Karate Files

⚠️ Breaking Changes

• Mock servers no longer evaluate untrusted request data as code by default. Java interop (Java.type) and embedded-expression evaluation of request-derived data (request, requestHeaders, requestParams) are now off by default for mocks, closing a remote-code-execution risk. A mock that uses Java interop or templates off request content must opt in — add configure javaBridgeEnabled = true and/or configure requestExpressionsEnabled = true to the mock Background (or set .javaBridgeEnabled(true) / .requestExpressionsEnabled(true) on MockServer.Builder). [#2927]

Important Fixes

• match through a null/undefined/absent intermediate path degrades to #notpresent and never resolves a same-named variable in scope (e.g. a Scenario-Outline Examples column) [#2926] [#2906]
• #notpresent works across multiple Examples columns on absent paths [#2924]
• Gatling simulations auto-read -Dkarate.env / KARATE_ENV again [#2925]
• <column> expansion of an object column in a dynamic Scenario Outline [#2921]
• schema cross-references resolve when loaded via call read() [#2919]
• configure headers/cookies mutations to the source object are reflected per-request [#2918]
• get with a JsonPath filter [?(@.field=='value')] no longer returns null [#2916]
• call read('file.js')(args) immediately-invoked JS parses correctly [#2915]
• JS-driven feature calls (karate.call) appear in the report and summary [#2914]
• #(variable) in an Examples table no longer throws ReferenceError when the called feature uses callSingle [#2913]
• @setup scenario can be called by tag / manually [#2908]
• HTML report pass% (donut) reconciled with the totals row when scenarios are skipped [#2907]
• __arg is defined for called scenarios and top-level runFeature(path, arg) [#2905]
• bytes datatype keyword wired up [#2904]
• per-Engine isolation of built-in constructors and prototypes [#2920]
• browser driver: re-arm OOPIF auto-attach across pooled-driver reuse and CDP session switches [#2922]
• afterScenario hook runs before driver/channel teardown [#2923]

New Features & Enhancements

• console logging can be fully silenced — new off / none levels [#2917]
• author-set __id for stable scenario identity, plus karate.scenario.slug
• request.bodyJson convenience accessor
• HTML report KPI summary-card hook; scenarios show effective (inherited) tags
• karate.getConfigDir() exposes the resolved karate-config.js directory
• dry-run reports steps as skipped (not passed)

View the complete list of all issues fixed in this release.

Full Changelog: https://github.com/karatelabs/karate/compare/v2.0.10...v2.1.0

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)