chore(deps): bump schemathesis from 4.27.3 to 4.28.0 in /schema-tests

[dependabot]

Bumps schemathesis from 4.27.3 to 4.28.0.

Release notes

Sourced from schemathesis's releases.

Release 4.28.0

🚀 Added

• Fuzz dictionary bindings for GraphQL arguments via <Type>.<field>.<argument> keys.
• Opt-in low_valid_rate warning for operations that accept few of the requests sent to them.
• A server that stops accepting connections ends the run with one Server Unavailable error.
• missing_test_data warns for GraphQL operations whose responses never carry data.
• st replay retries passing crashes up to three times and reports intermittent ones as FLAKY.
• Dynamic auth extract_from = "cookie" takes a named cookie from a Set-Cookie login response.
• schemathesis.errors.FailureGroup for catching failures raised by validate_response.
• Support for pytest 8.4.
• validate() and is_valid() on request parameters for checking values against the schema.

🐛 Fixed

• False positive negative_data_rejection for regex, uri-reference and similar string formats in fuzzing.
• False positive response_schema_conformance for HEAD responses that declare a body.
• False positive 'negative_data_rejection' for unknown query parameters next to boolean ones.
• Send examples that different parameters declare under the same name together.
• Send the value, not the name, for examples maps inside a parameter or body schema.
• False positive GraphQL server errors for resolver rejections labelled in error extensions.
• Report OpenAPI links to missing operations or unresolvable references as invalid links.
• Complete partial request body examples declared under the examples keyword.
• Protocol-relative $ref (//host/schema.json) failing to resolve for schemas loaded from a file.
• XML serialization error for scalar bodies under a root element with a namespace prefix.
• Generate cookie values from RFC 6265 cookie-octets only.
• Send a JSON string, not raw bytes, for top-level format: binary JSON bodies.

🔧 Changed

• Name the conflicting constraints and where they sit when test data cannot be generated.
• Report GraphQL non-nullable fields resolving to null as a GraphQL schema violation, severity high.
• missing_test_data names the operation that appears to supply the data an unlinked operation needs, or reports that none does.

Release 4.27.5

🐛 Fixed

• Crash on schemas where properties is not an object.
• Drop parameter examples built from nested ones that violate the parameter's own schema.
• Skip parameter schema examples values that violate that schema in the examples phase.
• Coverage phase probing methods of operations disabled via [[operations]].
• Crash in the examples phase for allOf members with wrongly typed examples or required.
• Server-Sent Events: False positives for event payloads containing U+2028 or other control characters.
• Validate SSE events against both itemSchema and a sibling schema.
• Report a schema error instead of a generic check failure for boolean allOf/anyOf branches.

Release 4.27.4

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.28.0 - 2026-09-23

🚀 Added

• Fuzz dictionary bindings for GraphQL arguments via <Type>.<field>.<argument> keys.
• Opt-in low_valid_rate warning for operations that accept few of the requests sent to them.
• A server that stops accepting connections ends the run with one Server Unavailable error.
• missing_test_data warns for GraphQL operations whose responses never carry data.
• st replay retries passing crashes up to three times and reports intermittent ones as FLAKY.
• Dynamic auth extract_from = "cookie" takes a named cookie from a Set-Cookie login response.
• schemathesis.errors.FailureGroup for catching failures raised by validate_response.
• Support for pytest 8.4.
• validate() and is_valid() on request parameters for checking values against the schema.

🐛 Fixed

• False positive negative_data_rejection for regex, uri-reference and similar string formats in fuzzing.
• False positive response_schema_conformance for HEAD responses that declare a body.
• False positive 'negative_data_rejection' for unknown query parameters next to boolean ones.
• Send examples that different parameters declare under the same name together.
• Send the value, not the name, for examples maps inside a parameter or body schema.
• False positive GraphQL server errors for resolver rejections labelled in error extensions.
• Report OpenAPI links to missing operations or unresolvable references as invalid links.
• Complete partial request body examples declared under the examples keyword.
• Protocol-relative $ref (//host/schema.json) failing to resolve for schemas loaded from a file.
• XML serialization error for scalar bodies under a root element with a namespace prefix.
• Generate cookie values from RFC 6265 cookie-octets only.
• Send a JSON string, not raw bytes, for top-level format: binary JSON bodies.

🔧 Changed

• Name the conflicting constraints and where they sit when test data cannot be generated.
• Report GraphQL non-nullable fields resolving to null as a GraphQL schema violation, severity high.
• missing_test_data names the operation that appears to supply the data an unlinked operation needs, or reports that none does.

4.27.5 - 2026-09-20

🐛 Fixed

• Crash on schemas where properties is not an object.
• Drop parameter examples built from nested ones that violate the parameter's own schema.
• Skip parameter schema examples values that violate that schema in the examples phase.
• Coverage phase probing methods of operations disabled via [[operations]].
• Crash in the examples phase for allOf members with wrongly typed examples or required.
• Server-Sent Events: False positives for event payloads containing U+2028 or other control characters.
• Validate SSE events against both itemSchema and a sibling schema.
• Report a schema error instead of a generic check failure for boolean allOf/anyOf branches.

4.27.4 - 2026-09-19

... (truncated)

Commits

• 48881ac chore: Release 4.28.0
• fefd1b9 fix: False positive negative_data_rejection for regex, uri-reference an...
• 50897ec fix: Send a JSON string, not raw bytes, for top-level format: binary JSON b...
• 2d4d12d fix: False positive 'negative_data_rejection' for unknown query parameters ne...
• bbed0e0 fix: Generate cookie values from RFC 6265 cookie-octets only
• 4ff8af0 fix: Report OpenAPI links to missing operations or unresolvable references as...
• d5dd46b fix: False positive response_schema_conformance for HEAD responses that dec...
• fedcd8b fix: XML serialization error for scalar bodies under a root element with a na...
• 51c0816 docs: Update docs
• 4c39957 chore: Name the conflicting constraints and where they sit when test data can...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!