wiremock

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@W0rty, @numacanedo, @Mahoney, @tomakehurst, @oleg-nenashev

🔒 This is a security release that addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Overall CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS
  Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Overall CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

Credits: @W0rty, @numacanedo, @Mahoney, @tomakehurst, @oleg-nenashev

A new major release that introduces a lot of new features, enhancements and also some breaking changes. The key changes include support for Java 17, dropping Java 8 support, new matchers and dynamic response macros, new API endpoints, etc. We’ve made a small number of breaking changes to the Java API plus some behavioural changes, but the JSON (REST and file) API remains fully compatible with 2.x.

NOTE: A blog post with the user-friendly summary and migration guidelines is coming soon!

Thanks to all contributors! The changelog below represents key changes between 2.35.0 and 3.0.0. The full list of changes is available below in the collapsed section.

WARNING: There are known issues in the WireMock 3.0.0 release. Please be careful when updating, and see the Errata below

Upgrade guide

This guide assumes you would be upgrading from WireMock 2.35.0 to 3.1.0

1. If you aren’t using WireMock 2.35.0, upgrade to this version first
2. If you use WireMock Standalone, backup your configurations, logs and other information you might need in the future, just in case the - upgrade goes wrong
3. If you use the WireMock Webhooks Extension, delete the dependency on it and the downloads. Now the extension is a part of the WireMock core
4. If you use any WireMock extensions, private source or open source ones, ensure they are compatible with WireMock 3 by checking this GitHub Issue, documentation and the integration tests. If you discover any incompatible extension, please raise a bug in [wiremock/wiremock/issues (https://github.com/wiremock/wiremock/issues) or comment in wiremock/wiremock #2323, We will triage and route it accordingly
5. If you use Java 8 on the instance, update to Java 11 or Java 17
6. Update WireMock to the most recent release of WireMock 3

🚀 New features and improvements

• Matching and response templating:
• JSON matching via matchesJsonSchema() @kapishmalik
• Form parameter matching support (#2157) @kapishmalik
• not() matcher that inverts other matchers (#2006) @SatyamAK
• Support for multi-stub mapping files to the remote loader function (#2198) @DjerohN
• Support for Java time when serialising to/from JSON (#2130 ) @mark-henry
• Support for matching multi-valued headers and query parameters with includes and hasExactly (#2110) @kapishmalik
• Matching URLs by path template @tomakehurst
• Matching path variables in the same manner as query, headers, etc. @tomakehurst
• Support for addressing path variables by name in response templates @tomakehurst

Proxy mode:

• Add support for recording via an existing proxy configuration and not having to set the target URI (5637a00) @tomakehurst
• Make proxy timeout configurable (#2058) @lpradel
• Add support for disabling proxy pass-through (#2087) @kapishmalik

API and Extensibility:

• #1512 - Extensions API v2 - Documentation (#2238) @tomakehurst
  • New extension points: RequestFilterV2, TemplateHelperProviderExtension, TemplateModelDataProviderExtension, ResponseDefinitionTransformerV2, ResponseTransformerV2, ServeEventListener
• Add Beta API for externalized state storage (#2144) @tomakehurst
• Add patch() Method with URL in WireMock REST API client (#2261) @Joel-Schaltenbrand
• Add convenient method for matching absence of query and form params in a request (#2192, #2193) @G-Basak
• Add a beforeResponseSent() serve event listener hook (#2295) @tomakehurst
• Add a WireMock#requestedFor() method allowing to pass Http method as parameter (#2175) @ytvnr
• Add annotations for Beta and Internal APIs (#2332) @oleg-nenashev
• Allow configuring webhook to forbid target endpoints (#2307) @Mahoney
• Add WiremockNetworkTrafficListeners as unified factory for creating arbitrary notifying traffic listeners.(#2283) @gsmith85
• Add support for customising the filenames produced when stubs are saved or recorded via Handlebars at startup @craftsman228
• Add request IP to template model (#2103) @bmarwell
• Allow fixing class loader in ClasspathFileSource (#2054) @derari

Operations:

• #1913 - Support for sub-events associated with a ServeEvent - Documentation (#2238) @tomakehurst
• Add healthcheck endpoint to WireMock Standalone (#2303) @Purely-Jonas @ikalu
• Add support for custom encoding in ConsoleNotifyingWiremockNetworkTrafficListener (#2139) @gsmith85
• Performance: Change Queue on to Deque in InMemoryRequestJournalStore (#2299) @pks-1981
• Improve rendering performance for large response templates (#2211) @Mahoney
• Improve error message in AbstractFileSource#assertFilePathIsUnderRoot() (#2267) @oleg-nenashev
• New ASCII art on standalone startup (166c3b3) @tomakehurst

💥 Known Issues / Errata

• FIXED in 3.1.0 - WireMock Webhook Extension 3.0.0 JAR is broken #2342. Also, the 2.35.0 build of the extension is not compatible with WireMock 3.0.0 as reported in #2341. This extension cannot be reliably used until a new patch is released
• Some other WireMock 2 exceptions are not compatible with WireMock 3 and need an update. See the WireMock 3 extension compatibility notes in #2323
• FIXED in 3.0.1 - StopAction in the old V1 Filter extension implementation was not working as expected - fixed by @Mahoney in #2335
• FIXED in 3.0.2 - Help printing fails in WireMock standalone - fixed by @tomasbjerre in 3.0.2 #2351

