chore(deps-dev): bump schemathesis from 4.16.1 to 4.24.0 in /clients/python

[dependabot]

Bumps schemathesis from 4.16.1 to 4.24.0.

Release notes

Sourced from schemathesis's releases.

Release 4.24.0

🚀 Added

• Dynamic token authentication support for OAuth2 and OpenID Connect security schemes.
• Reactive auth refresh: refetch the token and replay a request on configured statuses (auth.dynamic.openapi.<scheme>.retry-on, @schemathesis.auth(retry_on=[401])).

🐛 Fixed

• Report dynamic authentication token-fetch failures without duplicated text or an internal traceback.
• Explain 401/403 responses from a dynamic authentication token endpoint as rejected credentials.
• Crash dictionary changed size during iteration with multiple workers under free-threaded Python.
• Crash on schemas embedding a JSON Schema resource that declares its own $schema dialect.
• False positive positive_data_acceptance for required array query parameters generated as empty.
• False positive negative_data_rejection for body schemas with additionalProperties: false. #4332
• Generation error for request bodies with prefixItems in OpenAPI 3.1 schemas.
• Crash Cannot sample from a length-zero sequence for array items with an empty enum.
• False positive positive_data_acceptance for array items with enum entries violating the item schema.
• Undercounted stateful link totals for schemas sharing a response definition across operations.
• Operations with unresolvable $refs silently skipped when dependency ordering applies.
• False missing_deserializer warning for media types whose own schema is unstructured.
• Skip reasons in the summary borrowed from operations that were tested in another phase.

🔧 Changed

• Configuration errors shown without a traceback, under a Configuration Error heading.
• Group the missing_deserializer warning by media type, one line per operation.
• Report why operations were skipped: disabled phases, failure limit, interruption, or time limit.

Release 4.23.0

🚀 Added

• Reuse literal values from the application's Python source during generation. Disable via analysis.constants.enabled.
• Web Fuzzing Commons authentication via [auth.wfc].
• Automatic 429 retries honoring the Retry-After header with --rate-limit=auto. #1722
• checks.response_schema_conformance.validate-formats to disable format validation in response checks. #2481

🐛 Fixed

• False positive positive_data_acceptance for arrays with contains/minContains/maxContains in the coverage phase.
• False positive positive_data_acceptance for objects with dependentRequired/dependentSchemas in the coverage phase.
• False positive negative_data_rejection for objects combining additionalProperties with matching patternProperties.
• False positive positive_data_acceptance for path integers at the schema minimum. #4312
• Integers generated outside the range implied by format: int32/int64. #593
• Internal error on responses declaring an unknown or invalid charset.
• Generation error for numbers combining multipleOf with minimum and maximum in the coverage phase.
• False positive negative_data_rejection for const and propertyNames under Open API 3.0 in the coverage phase.
• Integers just below the int64 minimum accepted during schema validation.

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.24.0 - 2026-07-19

🚀 Added

• Dynamic token authentication support for OAuth2 and OpenID Connect security schemes.
• Reactive auth refresh: refetch the token and replay a request on configured statuses (auth.dynamic.openapi.<scheme>.retry-on, @schemathesis.auth(retry_on=[401])).

🐛 Fixed

• Report dynamic authentication token-fetch failures without duplicated text or an internal traceback.
• Explain 401/403 responses from a dynamic authentication token endpoint as rejected credentials.
• Crash dictionary changed size during iteration with multiple workers under free-threaded Python.
• Crash on schemas embedding a JSON Schema resource that declares its own $schema dialect.
• False positive positive_data_acceptance for required array query parameters generated as empty.
• False positive negative_data_rejection for body schemas with additionalProperties: false. #4332
• Generation error for request bodies with prefixItems in OpenAPI 3.1 schemas.
• Crash Cannot sample from a length-zero sequence for array items with an empty enum.
• False positive positive_data_acceptance for array items with enum entries violating the item schema.
• Undercounted stateful link totals for schemas sharing a response definition across operations.
• Operations with unresolvable $refs silently skipped when dependency ordering applies.
• False missing_deserializer warning for media types whose own schema is unstructured.
• Skip reasons in the summary borrowed from operations that were tested in another phase.

🔧 Changed

• Configuration errors shown without a traceback, under a Configuration Error heading.
• Group the missing_deserializer warning by media type, one line per operation.
• Report why operations were skipped: disabled phases, failure limit, interruption, or time limit.

4.23.0 - 2026-07-16

🚀 Added

• Reuse literal values from the application's Python source during generation. Disable via analysis.constants.enabled.
• Web Fuzzing Commons authentication via [auth.wfc].
• Automatic 429 retries honoring the Retry-After header with --rate-limit=auto. #1722
• checks.response_schema_conformance.validate-formats to disable format validation in response checks. #2481

🐛 Fixed

• False positive positive_data_acceptance for arrays with contains/minContains/maxContains in the coverage phase.
• False positive positive_data_acceptance for objects with dependentRequired/dependentSchemas in the coverage phase.
• False positive negative_data_rejection for objects combining additionalProperties with matching patternProperties.
• False positive positive_data_acceptance for path integers at the schema minimum. #4312
• Integers generated outside the range implied by format: int32/int64. #593
• Internal error on responses declaring an unknown or invalid charset.
• Generation error for numbers combining multipleOf with minimum and maximum in the coverage phase.
• False positive negative_data_rejection for const and propertyNames under Open API 3.0 in the coverage phase.
• Integers just below the int64 minimum accepted during schema validation.

... (truncated)

Commits

• 510d89b chore: Release 4.24.0
• c6d0e54 chore: Report why operations were skipped: disabled phases, failure limit, in...
• 23df950 fix: Skip reasons in the summary borrowed from operations that were tested in...
• 1193cee test: Make tests independent of execution order
• a5f782a fix: Operations with unresolvable $refs silently skipped when dependency or...
• 7ae345f fix: False missing_deserializer warning for media types whose own schema is...
• 11cc0d7 chore: Update pre-commit
• 22f92ae fix: Undercounted stateful link totals for schemas sharing a response definit...
• 3eac989 fix: Crash on schemas embedding a nested JSON Schema resource that declares i...
• e8ec69b fix: False positive negative_data_rejection for body schemas with `addition...
• Additional commits viewable in compare view

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from al-pragliola. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dependabot]

Superseded by #3029.