Added stateful OpenAPI mocking through type: stateful-mock in specmatic config, seeding an in-memory resource store from inline and external examples and preserving create, update, and delete semantics across requests.
Re-exposed the examples generate and examples fix CLI commands for OpenAPI, making it easier to generate example payloads and fix existing examples directly from the command line.
Fixed send-report command failing to start when --metadata was supplied.
Fixed OpenAPI and JSON Schema pattern matching to use search semantics, so unanchored expressions can match substrings while explicit ^ and $ anchors continue to constrain the corresponding boundary.
Fixed generated values for anchored patterns with alternatives and length constraints, including empty alternatives and partial anchors, so generated values remain valid for the original pattern. Unsupported regex structures will use the lenient fallback.
Insights reporting commands now accept --run-attempt and include it with raw report submissions, allowing reports from repeated executions of one CI run to be distinguished.
CI report publishing now accepts repository and build identifiers supplied through SPECMATIC_REPO_ID, SPECMATIC_BUILD_ID, -Dspecmatic.repo.id, and -Dspecmatic.build.id, in addition to command-line options.
Insights build, repository, branch, and run-attempt details can now be inferred from GitHub Actions, GitLab CI, Azure Pipelines, Jenkins, CircleCI, Bitbucket Pipelines, Buildkite, and TeamCity. SPECMATIC_* environment variables and -Dspecmatic.* system properties override CI-derived values.
Added support for column level filters in the HTML report
Added a validate_examples MCP tool for validating inline and external OpenAPI examples against their specification, with structured validation results and guidance when Docker paths prevent local validation.
Added Studio support for editing, renaming, and deleting inline OpenAPI and AsyncAPI examples directly in their source specifications, with changes written back to the correct nested or referenced location while preserving authored metadata.
Added Studio support for safely importing external OpenAPI and AsyncAPI examples into specifications and exporting inline examples to external files, with per-example Copy, Move, and Skip choices, batch conversion results, and capability-aware importability diagnostics.
Fixed request fixing in studio to preserve security scheme headers and query parameters and repair invalid security values.
Fixed regular expressions containing an unescaped . so matching and generated values use the same behavior and do not unexpectedly include line terminators.
License, telemetry, and utilization requests now support HTTP(S) proxies configured through JVM proxy properties or standard proxy environment variables, with NO_PROXY bypass support.
Improved GraphQL specification parsing for large schemas and clearer validation errors for missing or empty query roots and improved parser diagnostics for invalid OpenAPI, AsyncAPI, and gRPC specifications during report generation.
Use mock, test, run-suite, or backward-compatibility-check with --ci and the Insights repository/build metadata options to submit reports directly to Specmatic Insights. The separate send-report follow-up step is deprecated.
Improved Insights-backed backward-compatibility verdict messages to distinguish affected consumers, no reported consumers, strict-mode failures, Insights check failures, unavailable licenses, unsupported protocols, and missing operation requests.
Improved OpenAPI handling of default responses to ensure they only match undeclared statuses. Fixed issues with loading, validating and fixing default response examples. Now, the declared status of a default response example is asserted during contract tests and returned by mocks.
Renamed the central contract repository report to the Spec Metadata Report. The spec-metadata-report command and spec_metadata_report.json output are now the primary names, while the previous command name remains an alias and send-report continues to consume the previous report filename.
Added an MCP tool for running a complete Specmatic test suite by reusing the run-suite command.
Added support for starting MCP mocks directly with specification paths, a port, and example directories.
Added support for loading OpenAPI multipart/form-data request examples, including multipart content and external file references for mock.
Added APIs to load central lint configuration once and lint supplied specification content with that resolved configuration, avoiding a config repository clone for every lint operation.
Fixed GraphQL contract tests reusing state from a previous run.
Fixed loading of OpenAPI examples referenced through internal or external references, with consistent handling of scalar, structured, array, null, and Specmatic values.
Fixed OpenAPI multipart/form-data and application/x-www-form-urlencoded examples so their requests use multipart parts or form fields instead of a generic request body, allowing inline and external examples to match request patterns during test generation and mocking.
Fixed multipart mock request parsing to preserve each part's Content-Encoding, so multipart examples declaring an encoding can match the incoming request.
Fixed request examples for operations with an empty response body so path parameter examples are retained when a request body is present.
