build(deps): bump karateVersion from 2.0.10 to 2.1.1

[dependabot]

Bumps karateVersion from 2.0.10 to 2.1.1.
Updates io.karatelabs:karate-core from 2.0.10 to 2.1.1

Release notes

Sourced from io.karatelabs:karate-core's releases.

v2.1.1

Important Fixes

• karate.match() inside a closure passed across feature files resolves variables in the calling scope, not the defining scope #2966
• karate.remove() now removes nested JSON fields #2953
• get[0] with a JsonPath filter on a missing property degrades to #notpresent instead of erroring #2950
• call / callonce with read() no longer returns the entire caller scope in the result #2949
• callonce inside a call read() no longer caches globally across invocations #2941
• Escaped pipe \| in Examples tables is treated as a literal pipe character #2943
• param with a null value omits the query parameter instead of failing #2942
• afterFeature now fires as expected when running with multiple threads #2939
• karate.set(callSingle()) with call read() in Background no longer freezes Scenario Outline row values #2934
• karate.set(callSingle()) with the disk cache no longer wipes config-level Java.type() variables #2933
• Feature calls made from JS helper files show up in the summary report again #2928
• Gatling: feature errors are logged, ANSI escapes are stripped from log files, and --no-color is accepted #2937
• --no-color is applied and stripped before subcommand parsing #2936
• Gatling: a scenario that fails before any HTTP request emits a synthetic KO instead of vanishing from the report
• Gatling: feature chaining repaired — the mutable __karate map is matched on read
• A non-SSE GET against HttpServer is rejected with a real status (405/404) rather than hanging
• DOM nodes render as XML text instead of crashing json-smart
• Driver: page-load waits are bound to the navigation's loaderId, closing a class of races on redirects and replaced loaders
• Driver: each pooled slot gets its own browser context, and tab enumeration is scoped to the driver's own context

New Features & Enhancements

• The HTML report opens far faster and uses much less memory on large features — syntax highlighting is deferred until a block is viewed #2938
• Failures pinpoint the feature-file location, with a richer failure console #2952
• Driver: select() fires the full real-selection event sequence (input, change, blur, focusout)
• Driver: new CdpDriver.objectId(locator) for locator to CDP-node resolution
• CDP: named init-script registry, plus DOM.getFrameOwner / describeNode and script/binding injection wrappers
• WebSocket: subprotocol negotiation support in WsClient
• HTTP: bind-host support on HttpServer for localhost-only hardening
• BootLoader.bootOnly, BootBinding.getGlobals() and ConfigLoader.configOnly — evaluate boot and config without running features
• Report: kind-labelled embed badges, skipped tiles, and Scenario Outline badges
• Dependency bumps: Selenium, the Scala / Gatling plugins, and central-publishing-maven-plugin

View the complete list of all issues fixed in this release.

Full Changelog: karatelabs/karate@v2.1.0...v2.1.1

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)

v2.1.0

⚠️ Breaking Changes

• Mock servers no longer evaluate untrusted request data as code by default. Java interop (Java.type) and embedded-expression evaluation of request-derived data (request, requestHeaders, requestParams) are now off by default for mocks, closing a remote-code-execution risk. A mock that uses Java interop or templates off request content must opt in — add configure javaBridgeEnabled = true and/or configure requestExpressionsEnabled = true to the mock Background (or set .javaBridgeEnabled(true) / .requestExpressionsEnabled(true) on MockServer.Builder). #2927

Important Fixes

... (truncated)

Commits

• 8739fcb ci(cve): take the version to scan as a dispatch input [no ci]
• 6ad2219 release 2.1.1 [no ci]
• 8c59387 docs(release): CVE & SBOM scan is its own workflow, off the release path [no ci]
• f30bcb6 docs(driver): B5 — openerId is the load-bearing filter, not an optional refin...
• 9a56bd6 docs(driver): clean up DRIVER_PLAN.md, correct the lock inventory [no ci]
• a24051c fix(driver): scope tab enumeration to the driver's own browser context
• 1f2b5f9 fix(driver): give each pooled slot its own browser context, not a shared tab
• f38e9c4 fix(driver): barrier on local navigation commit so the pooled reset stops racing
• 5126c11 refactor(ci): split the CVE & SBOM scan into its own workflow [no ci]
• 5dbb9d7 fix(driver): fail loudly on a null locator resolve, retry the transient miss
• Additional commits viewable in compare view

