Added Arazzo support across enterprise test, mock, and validate and run-suite CLIs, including multi-spec test and mock execution with combined reports.
Added structured JSON report file export by default alongside CLI terminal output, including precise line and column numbers (line, column) for all reported diagnostics in lint command.
Added built-in security lint rules inspired by OWASP API Security Top 10, detecting potential vulnerabilities such as sensitive credentials in URL parameters, unbounded numeric schemas, and missing security scheme definitions.
Added new built-in lint rules for health check endpoints (health-*), pagination parameters and response structures (page-*), response header validation, and naming/structural constraint checks.
Added new lenient built-in ruleset into linter, which is now the default preset.
Includes all specmatic/* rules, but every rule is capped at warn so teams can adopt incrementally without breaking CI on day one.
Health endpoint rules (health-*) and pagination rules (page-*) are active at warn.
WSDL parser performance was improved. Loading of complicated WSDLs should now be much snappier
Fixes to handle SOAPAction header case insensitively in mock, and fixes to other edge cases
Improved Arazzo workflow validation and example generation and runtime, including criteria-expression handling, runtime value resolution, interpolated expressions, clearer input validation, and more precise breadcrumbs for failures.
Configurable rules (custom YAML/JSON rule definitions) now execute natively in the linter engine, improving linting execution speed and removing external JavaScript runtime dependencies.
recommended ruleset is redefined. It now extends lenient and restores specmatic/* rules to their original severities (warn stays warn, error becomes error). Core correctness rules are promoted to error. Documentation-quality rules are newly active at warn. Naming conventions remain off.
strict ruleset is redefined. It now extends recommended and adds naming conventions at error (paths-kebab-case, json-property-names, path-parameters-snake-case, query-parameter-camel-case, schema-definition-camel-case, uri-names) and promotes documentation completeness fields to error.
Added support for generating examples for AsyncAPI specifications from Studio’s example tabs UI.
Fixture execution can now be filtered by scenario type, with users able to choose positive, all, or negative scenarios, while default stays positive.
Contract tests now support substitutions, including placeholder resolution in requests, response capture, and shared state across before, test, and after fixtures.
Coverage CTRF reports now include spec-level coverageMetrics in each execution detail, including covered-operation counts and both filtered and total operation counts for the spec.
Improved bundled CTRF reporting so coverage execution details now include spec-level coverage metrics and match operations back to the correct spec more reliably across absolute, relative, and normalized paths.
Improved bundled backward-compatibility HTML reporting so breakages in shared specs are attributed to the shared spec that actually changed, instead of being misreported against a referring spec when only one consumer is affected.
Fixed a regression in negative test generation so undeclared 4xx response variants such as 405 Method Not Allowed and 415 Unsupported Media Type continue to be exercised instead of being filtered out.
Improved URL handling across Postman import, proxy routing, remote spec loading, and web-source caching so mixed-case schemes, authorities with underscores, preserved user-info, and explicit ports behave more reliably.
Improved config-driven target resolution so Specmatic preserves scheme, host, port, path-prefix, and certificate details separately instead of flattening them into a base URL.
Substitutions are now lenient by default, i.e. missing variables now use auto-generated values, while enabling strictMode restores the previous behavior of failing instead of generating.
Substitutions stored values and data lookups can now use composite JSON objects and arrays and interpolated expressions, and unresolved substitutions now fall back to dictionary-backed generation when available.
Resolved the issue with partialize example that led to metadata keys such as delay-in-seconds being omitted via Studio during the partialization process.
Added support for generating, validating, and using OpenAPI examples for 405 and 415 request-rejection responses across enterprise test, mock, and Studio example flows.
Improved rejection-example handling so repaired and generated 405 and 415 examples preserve the failing HTTP method or unsupported content type that triggered the response.
Improved example-validation breadcrumbs so 405 and 415 failures point back to the original external-example JSON paths for method and content-type fixes.
Studio now surfaces 405 example-generation failures more clearly and avoids stale editor diagnostics during teardown.
Improved query-parameter diagnostics so nested object and array failures point to the actual serialized keys, and collisions between scalar and object-style query params are handled more pragmatically.
Enterprise now loads and validates OpenAPI examples for 422 responses in the bundled runtime.