Fixed backward-compatibility change tracking for path parameters defined through $ref, preventing unchanged OpenAPI operations from being reported as changed.
Backward-compatibility checks now report newly added specifications as compatible when no corresponding specification exists on the base branch, and explain the verdict using the base branch name.
Synchronized the bundled multipart-form-data example schemas with the supported example structure.
Remote configuration repositories now refresh their cached checkout only when the remote revision changes.
Added an MCP tool for running backward-compatibility checks against OpenAPI, AsyncAPI, gRPC, and GraphQL specifications.
Added inline OpenAPI and AsyncAPI examples to Studio’s existing example tables and grouped views, with support for viewing details and content, and validating them.
Added OpenID Connect security-scheme support for OpenAPI contracts, using the configured token as bearer authentication.
Added support for backward-compatibility check tool in MCP for OpenApi,AsyncAPI,gRPC,GraphQL specifications.
Added the lint-server command for running linter APIs over HTTP. It loads central lint configuration at startup, reuses it for lint requests, and refreshes it in the background when the remote repository changes.
Added POST /lint-reports to generate JSON lint reports for specifications fetched from a URL.
Added GET /config/status to inspect central config refresh health and POST /config/refresh to request an immediate refresh.
Added /api-docs for interactive Swagger UI documentation of lint server APIs.
Example files are now discovered recursively in configured example directories, including nested directories for examples command and studio.
Improved AsyncAPI example validation in Studio to show clearly labelled errors from the message schema(s) with the fewest mismatches when a channel supports multiple message types, while preserving authored correlation IDs.
Contract tests now retry documented and undocumented 429 Too Many Requests responses. Retry delays honor Retry-After values expressed as seconds or HTTP dates while retaining compatibility with ISO-8601 timestamps, and every request and response attempt remains available to reporting integrations such as Studio.
Strict-mode OpenAPI loading now supports response examples for operations that have no request parameters or request body in the spec. Specmatic uses the first named example from the first 2xx response and reports clearer warnings for examples it cannot select.
Coverage reports now preserve an OpenAPI default response as default when the system under test returns a status that is not explicitly declared.
Backward-compatibility checks now send each affected operation to Specmatic Insights only once when multiple generated failures refer to the same operation.
Fixed nullable OpenAPI responses so top-level JSON null values are matched as JSON nulls without changing null-like scalar parameter values.
Improved multipart contract-test and mock behavior so specification-derived parts no longer assume filenames, example-provided filenames remain enforceable, and declared part media types are validated consistently.
Standardized optional XML attribute handling across OpenAPI and WSDL parsing and preserved source locations for OpenAPI validation diagnostics.
Updated the bundled LZ4 Java runtime to 1.11.1 to address CVE-2026-59949, which could crash the JVM when native XXHash APIs received invalid byte-array ranges.
Async contract tests now support substitutions, including placeholder resolution in requests, response capture, and shared state across before, test, and after.
Added the ability to safely rename specifications and associated files in Studio, with Specmatic configuration paths updated automatically.
Added AsyncAPI Schema Object support for byte and binary formats, escaped JSON Pointer component references, and root-level object constraints and property overrides alongside allOf.
Added support to report the fixture execution details in AsyncAPI CTRF and HTML reports
Added load-time validation for before and after fixtures in external examples, with fuzzy matching for clearer errors.
Added ability to rename example files directly in Studio from the examples tab for OpenAPI and AsyncAPI specifications.
Added Swagger views for OpenAPI specifications in Studio and the ability to switch between editor and view, with auto-lint when a dependency changes.
Added AsyncAPI example structure validation including fixture controls and payload structure for external examples.
Added matcher support for JSON object and array containment, including mixed operands, array slicing, length and cardinality constraints, and exact matcher references resolved from example data.
Ability to mock exact values of security parameters using the example requests
Added MCP mock fixes for spec-file path resolution and gRPC/GraphQL specmatic.yaml serialization.
Improved isolation of Arazzo workflow inputs, step outputs, and workflow outputs under their workflow namespace, while preserving local shorthand and explicit cross-workflow runtime expressions.
Improved Arazzo validation, diagnostics, error messages, and user feedback.
Improved Arazzo handling of optional request bodies, default response statuses, and scalar value matching.
Improved Arazzo workflow editing, server selection, drag-and-drop behavior, and workflow rendering on Safari macOS.
Migrated Arazzo to the official 1.0.x and 1.1.x schemas, with generated Arazzo specifications now using the official schema.
