Repository navigation
Releases
Releases · Endava/cats
cats-15.6.0
- feat: Add MisleadingCreatePut and PartialUpdatePut oracle fuzzers and register missing native reflection enums
- feat: Reduce false positives for error leaks + improve detection of auth endpoints
- fix: Remove false positives found by live WFD validation of the new oracle fuzzers
- feat: Map PATCH merge, LDAP injection and CATS-only oracle reasons to WFC fault categories
- feat: Add OPTIONS Allow, rejected-update side-effect and filter-honored oracle fuzzers
- feat: Support HTTP method scoped entries in --skipFuzzers
- fix: Prefer explicit variant fields over body fields when selecting functional flow variants
- fix: Ignore generator schema snapshots when resolving allOf children for response validation
cats-15.5.0
- fix: Derive DELETE leaf from path template and resolve sub-resource forms for *Id path params
- refactor: Split TriageCommand into triage package with accurate rule synthesis, refData mining and live verification
- fix: Skip self-presence guards when marking correlation fields required and relax empty booleans under --no-strictTypes
- fix: Evict partial leaf resources on DELETE and skip fuzzed-path GET observations
- feat: Broaden multi-language detection in PathTraversal, LDAP, and XXE fuzzers
- feat: Add PaginationLimitHonoredFuzzer for collection limit verification
- feat: Add PatchOmittedFieldsClobberFuzzer for partial PATCH persistence verification
- feat: Add PathBodyIdMismatchFuzzer for path vs body identifier consistency
- feat: Add ArithmeticTotalMismatchFieldsFuzzer for inconsistent total validation
- feat: Add MutuallyExclusiveFieldsFuzzer for conflicting domain field pairs
- feat: Add ConfirmationFieldsMismatchFuzzer for cross-field equality validation
- feat: Add SpecialFloatTokensInNumericFieldsFuzzer for IEEE-754 NaN and Infinity tokens
- feat: Add TimezoneAndLocaleCodeFieldsFuzzer for invalid IANA, BCP-47, and ISO codes
- feat: Add CursorAndPaginationTokenFieldsFuzzer for cursor decoder edge cases
- feat: Add SearchAndFilterExpressionFieldsFuzzer for search and filter parser errors
- feat: Add composable string, encoding, and random helpers to ShorthandFunctionParser
- feat: Add OpenAPI constraint fuzzers for multipleOf, minItems, minProperties, exclusive bounds, oneOf, const/not, and max boundaries
- feat: Add new mutators and readOnly, HPP, path traversal, and verb override fuzzers
cats-15.4.0
- fix: Preserve all YAML types and null values in forEach variables and nested body overrides
- feat: Support delayMs, poll, repeat, and forEach in functional flows
- fix: Support single-object correlate block on functional flow steps
- feat: Display active fuzzer profile in HTML summary report
- feat: Support nested rules lists and path-keyed maps in correlation files
- feat: Validate correlated pool values against target field schema pattern, length, and format constraints
- feat: Mark correlation then.set targets as conditionally required when when-predicate matches
- fix: Require non-zero authErrors and ioErrors in ExecutionStatisticsListener
- fix: Support root JSON arrays of objects in RequiredOnlyPayloadGenerator.generateFallbackMinimalPayloads
cats-15.3.1
- feat: Classify path segments by REST role in PathNounsLinter and PathPluralsLinter, use spec evidence for verb-prefixed collections, and wire --strict
cats-15.3.0
- feat: Add OneOfAmbiguousVariants and SchemaValueConformance contract linters
- fix: Resolve medium/low review findings across linters, resource pool, triage heuristics, content-type stripping, and --no-color progress
- fix: Guard cyclic schemas in linters, prevent shared allOf required mutation, support multi-level discriminator validation, and escape templated wildcard paths
- feat: Update WFC Commons to 0.13.0 and map faults to official DefinedFaultCategory constants
- fix: Support SpringDoc OpenAPI 3.1 polymorphic schemas, resolve primitive $ref schemas, and refine RuntimeResourcePool and ServiceCaller
- feat: Auto-discover .cats.properties, improve --no-color progress output, and fix TriageCommand and ExplainCommand
- feat: Add SortColumnOrmLeakFields, IdempotencyKeyConflict, ControlCharsInStringFields, and EmojisInStringFields fuzzers and update profiles
- feat: Add new contract linters, granular LintCommand filtering, and linter heuristic refinements
