Karate Files

Important Fixes

• karate.call() with a real HTTP request no longer repeats the first response when called in a loop with updated params (2.1.1 → 2.1.2 regression) [#3030]
• karate run with karate-pom.json no longer runs every feature twice (2.1.2 standalone) [#3041]
• A feature-level @fail tag is inherited by every scenario in the feature (v1 → v2 regression) [#3029]
• karate.read() no longer corrupts .xlsx and other Office / zip-based files [#3021]
• read() accepts a dynamic, concatenated path expression [#3022]
• Browser file upload restored via inputFile() for both CDP and W3C backends [#3015]
• byte[] variables are no longer shared by reference through callonce / callSingle caches, and primitive arrays no longer crash on unchecked casts [#3014]
• Error output shows the file name and line number everywhere [#3024]
• Cucumber JSON report scenarios carry start_timestamp again [#3047]
• optional('#missing').click() does nothing for an absent element instead of throwing [#3042]
• driver.script() no longer adds an extra invocation to an arrow IIFE [#3046]
• JSON.stringify() keeps the quotes when serializing a scalar string [#3043]
• An explicitly constructed java.lang.String keeps hashCode and equalsIgnoreCase [#3045]
• The Java String constructor works when its byte-array argument is a method call [#3044]
• Mock server: pathParams, requestUrlBase and requestMethod are treated as untrusted request data like the other request variables, and the file session store rejects crafted session ids [#3064]
• An Error thrown past a step now fails its scenario instead of reading as passed

New Features & Enhancements

• JS engine: class static initialization blocks, structuredClone and performance.now globals, and many spec-conformance fixes
• Match: match, karate.match and assert fire a MATCH_EXIT run event for listeners
• HTTP: Http.quiet() for callers that treat a 4xx/5xx as a normal outcome; a mock's response.body can be mutated in place
• Run events: every scenario execution carries a run-unique executionIndex, and a listener failure no longer keeps an event out of the stream
• Gatling: the log replay names each scenario and descends into called features
• Logging: the bundled logback.xml sets only parent loggers, so the default console matches the docs; logging.console precedence is documented [#3031]
• Server mode: ka:data, ka:vals, ka:dispatch and the ka: → hx-* helpers escape values that would end the attribute
• Security docs: SECURITY.md now states the scope for reports — Karate, including the mock server, is test tooling for trusted networks only
• Dependency bumps: netty 4.2.18.Final, jackson-bom 2.22.3, slf4j 2.0.20, logback 1.6.4

View the complete list of all issues fixed in this release.

Full Changelog: https://github.com/karatelabs/karate/compare/v2.1.2...v2.1.3

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)