Improved Arazzo support for multiple workflow input scenarios and shared default inputs.
Improved Arazzo drag-and-drop workflow editing in Studio with proximity connections and automatic workflow resizing.
Improved Arazzo source resolution for single-source specifications and reusable references.
Added Arazzo support across enterprise test, mock, and validate and run-suite CLIs, including multi-spec test and mock execution with combined reports.
Added structured JSON report file export by default alongside CLI terminal output, including precise line and column numbers (line, column) for all reported diagnostics in lint command.
Added built-in security lint rules inspired by OWASP API Security Top 10, detecting potential vulnerabilities such as sensitive credentials in URL parameters, unbounded numeric schemas, and missing security scheme definitions.
Added new built-in lint rules for health check endpoints (health-*), pagination parameters and response structures (page-*), response header validation, and naming/structural constraint checks.
Added new lenient built-in ruleset into linter, which is now the default preset.
Includes all specmatic/* rules, but every rule is capped at warn so teams can adopt incrementally without breaking CI on day one.
Health endpoint rules (health-*) and pagination rules (page-*) are active at warn.
WSDL parser performance was improved. Loading of complicated WSDLs should now be much snappier
Fixes to handle SOAPAction header case insensitively in mock, and fixes to other edge cases
Improved Arazzo workflow validation and example generation and runtime, including criteria-expression handling, runtime value resolution, interpolated expressions, clearer input validation, and more precise breadcrumbs for failures.
Configurable rules (custom YAML/JSON rule definitions) now execute natively in the linter engine, improving linting execution speed and removing external JavaScript runtime dependencies.
recommended ruleset is redefined. It now extends lenient and restores specmatic/* rules to their original severities (warn stays warn, error becomes error). Core correctness rules are promoted to error. Documentation-quality rules are newly active at warn. Naming conventions remain off.
strict ruleset is redefined. It now extends recommended and adds naming conventions at error (paths-kebab-case, json-property-names, path-parameters-snake-case, query-parameter-camel-case, schema-definition-camel-case, uri-names) and promotes documentation completeness fields to error.
Added support for generating examples for AsyncAPI specifications from Studio’s example tabs UI.
Fixture execution can now be filtered by scenario type, with users able to choose positive, all, or negative scenarios, while default stays positive.
Contract tests now support substitutions, including placeholder resolution in requests, response capture, and shared state across before, test, and after fixtures.
Coverage CTRF reports now include spec-level coverageMetrics in each execution detail, including covered-operation counts and both filtered and total operation counts for the spec.
Improved bundled CTRF reporting so coverage execution details now include spec-level coverage metrics and match operations back to the correct spec more reliably across absolute, relative, and normalized paths.
Improved bundled backward-compatibility HTML reporting so breakages in shared specs are attributed to the shared spec that actually changed, instead of being misreported against a referring spec when only one consumer is affected.
Fixed a regression in negative test generation so undeclared 4xx response variants such as 405 Method Not Allowed and 415 Unsupported Media Type continue to be exercised instead of being filtered out.
Improved URL handling across Postman import, proxy routing, remote spec loading, and web-source caching so mixed-case schemes, authorities with underscores, preserved user-info, and explicit ports behave more reliably.
Improved config-driven target resolution so Specmatic preserves scheme, host, port, path-prefix, and certificate details separately instead of flattening them into a base URL.
Substitutions are now lenient by default, i.e. missing variables now use auto-generated values, while enabling strictMode restores the previous behavior of failing instead of generating.
Substitutions stored values and data lookups can now use composite JSON objects and arrays and interpolated expressions, and unresolved substitutions now fall back to dictionary-backed generation when available.
Resolved the issue with partialize example that led to metadata keys such as delay-in-seconds being omitted via Studio during the partialization process.
Added support for generating, validating, and using OpenAPI examples for 405 and 415 request-rejection responses across enterprise test, mock, and Studio example flows.
Improved rejection-example handling so repaired and generated 405 and 415 examples preserve the failing HTTP method or unsupported content type that triggered the response.
Improved example-validation breadcrumbs so 405 and 415 failures point back to the original external-example JSON paths for method and content-type fixes.
Studio now surfaces 405 example-generation failures more clearly and avoids stale editor diagnostics during teardown.
Improved query-parameter diagnostics so nested object and array failures point to the actual serialized keys, and collisions between scalar and object-style query params are handled more pragmatically.