cats-15.1.3
- fix: Guard null Components in OpenApiUtils.getExamples and register Swagger Jackson serializers for GraalVM native image
cats-15.1.2
- fix: Reduce false positives across XSS, SQL, NoSQL, SSTI, and XXE injection fuzzers
- fix: Do not flag 4XX JSON error responses that echo rejected input as reflected XSS
- feat: Support default lengths for #(numeric), #(alpha), #(alphabetic), #(alphanumeric), and #(ascii) shorthands
- feat: Report cross-family status mismatches as errors, preserve schema validation, and unwrap root JSON arrays in FunctionalFlowFuzzer
- feat: Support nested discriminators, unquoted error field names, and executable generators in TriageCommand correlation synthesis
- fix: Improve nested sub-resource correlation, DELETE producer refill, inactive lifecycle state eviction, and date/enum fuzzer handling
- feat: Add --checkFieldInResponse option (default false) to guard 4XX fuzzed-field name checking
- fix: Prefer POST top-level response string identifiers over GET and request-body candidates when target example has digits
- feat: Support root JSON array payloads in FieldCorrelationEvaluator.applyRequestCorrelations
- feat: Add --allowDifferentCaseEnumValues option (default true) for EnumCaseVariantFieldsFuzzer
- feat: Add two-pass DELETE wave execution, on-demand producer pool refill, and WFC session recovery
cats-15.1.1
- fix: Keep mutationTargets on ServiceData for runtime resource protection while omitting them from FunctionalFlow reports
- fix: Disable runtime URL parameter enrichment in FunctionalFlowFuzzer so explicit step path parameters are preserved
- fix: Protect explicit step body fields from correlation overrides and omit mutation targets on functional flow steps
- feat: Replace expect.where with expect.that, support shorthand save lists, and avoid merging optional GET query params in FunctionalFlowFuzzer
- feat: Enhance FunctionalFlow and SecurityFuzzer with cross-step/cross-field capabilities and add stateful replay and flow export to ReplayCommand
- feat: Add CATS AI agent skill suite and 'cats init --skills' installer for Devin, Codex, Claude Code, OpenCode, and Cursor
cats-15.1.0
- feat: Upgrade 'cats triage' with live fix verification (--verify), --refData mining from 2XX exchanges, OpenAPI contract patch export, and similarity clustering
- refactor: Replace raw HTTP status code ranges and hardcoded fuzzer names with ResponseCodeFamily and ConsoleUtils
- refactor: Replace untyped CommandContext map with typed fields, reset FilterArguments/CatsGlobalContext caches, and resolve TestReportsGenerator exporters dynamically
- feat: Generate small positive counts/quantities and ISO timestamps for temporal query params, and add malformed Accept quality and control-char crash vectors
- feat: Add 'cats triage' (diagnose/doctor) command for root-cause clustering, correlation rule synthesis, and minimal curl reproducer export
- feat: Add UTF-7 charset Content-Type in DummyContentTypeHeadersFuzzer and raw percent query mutations in InvalidReferencesFieldsFuzzer
- feat: Add XmlPayloadEncoder to serialize application/xml request bodies using OpenAPI Schema XML metadata
- feat: Add enum-variant and required-header fallbacks in OnlyRequiredFieldsFuzzer and correlate single-value wrapper responses
- feat: Support multipart/form-data fallback and templated POST producer ordering in OperationDependencyOrder
- feat: Skip OpenAPI discriminator properties and single-value constant enums during resource pool enrichment
- fix: Prevent collection POSTs from overwriting their own discriminator/type fields and expect FOURXX_TWOXX in BidirectionalOverrideFieldsFuzzer when sanitizeFirst is enabled
- fix: Exclude per-request correlation/trace/idempotency keys from resource pool enrichment and expect 2XX/4XX on non-body DummyContentTypeHeadersFuzzer
- fix: Prevent cyclic oneOf/allOf StackOverflowError in OpenAPIModelGeneratorV2 and run non-body fuzzers on XML-body operations
- feat: Test boundaryless multipart/form-data Content-Type across all HTTP methods in DummyContentTypeHeadersFuzzer
- feat: Run crash wave breadth-first, fix raw path resolution in InvalidReferencesFieldsFuzzer, and enable value-changing coercion fuzzers on GET/DELETE
- feat: Cap generateRequestSamples combinations and add resource-qualified aliases for inferred collection keys and Location headers
