emitting example/default values the operation's draft rejects.
• Judging anyOf/oneOf branch values against the parent in the wrong draft.
• Crashing on multipleOf beside a numeric bound past 28 significant digits.
• Emitting multipleOf steps no float can carry, landing back on the excluded bound.
• Numeric exclusiveMinimum/exclusiveMaximum overriding a tighter minimum/maximum instead of combining.
• Integer boundary values emitted as floats when the bound is written like 7.0.
• Integer steps past float bounds taken in binary, not the decimal the validator reads.
• Emitting an excluded integer bound when minimum/maximum repeats a large float exclusiveMinimum/exclusiveMaximum.
• Emitting a float as a type violation for integer when number is allowed too.
• Emitting a non-multiple for multipleOf past 2^53.
• Emitting inf as a violation of a bound at the largest float.
• Generating non-integer values for integers with a fractional multipleOf.

... (truncated)

Commits

• 510bf7b chore: Release 4.25.2
• c88a80d fix: Coverage phase ignoring patternProperties entries matching a declared ...
• 8b934ba chore: NDJSON report spells phase names and skip reasons as machine tokens
• f63aeac fix: Coverage phase ignoring keywords beside $ref when generating values
• bd986ac fix: Coverage phase emitting a value two oneOf branches admit when one keep...
• 3e02e72 fix: Coverage phase emitting a pattern-matching string as a multipleOf vi...
• d583dac fix: Missing Allure entry in the Reports section of the CLI summary
• a4f7646 fix: Credentials from --header, --auth, --proxy and the schema URL stor...
• 098b239 fix: NDJSON report omitting each failure's title, severity and operation
• 2cf28f4 chore: Release 4.25.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.