Enterprise now loads and validates OpenAPI examples for 422 responses in the bundled runtime.
Improved OpenAPI source-location tracking so bundled validation and backward-compatibility failures can retain the original schema source pointer, including referenced schemas.
Improved specmatic config upgrade handling for legacy configurations so global mock and test settings stay under top-level specmatic.settings.
Updated bundled reporting and licensing flows so license-aware CLI operations support --debug trace logging while retaining backward-compatible --log-level support.
Improved bundled license CLI output with clearer success, warning, and error cues, including colorized log levels on ANSI-capable terminals.
Studio now renders the OpenAPI examples workspace natively instead of inside an iframe, with smoother generate, validate, bulk-fix, and drilldown flows.
Studio now shows backward-compatibility issues as structured editor diagnostics with direct jumps to the affected source locations, including flattened query-parameter paths.
Studio now detects older Specmatic config files during export and offers an in-place V2 to V3 upgrade before writing the workflow.
Added bundled MCP server support for contract tests, mock servers, and backward-compatibility execution flows.
Backward-compatibility CTRF reports now include structured metadata for each breaking change, including specFile:lineNumber:columnNumber and rule-violation information.
Reduced delays and timeout risk during DNS resolution when enterprise reporting flows connect to Specmatic Insights.
HttpStub can now load badRequest examples that include extra out-of-spec query parameters and respond with the example's provided response data.
Improved federated and filesystem-based CTRF metadata handling so spec-path reporting is more reliable in enterprise report flows.
Restored AsyncAPI v2 operation-exchange handling after a regression.
Improved Arazzo schema validation, drilldown scoping, and Studio mock event rendering.
Bundled linter updates now add HTML lint reports with line numbers, improve missing-field diagnostics, clarify built-in ruleset naming, and improve OpenAPI 3.0 rule behavior.
Breaking: Removed legacy async coverage, stub-usage, and test-data report generation in favor of the newer CTRF plus HTML reporting flow. Mitigation: use the CTRF report instead.
Simplified async and gRPC reporting paths to align the enterprise distribution with the newer reporting model.
Improved Arazzo HTML report coverage and report-generation verification.
Fixed example loading across multiple directories (central repository and local filesystem) so examples are no longer incorrectly overridden.
Bundled linter capabilities now include profiles, rule categorization, maturity display values in reports, and better local config handling for --config.
Bundled the newer Specmatic runtime with richer backward-compatibility CTRF reporting, including improved multi-spec support and WIP-aware reporting behavior.
Updated the enterprise build/runtime image setup to support extra APK dependencies such as Node.js, npm, and wget where needed.
Improved GraphQL schema resolution, argument matching, and request generation, especially for bare enum values and nested JSON structures in responses.
Temporarily pinned wire-schema for Java subprojects as part of the release packaging adjustments.
Studio can now enhance an existing OAS from the UI: when a test fails with an unexpected out-of-spec response, that response can be auto-added to the specification.
Upgraded Bouncy Castle dependencies to patch a CVE.
Improved the accuracy, consistency, and explainability of OpenAPI coverage, contract-testing, and stub-usage reporting, with richer metrics and reasoning data for test-execution decisions, skipped scenarios, and mock usage.
OpenAPI UI tables are now grouped on the five primary identifiers — path, method, request content-type, status, and response content-type — rather than just path, method, and status.
Breaking: Content-Type is now determined based on the SOAP version; previously any content-type was allowed. Mitigation: update your examples to specify the expected Content-Type, and ensure the backend follows SOAP standards for content-types.
Breaking: Request bodies are no longer marked optional unless explicitly specified; previously an unspecified request body defaulted to required. Mitigation: explicitly mark request bodies as required where needed.
Fixed a serialization exception when mtlsEnabled was set in a reffed-out runOptions.
--spec-file and --dir paths are now resolved against the command's working directory before validation, avoiding a spurious validation failure.
Fixed a typo in the BCC console output.
Fixed an Avro bug where integers could fall outside the applied min/max bounds.
Malformed GraphQL queries no longer throw an NPE during parsing.
Breaking: The CTRF report output field is now outputs and is an array of outputs instead of a single object. Mitigation: read outputs if you parse the CTRF report for internal usage.
Fixed Studio disabling interactions after run-suite execution, and improved performance for large drilldowns.