[dependabot]

Bumps the python group with 2 updates: fastapi and schemathesis.

Updates fastapi from 0.142.4 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

• 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

Commits

• f5c6e9b 🔖 Release version 0.143.0 (#16477)
• 182c8b8 📝 Update release notes
• af889e4 💥 Require opt-in for automatic OpenTelemetry exporter setup (#16476)
• See full diff in compare view

Updates schemathesis from 4.29.4 to 4.30.0

Release notes

Sourced from schemathesis's releases.

Release 4.30.0

🚀 Added

• Sign up and log in automatically when the schema declares sign-up and login operations.
• Suggest a dynamic auth config when authentication fails on schemas with sign-up and login operations.
• Dependency inference links values only an item GET returns, like version, into update bodies.
• Dependency inference links ids created inside response envelopes, and fromAirportId-style fields to fromAirport objects.
• max-stream-events config option to stop reading Server-Sent Events streams after that many events. #3633

🔧 Changed

• Follow redirects only within the requested host; return redirects elsewhere as the response.
• positive_data_acceptance accepts 3xx responses by default.
• Coverage phase leads with values from earlier responses over declared parameter examples.

🐛 Fixed

• False positive ignored_auth on redirects to a login page and on invalid path parameters.
• False positive negative_data_rejection on valid bodies after a before_call hook edits another part. #5105
• False positive negative_data_rejection when a body.* parameter override restores the mutated field.
• pytest plugin collecting @schema.parametrize() tests imported under names pytest would not collect.
• Schema Error on Open API 3.1 schemas using array-form items for tuples.
• Crash on response examples whose media type declares a boolean schema.
• Network error on the first redirect with max-redirects = 0.
• Stateful testing aborting when a few operations hang instead of skipping them.
• st run applying Hypothesis's CI profile over explicit options when CI is set. #4391
• Omit empty exploded-object query parameters from requests.
• Dependency inference missing links from collection listings to item path parameters like {partition_id}.
• Stateful testing failing with invalid inferred links when operations share a response definition.
• Schema Error "Invalid operationRef definition" for inferred links to templated paths.
• ignored_auth crash in Case.validate_response on schemas without an absolute base URL.
• Crash on non-string pattern definitions during test case generation.
• False "credentials likely invalidated" warning when an endpoint returns 401 after a successful re-login.
• Server-Sent Events: validate schema against the whole stream, as an array of events. #3633
• Spurious internal or schema error when values learned from responses alter test case generation.
• Negative mode skipping operations when --header sets only some required headers.
• Stateful phase failing the run on baseline failures when Hypothesis reports the suite as flaky. #5104
• Record pytest invocations correctly in generated reports.
• WFC report fault categories missing the id required by WFC Report 0.8.0.
• Engine runs against ASGI apps sending requests over the network, and crashing on WSGI apps.
• --generation-deterministic producing different test cases per run, and st fuzz ignoring --generation-database.
• Links with percent-encoded operationRef (e.g. %7Bid%7D) resolving to the wrong operation.
• ResourceWarning about unclosed streams after ASGI lifespan shutdown. #5085
• Reproduction commands showing the schema's base URL instead of the requested one.
• Report server outages behind port proxies like docker run -p once, not per operation.
• Crash in stateful testing on paths with segments like {id}:cancel.
• Misleading additionalProperties hint when the server rejects a body for its NUL characters.
• False positive unsupported_method for methods a templated path declares on the same URL.
• Hang or timeout error on endless Server-Sent Events streams. #3633

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.30.0 - 2026-10-08

🚀 Added

• Sign up and log in automatically when the schema declares sign-up and login operations.
• Suggest a dynamic auth config when authentication fails on schemas with sign-up and login operations.
• Dependency inference links values only an item GET returns, like version, into update bodies.
• Dependency inference links ids created inside response envelopes, and fromAirportId-style fields to fromAirport objects.
• max-stream-events config option to stop reading Server-Sent Events streams after that many events. #3633

🔧 Changed

• Follow redirects only within the requested host; return redirects elsewhere as the response.
• positive_data_acceptance accepts 3xx responses by default.
• Coverage phase leads with values from earlier responses over declared parameter examples.

🐛 Fixed

• False positive ignored_auth on redirects to a login page and on invalid path parameters.
• False positive negative_data_rejection on valid bodies after a before_call hook edits another part. #5105
• False positive negative_data_rejection when a body.* parameter override restores the mutated field.
• pytest plugin collecting @schema.parametrize() tests imported under names pytest would not collect.
• Schema Error on Open API 3.1 schemas using array-form items for tuples.
• Crash on response examples whose media type declares a boolean schema.
• Network error on the first redirect with max-redirects = 0.
• Stateful testing aborting when a few operations hang instead of skipping them.
• st run applying Hypothesis's CI profile over explicit options when CI is set. #4391
• Omit empty exploded-object query parameters from requests.
• Dependency inference missing links from collection listings to item path parameters like {partition_id}.
• Stateful testing failing with invalid inferred links when operations share a response definition.
• Schema Error "Invalid operationRef definition" for inferred links to templated paths.
• ignored_auth crash in Case.validate_response on schemas without an absolute base URL.
• Crash on non-string pattern definitions during test case generation.
• False "credentials likely invalidated" warning when an endpoint returns 401 after a successful re-login.
• Server-Sent Events: validate schema against the whole stream, as an array of events. #3633
• Spurious internal or schema error when values learned from responses alter test case generation.
• Negative mode skipping operations when --header sets only some required headers.
• Stateful phase failing the run on baseline failures when Hypothesis reports the suite as flaky. #5104
• Record pytest invocations correctly in generated reports.
• WFC report fault categories missing the id required by WFC Report 0.8.0.
• Engine runs against ASGI apps sending requests over the network, and crashing on WSGI apps.
• --generation-deterministic producing different test cases per run, and st fuzz ignoring --generation-database.
• Links with percent-encoded operationRef (e.g. %7Bid%7D) resolving to the wrong operation.
• ResourceWarning about unclosed streams after ASGI lifespan shutdown. #5085
• Reproduction commands showing the schema's base URL instead of the requested one.
• Report server outages behind port proxies like docker run -p once, not per operation.
• Crash in stateful testing on paths with segments like {id}:cancel.
• Misleading additionalProperties hint when the server rejects a body for its NUL characters.
• False positive unsupported_method for methods a templated path declares on the same URL.
• Hang or timeout error on endless Server-Sent Events streams. #3633

... (truncated)

Commits

• 513c716 chore: Release 4.30.0
• 074ca5e chore: Update tracecov to 0.25.2
• c21fcc8 test: Make the inferred-link schema error test independent of timing
• 8a02250 test: Fix flaky tests
• 6cf0edd fix: Links with percent-encoded operationRef (e.g. %7Bid%7D) resolving to...
• 66d5c5a fix: Spurious internal or schema error when values learned from responses alt...
• fe980d1 fix: Crash at the end of st run when the baseline file cannot be written
• 63ef3a0 fix: False positive ignored_auth on redirects to a login page and on invali...
• 5be614a fix: Schema Error "Invalid operationRef definition" for inferred links to t...
• 64e9d16 fix: Schema Error on Open API 3.1 schemas using array-form items for tuples
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.