Updates io.karatelabs:karate-junit6 from 2.0.10 to 2.1.1

Release notes

Sourced from io.karatelabs:karate-junit6's releases.

v2.1.1

Important Fixes

• karate.match() inside a closure passed across feature files resolves variables in the calling scope, not the defining scope #2966
• karate.remove() now removes nested JSON fields #2953
• get[0] with a JsonPath filter on a missing property degrades to #notpresent instead of erroring #2950
• call / callonce with read() no longer returns the entire caller scope in the result #2949
• callonce inside a call read() no longer caches globally across invocations #2941
• Escaped pipe \| in Examples tables is treated as a literal pipe character #2943
• param with a null value omits the query parameter instead of failing #2942
• afterFeature now fires as expected when running with multiple threads #2939
• karate.set(callSingle()) with call read() in Background no longer freezes Scenario Outline row values #2934
• karate.set(callSingle()) with the disk cache no longer wipes config-level Java.type() variables #2933
• Feature calls made from JS helper files show up in the summary report again #2928
• Gatling: feature errors are logged, ANSI escapes are stripped from log files, and --no-color is accepted #2937
• --no-color is applied and stripped before subcommand parsing #2936
• Gatling: a scenario that fails before any HTTP request emits a synthetic KO instead of vanishing from the report
• Gatling: feature chaining repaired — the mutable __karate map is matched on read
• A non-SSE GET against HttpServer is rejected with a real status (405/404) rather than hanging
• DOM nodes render as XML text instead of crashing json-smart
• Driver: page-load waits are bound to the navigation's loaderId, closing a class of races on redirects and replaced loaders
• Driver: each pooled slot gets its own browser context, and tab enumeration is scoped to the driver's own context

New Features & Enhancements

• The HTML report opens far faster and uses much less memory on large features — syntax highlighting is deferred until a block is viewed #2938
• Failures pinpoint the feature-file location, with a richer failure console #2952
• Driver: select() fires the full real-selection event sequence (input, change, blur, focusout)
• Driver: new CdpDriver.objectId(locator) for locator to CDP-node resolution
• CDP: named init-script registry, plus DOM.getFrameOwner / describeNode and script/binding injection wrappers
• WebSocket: subprotocol negotiation support in WsClient
• HTTP: bind-host support on HttpServer for localhost-only hardening
• BootLoader.bootOnly, BootBinding.getGlobals() and ConfigLoader.configOnly — evaluate boot and config without running features
• Report: kind-labelled embed badges, skipped tiles, and Scenario Outline badges
• Dependency bumps: Selenium, the Scala / Gatling plugins, and central-publishing-maven-plugin

View the complete list of all issues fixed in this release.

Full Changelog: karatelabs/karate@v2.1.0...v2.1.1

Important: refer 2.0.0 release notes for those upgrading from 1.X

Artifacts

• Maven artifacts
• Standalone JAR (download below)
• CVE / SBOM report (download below)

v2.1.0

⚠️ Breaking Changes

• Mock servers no longer evaluate untrusted request data as code by default. Java interop (Java.type) and embedded-expression evaluation of request-derived data (request, requestHeaders, requestParams) are now off by default for mocks, closing a remote-code-execution risk. A mock that uses Java interop or templates off request content must opt in — add configure javaBridgeEnabled = true and/or configure requestExpressionsEnabled = true to the mock Background (or set .javaBridgeEnabled(true) / .requestExpressionsEnabled(true) on MockServer.Builder). #2927

Important Fixes

... (truncated)

Commits

• 8739fcb ci(cve): take the version to scan as a dispatch input [no ci]
• 6ad2219 release 2.1.1 [no ci]
• 8c59387 docs(release): CVE & SBOM scan is its own workflow, off the release path [no ci]
• f30bcb6 docs(driver): B5 — openerId is the load-bearing filter, not an optional refin...
• 9a56bd6 docs(driver): clean up DRIVER_PLAN.md, correct the lock inventory [no ci]
• a24051c fix(driver): scope tab enumeration to the driver's own browser context
• 1f2b5f9 fix(driver): give each pooled slot its own browser context, not a shared tab
• f38e9c4 fix(driver): barrier on local navigation commit so the pooled reset stops racing
• 5126c11 refactor(ci): split the CVE & SBOM scan into its own workflow [no ci]
• 5dbb9d7 fix(driver): fail loudly on a null locator resolve, retry the transient miss
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Allure Report Summary

	Name	Duration	Stats	New	Flaky	Retry	Report
	Allure Java – Pull request #1364	27m 7s	2068	2068	0	0