v2.9.0

2.9.0 (2026-10-30)

Features

• adapters: deprecate the private assertion helpers and announce phpunit as a dev dependency (#667) (32efac4)
• cli: accept the v3 flag spellings and deprecate the old ones (#655) (1f1d4cc)
• config: deprecate the remaining flat phpunit and laravel configuration keys (#671) (cb18658)
• coverage: announce the v3 legacy-sidecar cutoff and merge i/o exit code (#670) (f263f0d)
• doctor: default specs and acknowledged schemes from gesso.php via --config (#665) (232727d)
• enum-drift: deprecate the file-path binding reasons removed in 3.0 (#664) (be76d28)
• enum-drift: report the discovered bindings in the run summary (#668) (a1ddf87)
• laravel: add a raw-json request helper for bodies php arrays cannot express (#669) (9fb0f3b)

Bug Fixes

• strict: point the strict-mode footers at gesso.php instead of deprecated phpunit parameters (#666) (717f64f)

Performance Improvements

• spec: share resolved $ref targets instead of copying them per reference (#651) (27f5cb4)
• validation: skip strict-mode observation when both strict checks are off (#653) (2d20d03)

v2.8.0

2.8.0 (2026-10-26)

Features

• config: deprecate the phpunit.xml parameters that gesso.php collapses (#622) (e4c9d71)
• coverage:merge: scope sidecars to a run id so stale sidecars are ignored instead of fatal (#624) (eb155f6)
• enum-drift: deprecate file-path enum bindings and enum_spec_base_path (#628) (60f8245)
• enum-drift: resolve enum bindings by spec component name (#623) (b9e1d6e)
• fuzz: follow openapi links during whole-spec exploration (#634) (bd762d8)
• fuzz: synthesize form-encoded request bodies (#631) (872a628)
• runtime: evaluate http runtime expressions for links (a4f44a3)
• validation: validate form response bodies against their schemas (#629) (495bff6)

Bug Fixes

• doctor: report the operations runtime validation skips (#650) (55a0da6)
• spec: accept annotation-only subschemas (#648) (73fa17a)
• spec: match path templates that mix literals and parameters in one segment (#652) (2115f7a)
• validation: ignore reserved header parameters instead of failing the request (#649) (464400a)

v2.7.1

2.7.1 (2026-10-24)

Bug Fixes

• cli: disable redirects for the symfony client in doctor (#637) (a8aa59d)
• coverage:merge: neutralize control characters in merge output (#640) (10b7a7c)
• coverage: reject sidecar directories and files owned by another user (#638) (91c1549)
• internal: redact php auth headers and url userinfo in curl repros (#635) (464cedf)
• spec: redact credentials from remote ref diagnostics (#636) (6ebe336)
• stubs: keep generated files inside the output directory and comments single-line (#639) (6c17649)

v2.7.0

2.7.0 (2026-10-23)

Features

• adapters: default the symfony and psr-7 policy hooks from the shared configuration (#614) (a44de39)
• adapters: spec-driven http client fakes for consumer-side contract testing (#617) (1ac0609)
• cli: accept --format and --output-file on every gesso subcommand (#620) (d61d272)
• cli: default coverage:merge and coverage:gate from gesso.php via --config (#626) (c40877d)
• config: share configuration between phpunit and laravel (#593) (cfd51e4)
• contract: move named contract checks to the Contract namespace behind a deprecated Fuzz alias (#608) (fd09867)
• doctor: emit an equivalent gesso.php with --emit-config (#627) (4928950)
• enum-drift: evaluate enum drift once per paratest run (#613) (22d66a5)
• laravel: read route-side parity exclusions and the spec list from config (#621) (7100c9b)
• stubs: support explicit request prefixes (#592) (0a4bb67)
• validation: honor form encoding style, explode, and part headers (#619) (1ac648b)
• validation: preserve body boundaries across adapters and doctor (#566) (b305a8c)

Bug Fixes

• ci: resolve phpstan 2.3 findings and pin dev analysis tools (#600) (53a47f1)
• config: lower-case setting values without ext-mbstring (#570) (53a728f)
• config: normalise gesso.php enum values like the extension parameters (#609) (e127a4b)
• docs: update locked vue and source-map-js past high advisories (#601) (35bd5d3)
• phpunit: tolerate the sealed event facade in the pest --parallel orchestrator (#599) (8a0f745)
• validation: decode adapter JSON bodies as objects so a nested {} is not read as [] (#561) (006aeaa)

v2.6.0

2.6.0 (2026-08-12)

