karate

Important Fixes

• karate.call() with a real HTTP request no longer repeats the first response when called in a loop with updated params (2.1.1 → 2.1.2 regression) #3030
• karate run with karate-pom.json no longer runs every feature twice (2.1.2 standalone) #3041
• A feature-level @fail tag is inherited by every scenario in the feature (v1 → v2 regression) #3029
• karate.read() no longer corrupts .xlsx and other Office / zip-based files #3021
• read() accepts a dynamic, concatenated path expression #3022
• Browser file upload restored via inputFile() for both CDP and W3C backends #3015
• byte[] variables are no longer shared by reference through callonce / callSingle caches, and primitive arrays no longer crash on unchecked casts #3014
• Error output shows the file name and line number everywhere #3024
• Cucumber JSON report scenarios carry start_timestamp again #3047
• optional('#missing').click() does nothing for an absent element instead of throwing #3042
• driver.script() no longer adds an extra invocation to an arrow IIFE #3046
• JSON.stringify() keeps the quotes when serializing a scalar string #3043
• An explicitly constructed java.lang.String keeps hashCode and equalsIgnoreCase #3045
• The Java String constructor works when its byte-array argument is a method call #3044
• Mock server: pathParams, requestUrlBase and requestMethod are treated as untrusted request data like the other request variables, and the file session store rejects crafted session ids #3064
• An Error thrown past a step now fails its scenario instead of reading as passed

New Features & Enhancements

• JS engine: class static initialization blocks, structuredClone and performance.now globals, and many spec-conformance fixes
• Match: match, karate.match and assert fire a MATCH_EXIT run event for listeners
• HTTP: Http.quiet() for callers that treat a 4xx/5xx as a normal outcome; a mock's response.body can be mutated in place
• Run events: every scenario execution carries a run-unique executionIndex, and a listener failure no longer keeps an event out of the stream
• Gatling: the log replay names each scenario and descends into called features
• Logging: the bundled logback.xml sets only parent loggers, so the default console matches the docs; logging.console precedence is documented #3031
• Server mode: ka:data, ka:vals, ka:dispatch and the ka: → hx-* helpers escape values that would end the attribute
• Security docs: SECURITY.md now states the scope for reports — Karate, including the mock server, is test tooling for trusted networks only
• Dependency bumps: netty 4.2.18.Final, jackson-bom 2.22.3, slf4j 2.0.20, logback 1.6.4

View the complete list of all issues fixed in this release.

Full Changelog: https://github.com/karatelabs/karate/compare/v2.1.2...v2.1.3

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)

Important Fixes

• ##(schema) optional-marker semantics now apply to schema references — a null value passes #3006
• The method keyword resolves variables again (v2 regression) #2997
• karate.sort(list) works with a single argument as documented — the key function is optional #2996
• get[0] with a JsonPath filter returns [] instead of erroring when the path traverses a null node #2995
• call / callonce with read() no longer drops a callee-defined key that shares a name with a caller variable #2991
• NDJSON response bodies are kept as raw text instead of being silently truncated by JSON parsing #2990
• afterScenario hook scope is no longer frozen to the first scenario when Background uses callonce with HTTP #2988
• set accepts a multi-line docstring expression #2978
• text/plain responses are no longer parsed as JSON just because the body starts with a brace #2977
• #(!^part) schema macro no longer false-passes on a list of objects #2976
• match contains only deep respects element multiplicity instead of matching differing multisets #2975
• Numeric match == no longer equates distinct integers above 2^53 #2974
• karate.callSingle / karate.call arguments are passed consistently to classpath: JS functions across scenarios #2973
• OOM under parallel execution fixed — embedded-expression processing no longer deep-copies every variable in scope on every step #2972
• Report keeps per-step / HTTP detail for karate.callSingle() calls made during karate-config.js resolution #2967

New Features & Enhancements

• JS engine: async / await / Promise runtime with setTimeout support
• JS engine: private class fields, methods and accessors; WeakMap / WeakSet; labeled statements with break / continue
• JS engine: significant performance work — slot-frame resolution for function locals, token caches, static binary operators
• Image: new pixelmatch comparison engine with cluster verdict and ignoredBoxes #2987
• HTTP: csv, yaml, toml and markdown are recognized named content-types
• Mocks: a Karate mock discloses itself on the wire via a Karate-Mock response header
• Gatling: failure detail aligned across the KO message and log output #2998
• Memory: a step's captured logs and embeds are released at feature end, and suite-exit no longer re-ships the whole run
• A dry run no longer prints as a green pass, and its result says so
• A missing karate-config.js is logged at INFO instead of WARN
• Dependency bumps: jackson-bom 2.22.1

View the complete list of all issues fixed in this release.

