v2.1.4

⚠️ Breaking Changes

These all tighten the mock server's defaults for handling request data and are unlikely to affect most teams. If you don't use Karate mocks, nothing here needs action. If you do, a mock that runs processes, or resolves markers or embedded expressions from files and values built at runtime, opts back in with one configure line, given in each bullet.

• Mock server: karate.exec() / karate.fork() are off by default in a mock; configure javaBridgeEnabled = true turns them back on #3067
• Mock server: a match / karate.match() marker that names a variable (#[] schema, ##(schema), #? _ == expected) resolves only when written in the mock feature itself; a marker held in a read() schema or built at runtime fails with a message naming the opt-in, configure requestExpressionsEnabled = true #3067
• Mock server: an embedded #(...) inside a value built by JS (({ a: '#(' + name + ')' }), a karate.call() result, a file read through an ext provider) is left verbatim unless that exact token is written in the mock feature or a file it read()s; configure requestExpressionsEnabled = true restores evaluation #3067
• Mock server: a feature called from a mock (call, callonce, karate.call()) runs with the mock's defaults — Java.type(), karate.exec() / karate.fork() are off and request data it receives stays inert; a helper that needs them has the mock opt in with configure javaBridgeEnabled = true / configure requestExpressionsEnabled = true #3067

Important Fixes

• Mock server: karate.request is treated as request data, and an XML request body is untrusted like a JSON one #3067
• Reports mask credential headers (Authorization, Cookie, Set-Cookie, Proxy-Authorization) as *** by default in HTML, JSONL, Cucumber JSON and JUnit XML (console unchanged); configure logging = { mask: false } shows them again
• Gherkin: a step outside a Background / Scenario / Scenario Outline (e.g. after an Examples table) is a parse error naming its line instead of being silently skipped, as in Cucumber
• JS engine: a stray token after a complete statement on the same line (var x = 'a' b) is reported as a SyntaxError, with a hint when a doubled or stray quote is the likely cause
• Mock server: Background functions no longer nest one wrapper per request until StackOverflowError #3081
• Mock server: an explicit Content-Type is kept when the response body is a string #3074
• Mock servers started with karate.start() are stopped when the scenario (or Suite) that started them ends, so ports are released #3096
• driver.quit() in a called feature releases the pooled driver, so later browser starts no longer time out (2.1.3 regression) #3093
• Appium driver types (android / ios) no longer silently start desktop Chrome; an unsupported driver type fails fast (2.1.3 regression) #3092
• Gatling: concurrent users are no longer capped at CPU×2 (each feature runs on a virtual thread), and a KO from a failed custom perf event is reported once on the right row #3094
• A feature-level @ignore no longer skips the feature when a :line filter selects a scenario (v1 → v2 regression) #3083
• Scenario Outline Examples columns no longer freeze to row 1 after karate.set(callSingle(...)) of a target with a nested call / callonce #3080
• karate.match() 2-arg form resolves dot-notation variable references inside #(...) / ##(...) / #[] schema markers #3066
• HTML report pass % reads 100 only when nothing failed (3120 of 3121 is 99%) #3065
• A Gherkin description line starting with a step keyword (e.g. When paused, ... under Feature:) no longer drops the Background that follows
• Server mode: the session cookie is Secure only over https, so sessions survive plain http on a LAN IP or container hostname

New Features & Enhancements

• configure afterFeature hook; ScenarioRuntime.currentOrNull() is available in Java glue during it #3097
• Mock variables are readable from the test that started the mock: mock.get(name, defaultValue) #3095
• Native HTTP server / mock request limits are configurable (maxInitialLineLength, maxHeaderSize, maxContentLength, also as karate mock flags and karate.start() keys), and a malformed or over-limit request gets a 431 / 414 / 400 instead of reaching the handler #3075
• HTML report summary can be sorted by feature file path #3073
• FileReaderProvider SPI: an ext JAR can own read() of a file type core does not parse
• A warning when a JSON literal holds an unquoted variable reference
• JS engine: ASI restricted productions, identifier escapes and the temporal dead zone for let / const / class, with 465 more test262 tests passing
• Dependency bumps: gatling 3.16.0, netty 4.2.19.Final, logback 1.6.5, httpclient5 5.6.5

View the complete list of all issues fixed in this release.

Full Changelog: v2.1.3...v2.1.4

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)