Features

• config: give plain phpunit suites the laravel-only validation-policy keys (#540) (5390c74)
• config: read gesso.php through a single validated loader (#547) (c1ad97c)
• coverage: record coverage inside the validators so the minimal core setup prints the table (#538) (dbc4b54)
• laravel: deprecate auto_inject_dummy_bearer and document the credentials superset (#541) (deba58e)

Bug Fixes

• spec: apply $ref sibling keywords in 3.1/3.2 schema objects (#544) (0883d1f)

v2.5.0

2.5.0 (2026-08-07)

Features

• cli: add gesso --version and a tool identity block to doctor JSON (#518) (62ae2ee)
• coverage: allow explicit state export so sharded CI jobs can be merged like paratest workers (#533) (4161810)
• deprecations: add the E_USER_DEPRECATED channel and the standing deprecation rule (#522) (3dfa3cf)
• identity: rename the env vars and artisan commands to the gesso brand (#525) (c0801a3)
• spec: keep servers[].url out of path matching and name it in the failure (#534) (2972387)
• validation: name the undeclared +json content type on a body failure (#532) (c753a46)

Bug Fixes

• build: stop shipping tests, benchmarks, and internal design docs to consumers (#515) (4d67894)
• fuzz: reuse one faker generator so GC cannot reseed a seeded run (#531) (12431ed)

v2.4.0

2.4.0 (2026-08-05)

Features

• cli: add coverage:gate for spec patch coverage (#490) (601a86a)
• cli: scaffold test stubs for uncovered operations (#491) (8f9d957)
• coverage: gate the set of uncovered responses with a committed baseline (#489) (4a210d5)
• fuzz: add ignored_auth and missing_required_header contract checks (#484) (9445ab3)
• validation: validate form request bodies against their schemas (#486) (b3254a5)

Bug Fixes

• cli: accept OpenAPI 3.1+ documents that omit paths or responses (#479) (c8bb5b5)
• cli: reject a spec shadowed by a sibling entry document in coverage:gate (#494) (34d12d0)
• coverage: skip responses object extensions in the declared set (#495) (2fccd0b)
• schema: read an empty Schema Object as "any value" instead of an array (#483) (fc096ac)

v2.3.0

2.3.0 (2026-08-03)

Features

• coverage: report SDK decoder exercise coverage (#465) (82fd407)
• fuzz: add response payload explorer with SDK round-trip assertions (#462) (c755e88)
• fuzz: add spec-wide SDK round-trip plan (#464) (632cdfa)
• fuzz: branch-complete case generation across composition choice points (#461) (15c73c1)
• fuzz: explore named component schemas (#463) (f1ce665)
• validation: extract shared response schema resolution for reuse outside the response validator (#460) (675ee6b)

Bug Fixes

• docs: correct stale parallel baseline-generation claims (#457) (526891b)
• fuzz: cover nullable enum branches (#467) (d09faa6)
• strict: treat map-shaped additionalProperties objects as data, not drift (#459) (212b733)
• validation: reject null response content (#466) (68adc03)

v2.2.0

2.2.0 (2026-07-31)

Features

• baseline: support baseline generation under parallel test runners (#426) (b0b5256)
• coverage: create the parent directory for coverage output paths instead of hard-failing (#452) (ec0c7fc)
• schema: support YAML files in #[BoundToOpenApiEnum] bindings (#456) (7ee9f4a)
• security: let consumers acknowledge unvalidatable security schemes (#450) (703bafb)
• spec: authenticated remote spec sources (#432) (ab569ee)
• strict: detect undocumented response properties (#431) (dd3548d)
• validation: parse non-exploded query parameter serializations (#451) (19f04ef)

Bug Fixes

• compat: omit @internal traits from the public-api baseline (#424) (11949ae)
• coverage: skip the threshold gate on partial runs (#453) (86e1d1a)
• fuzz: build unsupported_method probes from path parameters only (#455) (fdeba94)
• fuzz: exclude methods documented by colliding path templates from unsupported_method probes (#454) (c38bd66)

v2.1.0

2.1.0 (2026-07-30)

Features

• baseline: enforce violation baseline and report stale entries (#419) (d839cd0)
• baseline: violation fingerprints and baseline generation run (#416) (f97d621)
• dx: append curl reproduction commands to validation and exploration failures (#410) (aa98a09)
• fuzz: named contract checks with unsupported_method (#421) (57fed13)
• output: let adapters and the phpunit extension select json failure output (#415) (80603c3)
• output: populate body issue schema context and add versioned json output (#414) (9c6b947)
• result: expose structured validation issues with stable categories (#413) (47985a9)

Bug Fixes

• baseline: mark body-decode failures with a synthetic parse keyword (#422) (5fd0b2b)
• extension: keep empty defaultTestSuite guard analyzable on phpunit 13.2.6 (#411) (ee72ca2)