Improved OpenAPI source-location tracking so bundled validation and backward-compatibility failures can retain the original schema source pointer, including referenced schemas.
Improved specmatic config upgrade handling for legacy configurations so global mock and test settings stay under top-level specmatic.settings.
Updated bundled reporting and licensing flows so license-aware CLI operations support --debug trace logging while retaining backward-compatible --log-level support.
Improved bundled license CLI output with clearer success, warning, and error cues, including colorized log levels on ANSI-capable terminals.
Studio now renders the OpenAPI examples workspace natively instead of inside an iframe, with smoother generate, validate, bulk-fix, and drilldown flows.
Studio now shows backward-compatibility issues as structured editor diagnostics with direct jumps to the affected source locations, including flattened query-parameter paths.
Studio now detects older Specmatic config files during export and offers an in-place V2 to V3 upgrade before writing the workflow.
Added bundled MCP server support for contract tests, mock servers, and backward-compatibility execution flows.
Backward-compatibility CTRF reports now include structured metadata for each breaking change, including specFile:lineNumber:columnNumber and rule-violation information.
Reduced delays and timeout risk during DNS resolution when enterprise reporting flows connect to Specmatic Insights.
HttpStub can now load badRequest examples that include extra out-of-spec query parameters and respond with the example's provided response data.
Improved federated and filesystem-based CTRF metadata handling so spec-path reporting is more reliable in enterprise report flows.
Restored AsyncAPI v2 operation-exchange handling after a regression.
Improved Arazzo schema validation, drilldown scoping, and Studio mock event rendering.
Bundled linter updates now add HTML lint reports with line numbers, improve missing-field diagnostics, clarify built-in ruleset naming, and improve OpenAPI 3.0 rule behavior.
Breaking: Removed legacy async coverage, stub-usage, and test-data report generation in favor of the newer CTRF plus HTML reporting flow. Mitigation: use the CTRF report instead.
Simplified async and gRPC reporting paths to align the enterprise distribution with the newer reporting model.
Improved Arazzo HTML report coverage and report-generation verification.
Fixed example loading across multiple directories (central repository and local filesystem) so examples are no longer incorrectly overridden.
Bundled linter capabilities now include profiles, rule categorization, maturity display values in reports, and better local config handling for --config.
Bundled the newer Specmatic runtime with richer backward-compatibility CTRF reporting, including improved multi-spec support and WIP-aware reporting behavior.
Updated the enterprise build/runtime image setup to support extra APK dependencies such as Node.js, npm, and wget where needed.
Improved GraphQL schema resolution, argument matching, and request generation, especially for bare enum values and nested JSON structures in responses.
Temporarily pinned wire-schema for Java subprojects as part of the release packaging adjustments.
Studio can now enhance an existing OAS from the UI: when a test fails with an unexpected out-of-spec response, that response can be auto-added to the specification.
Upgraded Bouncy Castle dependencies to patch a CVE.
Improved the accuracy, consistency, and explainability of OpenAPI coverage, contract-testing, and stub-usage reporting, with richer metrics and reasoning data for test-execution decisions, skipped scenarios, and mock usage.
OpenAPI UI tables are now grouped on the five primary identifiers — path, method, request content-type, status, and response content-type — rather than just path, method, and status.
Breaking: Content-Type is now determined based on the SOAP version; previously any content-type was allowed. Mitigation: update your examples to specify the expected Content-Type, and ensure the backend follows SOAP standards for content-types.
Breaking: Request bodies are no longer marked optional unless explicitly specified; previously an unspecified request body defaulted to required. Mitigation: explicitly mark request bodies as required where needed.
Fixed a serialization exception when mtlsEnabled was set in a reffed-out runOptions.
--spec-file and --dir paths are now resolved against the command's working directory before validation, avoiding a spurious validation failure.
Fixed a typo in the BCC console output.
Fixed an Avro bug where integers could fall outside the applied min/max bounds.
Malformed GraphQL queries no longer throw an NPE during parsing.
Breaking: The CTRF report output field is now outputs and is an array of outputs instead of a single object. Mitigation: read outputs if you parse the CTRF report for internal usage.
Fixed Studio disabling interactions after run-suite execution, and improved performance for large drilldowns.