- feat: Support defaulted/minimal-optional fallbacks in OnlyRequiredFieldsFuzzer and query-only POST operations
- fix: Preserve OpenAPI server basePath when CLI --server specifies only host and port
- fix: Do not store DELETE payloads in SuccessfulBaselineStore and evict deleted IDs from baselines
- fix: Align expected response codes with post-sanitization minLength, maxLength, pattern, enum, and format constraints
- fix: Expect FOURXX_TWOXX for Abugidas/FullwidthBrackets and recognize fullwidth brackets in FuzzingStrategy
- refactor: Consolidate shared path-param expectations, JSON field insertion, and response/refData helpers
- feat: Log deprecation warning when running legacy FunctionalFuzzer YAML format
- feat: Add standalone FunctionalFlowFuzzer with sequential steps, cross-field correlations, and automatic format recognition
- feat: Support root scalar response body extraction via $, $body, or $response.body in CustomFuzzerUtil
- fix: Enforce OpenAPI schema enum constraints in ResourceRequestEnricher instead of hardcoded field names
- fix: Run non-DELETE fuzzers before DELETE fuzzers per path, support Hangul fillers in FuzzingStrategy, and scope query enrichment
- fix: Prevent spaces in replacement payloads from triggering InsertFuzzingStrategy during baseline and resource merging
- fix: Resolve #/components/responses references in CatsGlobalContext.getObjectFromPathsReference
- fix: Accept 405 in CheckDeletedResourcesNotAvailableFuzzer and prevent prefix/suffix overlap in matchesWithInsertedMiddleQualifier
- fix: Expect FOURXX_TWOXX for optional query parameters in EmptyStringsInFieldsFuzzer
- fix: Check minLength>0 in StringFieldsLeftBoundaryFuzzer, enum/optional query format in BaseFieldsFuzzer, and single HappyPath DELETE seed
- fix: Remove LongTypeSerializer from GSON_NO_PRETTY_PRINTING instead of wrapping numbers in Gson JsonPrimitive
- fix: Generate values strictly outside int32/int64/float/double limits in NumberGenerator when schema min/max is omitted
- fix: Preserve numeric and boolean types during FuzzingStrategy.mergeFuzzing on identifier fields
- fix: Preserve unquoted 64-bit JSON numbers in NumericValuesInStringFieldsFuzzer and skip URL path/query parameters
- fix: Enrich path parameters from RuntimeResourcePool when replaceUrlParams is true even if replaceRefData is false
- fix: Rewrite discriminator mapping references in ResponseSchemaValidator to match rewritten component schema URIs
- feat: Refine WFC fault classification for Allow headers, undocumented HTTP methods, 5XX retries, and exact-boundary fuzzers
- feat: Enhance CatsResultFactory reason messages with explicit I/O error reasons, auth hints, and consolidated second-phase reasons
- refactor: Replace magic HTTP status codes, methods, and headers with ResponseCodeFamily, HttpMethod, and HttpHeaders constants
- refactor: Replace hardcoded fuzzer name strings with compile-time Class references via ConsoleUtils
- feat: Add WFC_REPORT report format with Web Fuzzing Commons fault classification and multi-format report export
- feat: Redesign HTML summary and test detail reports with compact 2-row dashboard, side-by-side request/response panes, syntax highlighting, and theme persistence
- feat: Upgrade error clustering with JSON root-cause extraction, 2XX error inclusion, and interactive cluster report UI
- feat: Copy cURL to OS clipboard on 'c' in TUI with visual status feedback and footer hints
- fix: Reuse ReportingArguments '-j'/'--json' option in SmokeCommand
- feat: Add 'cats analyze' fuzzability blueprint & Mermaid graph and TUI 'c' copy-curl / '?' help overlay
- feat: Add 'cats init' subcommand to scaffold headers.yml, refData.yml, and functionalTests.yml
- feat: Add apples-to-apples '--baseline' regression gating and 'cats compare' subcommand
- feat: Add 'cats smoke' subcommand for fast live-server route, auth, and health checks
- refactor: Reduce cognitive complexity and resolve SonarQube maintainability issues across pool, command, factory, and util classes
- feat: Enhance TUI with wave progress, fuzzer drill-down, next/prev detail navigation, and curl/correlation details
cats-15.0.3
- feat: Synthesize property-level example payloads in ExamplesFieldsFuzzer and prefer direct POST producers on DELETE
