⚠️ Breaking Changes
- Mock servers no longer evaluate untrusted request data as code by default. Java interop (
Java.type) and embedded-expression evaluation of request-derived data (request,requestHeaders,requestParams) are now off by default for mocks, closing a remote-code-execution risk. A mock that uses Java interop or templates off request content must opt in — addconfigure javaBridgeEnabled = trueand/orconfigure requestExpressionsEnabled = trueto the mockBackground(or set.javaBridgeEnabled(true)/.requestExpressionsEnabled(true)onMockServer.Builder). #2927
Important Fixes
- match through a null/undefined/absent intermediate path degrades to
#notpresentand never resolves a same-named variable in scope (e.g. a Scenario-Outline Examples column) #2926 #2906 #notpresentworks across multiple Examples columns on absent paths #2924- Gatling simulations auto-read
-Dkarate.env/KARATE_ENVagain #2925 <column>expansion of an object column in a dynamic Scenario Outline #2921- schema cross-references resolve when loaded via
call read()#2919 configure headers/cookiesmutations to the source object are reflected per-request #2918getwith a JsonPath filter[?(@.field=='value')]no longer returns null #2916call read('file.js')(args)immediately-invoked JS parses correctly #2915- JS-driven feature calls (
karate.call) appear in the report and summary #2914 #(variable)in an Examples table no longer throws ReferenceError when the called feature usescallSingle#2913@setupscenario can be called by tag / manually #2908- HTML report pass% (donut) reconciled with the totals row when scenarios are skipped #2907
__argis defined for called scenarios and top-levelrunFeature(path, arg)#2905bytesdatatype keyword wired up #2904- per-Engine isolation of built-in constructors and prototypes #2920
- browser driver: re-arm OOPIF auto-attach across pooled-driver reuse and CDP session switches #2922
afterScenariohook runs before driver/channel teardown #2923
New Features & Enhancements
- console logging can be fully silenced — new
off/nonelevels #2917 - author-set
__idfor stable scenario identity, pluskarate.scenario.slug request.bodyJsonconvenience accessor- HTML report KPI summary-card hook; scenarios show effective (inherited) tags
karate.getConfigDir()exposes the resolvedkarate-config.jsdirectory- dry-run reports steps as skipped (not passed)
View the complete list of all issues fixed in this release.
Full Changelog: v2.0.10...v2.1.0
Important: refer 2.0.0 release notes for those upgrading from 1.X
Artifacts
- Maven artifacts
- Standalone JAR (download below)
- CVE / SBOM report (download below)