v2.1.3

Important Fixes

• karate.call() with a real HTTP request no longer repeats the first response when called in a loop with updated params (2.1.1 → 2.1.2 regression) #3030
• karate run with karate-pom.json no longer runs every feature twice (2.1.2 standalone) #3041
• A feature-level @fail tag is inherited by every scenario in the feature (v1 → v2 regression) #3029
• karate.read() no longer corrupts .xlsx and other Office / zip-based files #3021
• read() accepts a dynamic, concatenated path expression #3022
• Browser file upload restored via inputFile() for both CDP and W3C backends #3015
• byte[] variables are no longer shared by reference through callonce / callSingle caches, and primitive arrays no longer crash on unchecked casts #3014
• Error output shows the file name and line number everywhere #3024
• Cucumber JSON report scenarios carry start_timestamp again #3047
• optional('#missing').click() does nothing for an absent element instead of throwing #3042
• driver.script() no longer adds an extra invocation to an arrow IIFE #3046
• JSON.stringify() keeps the quotes when serializing a scalar string #3043
• An explicitly constructed java.lang.String keeps hashCode and equalsIgnoreCase #3045
• The Java String constructor works when its byte-array argument is a method call #3044
• Mock server: pathParams, requestUrlBase and requestMethod are treated as untrusted request data like the other request variables, and the file session store rejects crafted session ids #3064
• An Error thrown past a step now fails its scenario instead of reading as passed

New Features & Enhancements

• JS engine: class static initialization blocks, structuredClone and performance.now globals, and many spec-conformance fixes
• Match: match, karate.match and assert fire a MATCH_EXIT run event for listeners
• HTTP: Http.quiet() for callers that treat a 4xx/5xx as a normal outcome; a mock's response.body can be mutated in place
• Run events: every scenario execution carries a run-unique executionIndex, and a listener failure no longer keeps an event out of the stream
• Gatling: the log replay names each scenario and descends into called features
• Logging: the bundled logback.xml sets only parent loggers, so the default console matches the docs; logging.console precedence is documented #3031
• Server mode: ka:data, ka:vals, ka:dispatch and the ka: → hx-* helpers escape values that would end the attribute
• Security docs: SECURITY.md now states the scope for reports — Karate, including the mock server, is test tooling for trusted networks only
• Dependency bumps: netty 4.2.18.Final, jackson-bom 2.22.3, slf4j 2.0.20, logback 1.6.4

View the complete list of all issues fixed in this release.

Full Changelog: v2.1.2...v2.1.3

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)