Full Changelog: https://github.com/karatelabs/karate/compare/v2.1.1...v2.1.2

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)

Important Fixes

• karate.match() inside a closure passed across feature files resolves variables in the calling scope, not the defining scope #2966
• karate.remove() now removes nested JSON fields #2953
• get[0] with a JsonPath filter on a missing property degrades to #notpresent instead of erroring #2950
• call / callonce with read() no longer returns the entire caller scope in the result #2949
• callonce inside a call read() no longer caches globally across invocations #2941
• Escaped pipe \| in Examples tables is treated as a literal pipe character #2943
• param with a null value omits the query parameter instead of failing #2942
• afterFeature now fires as expected when running with multiple threads #2939
• karate.set(callSingle()) with call read() in Background no longer freezes Scenario Outline row values #2934
• karate.set(callSingle()) with the disk cache no longer wipes config-level Java.type() variables #2933
• Feature calls made from JS helper files show up in the summary report again #2928
• Gatling: feature errors are logged, ANSI escapes are stripped from log files, and --no-color is accepted #2937
• --no-color is applied and stripped before subcommand parsing #2936
• Gatling: a scenario that fails before any HTTP request emits a synthetic KO instead of vanishing from the report
• Gatling: feature chaining repaired — the mutable __karate map is matched on read
• A non-SSE GET against HttpServer is rejected with a real status (405/404) rather than hanging
• DOM nodes render as XML text instead of crashing json-smart
• Driver: page-load waits are bound to the navigation's loaderId, closing a class of races on redirects and replaced loaders
• Driver: each pooled slot gets its own browser context, and tab enumeration is scoped to the driver's own context

New Features & Enhancements

• The HTML report opens far faster and uses much less memory on large features — syntax highlighting is deferred until a block is viewed #2938
• Failures pinpoint the feature-file location, with a richer failure console #2952
• Driver: select() fires the full real-selection event sequence (input, change, blur, focusout)
• Driver: new CdpDriver.objectId(locator) for locator to CDP-node resolution
• CDP: named init-script registry, plus DOM.getFrameOwner / describeNode and script/binding injection wrappers
• WebSocket: subprotocol negotiation support in WsClient
• HTTP: bind-host support on HttpServer for localhost-only hardening
• BootLoader.bootOnly, BootBinding.getGlobals() and ConfigLoader.configOnly — evaluate boot and config without running features
• Report: kind-labelled embed badges, skipped tiles, and Scenario Outline badges
• Dependency bumps: Selenium, the Scala / Gatling plugins, and central-publishing-maven-plugin

View the complete list of all issues fixed in this release.

Full Changelog: https://github.com/karatelabs/karate/compare/v2.1.0...v2.1.1

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)

⚠️ Breaking Changes

• Mock servers no longer evaluate untrusted request data as code by default. Java interop (Java.type) and embedded-expression evaluation of request-derived data (request, requestHeaders, requestParams) are now off by default for mocks, closing a remote-code-execution risk. A mock that uses Java interop or templates off request content must opt in — add configure javaBridgeEnabled = true and/or configure requestExpressionsEnabled = true to the mock Background (or set .javaBridgeEnabled(true) / .requestExpressionsEnabled(true) on MockServer.Builder). #2927

Important Fixes

• match through a null/undefined/absent intermediate path degrades to #notpresent and never resolves a same-named variable in scope (e.g. a Scenario-Outline Examples column) #2926 #2906
• #notpresent works across multiple Examples columns on absent paths #2924
• Gatling simulations auto-read -Dkarate.env / KARATE_ENV again #2925
• <column> expansion of an object column in a dynamic Scenario Outline #2921
• schema cross-references resolve when loaded via call read() #2919
• configure headers/cookies mutations to the source object are reflected per-request #2918
• get with a JsonPath filter [?(@.field=='value')] no longer returns null #2916
• call read('file.js')(args) immediately-invoked JS parses correctly #2915
• JS-driven feature calls (karate.call) appear in the report and summary #2914
• #(variable) in an Examples table no longer throws ReferenceError when the called feature uses callSingle #2913
• @setup scenario can be called by tag / manually #2908
• HTML report pass% (donut) reconciled with the totals row when scenarios are skipped #2907
• __arg is defined for called scenarios and top-level runFeature(path, arg) #2905
• bytes datatype keyword wired up #2904
• per-Engine isolation of built-in constructors and prototypes #2920
• browser driver: re-arm OOPIF auto-attach across pooled-driver reuse and CDP session switches #2922
• afterScenario hook runs before driver/channel teardown #2923

New Features & Enhancements

• console logging can be fully silenced — new off / none levels #2917
• author-set __id for stable scenario identity, plus karate.scenario.slug
• request.bodyJson convenience accessor
• HTML report KPI summary-card hook; scenarios show effective (inherited) tags
• karate.getConfigDir() exposes the resolved karate-config.js directory
• dry-run reports steps as skipped (not passed)

View the complete list of all issues fixed in this release.

Full Changelog: https://github.com/karatelabs/karate/compare/v2.0.10...v2.1.0

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)