Mockzilla: all versions and old releases

What's Changed
- Bind multipart form fields declared through a reference by @jbn2336mz in #66
Full Changelog: v2.8.9...v2.8.10

What's Changed
- Stop holding the parsed spec after a service boots by @jbn2336mz in #65
Full Changelog: v2.8.8...v2.8.9

What's Changed
- Drop browser headers where they are noise by @jbn2336mz in #64
Full Changelog: v2.8.7...v2.8.8

What's Changed
- Add date_between to the context functions by @jbn2336mz in #63
Full Changelog: v2.8.6...v2.8.7

What's Changed
- Resolve a $ref that carries sibling keys to the schema it names by @jbn2336mz in #62
Full Changelog: v2.8.5...v2.8.6

What's Changed
- Use go 1.25.7 by @jbn2336mz in #61
Full Changelog: v2.8.4...v2.8.5

What's Changed
- Add service failures in its own error shape by @jbn2336mz in #60
Full Changelog: v2.8.3...v2.8.4

What's Changed
- Share OpenAPI overlays between services by @jbn2336mz in #59
Overlay sources can now point outside a service's own setup directory: a shared
file, an absolute path, or a URL. Several sources apply in order, so a shared
overlay can carry corrections common to an API while a service adds its own on
top, with the service's entries winning.
Remote overlay sources referenced by URL previously failed the build and now
work.
No configuration changes. Existing services behave as before and pick this up on
their next generation, which also makes them self-contained: a generated service
carries its overlay content rather than reading it back at startup.
Full Changelog: v2.8.2...v2.8.3

What's Changed
- Update documentation assets by @jbn2336mz in #58
Full Changelog: v2.8.1...v2.8.2

What's Changed
Take response values from the incoming request by @jbn2336mz in #56
Context values can be pulled out of the request being answered, using a dotted path into its payload:
charge:
currency: "request:order.payment.amount.currency"
amount: "request:order.payment.amount.value"
Post an order with EUR and 10.5 and the mock answers with EUR and 10.5 instead of random data. Array elements are addressed by index: request:order.amounts[0].currency.
- Works wherever contexts work: service context.yml, the X-Mockzilla-Context header, the UI context editor, and inside area blocks such as in-response.
- JSON and form-encoded requests are both read; the Content-Type header decides. Form bodies keep their nesting, so order[payment][currency]=EUR is reached with request:order.payment.currency.
- A path that matches nothing falls back to generated data, and the value has to fit the schema of the field it fills.
Fix response header generation by @jbn2336mz in #57
An in-response-header block used to be ignored, so headers meant to carry a fixed request id or trace id came back as random words. Those blocks now take effect, and in-response applies to response headers too.
Headers declared readOnly in the spec were dropped and sent as the literal text <nil>; they now appear with their value. Headers declared writeOnly were sent as <nil> as well; they are now omitted.
The documented area priority never matched the actual behavior, for requests as well as responses. The real chain is:
in-request-header > in-request > in-header > root
in-response-header > in-response > in-header > root
A header falls back to its direction (in-request / in-response) before the direction-agnostic in-header.
Full Changelog: v2.8.0...v2.8.1

What's Changed
- Fix admin UI double-prepending origin when AppConfig.BaseURL is absolute by @jbn2336mz in #54
- Always pass opts to generated service methods by @jbn2336mz in #55
Generated service methods take the options argument for every operation, including endpoints that declare no parameters. Those endpoints used to be handed only a context, which put response generation and the raw HTTP request out of reach exactly where the spec was thinnest.
Handlers now look the same across a whole API. The generate-then-tweak workflow, request headers, and cookies are available everywhere, and adding the first parameter to an endpoint no longer changes its handler signature.
Breaking change
Regenerating an existing service breaks compilation of hand-written service files that implement parameterless endpoints. Add the options argument to those methods, and drop the interface assertion near the top of the file if it is still there. The compiler points at every spot.
Runtime behavior is unchanged, and endpoints that already received options are untouched.
Full Changelog: v2.7.5...v2.8.0

What's Changed
- Bind the HTTP listener before registering services by @jbn2336mz in #53
Full Changelog: v2.7.4...v2.7.5

What's Changed
- Add service context provider by @jbn2336mz in #52
Full Changelog: v2.7.3...v2.7.4

Basic Auth for the API Explorer
Protect the Mockzilla API Explorer UI with HTTP Basic Auth. Only the explorer is gated (home, .services, .history, .replay, .config). Your mock API endpoints stay open.
Enable
Via environment variables:
MOCKZILLA_BASIC_AUTH_USER=alice
MOCKZILLA_BASIC_AUTH_PASSWORD=s3cret
or in app.yml:
basicAuth:
user: alice
password: s3cret
Leave them unset to keep the explorer open (the default).
Notes
- Pre-hashed passwords: set MOCKZILLA_BASIC_AUTH_PASSWORD_HASH (SHA-256 hex) instead of plaintext so the secret never travels in cleartext. The hash wins when both are set. Generate one with echo -n 's3cret' | shasum -a 256.
- Credentials are compared in constant time.
- Portable mode now reads .env from the working directory, so these variables (and any other config) can live in a .env next to the binary, matching server mode.

What's Changed
- Overwrite history duration in service by @jbn2336mz in #50
Full Changelog: v2.7.1...v2.7.2

What's Changed
- Add replay UI by @jbn2336mz in #48
Breaking change
Full Changelog: v2.6.7...v2.7.0