This list will be expanded when we find new issues

💥 Breaking changes

• Java 8 is no longer supported, WireMock will NOT work on this version anymore
• Upgrade from Jetty 9 to Jetty 11 (Changelog) @tomakehurst
• Change the Maven repository groupID to org.wiremock for all artifacts built from this repository: wiremock, wiremock-standalone, wiremock-webhooks-extension @tomakehurst
• Change Artifact IDs of wiremock-jre8 and wiremock-jre8-standalone to wiremock and wiremock-standalone @tomakehurst
• Change the standalone CLI entrypoint from com.github.tomakehurst.wiremock.standalone.WireMockServerRunner to wiremock.Run (166c3b3) @tomakehurst
• Starting from WireMock 3.1.0, the Webhooks extension is included into the main distribution, and hence enabled by default. Users should remove dependency on the extension when upgrading to this version
• Almost all Guava usages in public binary APIs were replaced by Java 11 equivalents. The rest will be removed in the WireMock 4 release in the future. Credits to @timtebeek, @pks-1981, @tomasbjerre
• Remove deprecated API routes (note: we’ve preserved the ones necessary for the 2.x client to continue to work with the 3.x server) (47d420) @tomakehurst
• Change order of handling scenarios with transformed stubs (#2140) @gsmith85
• Switch the com.github.tomakehurst.wiremock.common.Timing return values to Integer and allow null when data isn't ready (#2275) @emilianoalvarez91
• Response templating is enabled in local mode by default when starting programmatically. It is now entirely configured via startup options and customised via the extension interface so ResponseTemplateTransformer should no longer be constructed directly. 2.x code constructing ResponseTemplateTransformer will no longer compile so should be removed or migrated to the 3.x style - See #2349 for detail

Please note the the legacy recorder has now been deprecated (7b8a7d. It will removed in WireMock 4 @tomakehurst

Please also note that some APIs remain in the Beta state, and there might be some breaking changes within major releases. We will be adding more annotations in the next release to make it explicit.

🐛 Bug fixes

• Shadow additional packages in wiremock-standalone (#2327) @jluehe
• Prevent slf4j being shaded into the webhooks JAR @tomakehurst
• Correctly handle scenarios with transformed stubs (#2140) @gsmith85
• Fix flood JSON string can not be null or empty from mapping matcher (#2247) @emilianoalvarez91
• Fix admin request crashing when timing responseSendTime is null (#2275) @emilianoalvarez91
• Fix ParseJsonHelper not storing parsed result in variable (if any) when json is empty (#2277) @G-Basak
• Fix @WireMockTest not working with @DisabledInNativeImage (#2219) @DarkAtra
• Prevent exception being thrown when a stub using matchesJsonSchema is present and the request body is empty (#2223) @Mahoney
• Fix mis-detection of browser proxy requests over HTTPs (e21394e) @tomakehurst
• Fix broken hashCode() in HTTP body (#2116) @ullenius
• Add missing equals() and hashCodeI() methods to matcher classes @jnt0r
• Fix bug when running declarative + programmatic JUnit5 extension (#2123) @parawanderer
• Respect keystore type when loading keystores (#2003) @kaarefc
• Fix NullPointerException thrown when rendering a diff report for a path template matched stub @Mahoney
• Fix a bug where disabling browser proxy pass-through also disabled proxy stubs @Mahoney
• Prevent NullPointerException when a multipart could not be parsed (#2035) @sickmartian
• Fix clock skew problem with certificate generation (#2019) @DrMetallius
• Fix exception thrown when using path template matching when request URL does not match structure
• Fix diff reporting when path templates or variables do not match @tomakehurst
• Fix multipart upload parsing behaviour so that a full buffer doesn't cause the request to hang (#2072) @jwilmoth-nc
• Forcibly close all connections on server shutdown so we don't have to wait for the grace period to expire each time @tomakehurst

👻 Maintenance

• Replace Guava usages by JDK native implementations (#2305, #2297, #2289, #2215, #2225, #2246, #2228, #2214, #2121, #2200, #2120) @pks-1981
• ServerEvent: replace Guava predicate and function with STL (refs #2111) (#2255) @tomasbjerre
• Fix HttpsBrowserProxyAcceptanceTest (#2314) @pks-1981
• Update the release drafter config for beta versioning (#2300) @oleg-nenashev
• Add IntelliJ Run Configurations (#2274) @picimako
• Replace Guava Files management with STL (#2256) @tomasbjerre
• Remove dependencies on new:ing collections with Guava (#2254) @tomasbjerre
• Prove matches json schema works for path params (#2257) @Mahoney
• add-exports in eclipse configuration (#2245) @tomasbjerre
• Add changelog generation with Release Drafter (#2213) @oleg-nenashev
• Refactor/prefer the java standard library instead of guava (#2206) @timtebeek
• Add WireMock Java Co-Maintainers as CODEOWNERS (#2243) @oleg-nenashev
• Refactor to lambdas (#2114) @timtebeek
• Remove duplicate dependencies (#2177) @picimako
• Fix the build output so that that we're not putting a spurious fat JAR with an -all classifier in the thin JAR artifact @tomakehurst

All changes

Add stub import doc by @i-whammy in #1826
Fix NullPointerException by @Mahoney in #2038
Bump mockito-junit-jupiter from 4.8.1 to 4.11.0 by @dependabot in #2052
Bump mockito-core from 4.8.1 to 4.11.0 by @dependabot in #2051
Bump netty-all from 4.1.84.Final to 4.1.86.Final by @dependabot in #2042
Bump com.diffplug.spotless from 6.11.0 to 6.12.0 by @dependabot in #2030
Bump jackson-bom from 2.13.4.20221013 to 2.14.1 by @dependabot in #2026
Bump org.sonarqube from 3.4.0.2513 to 3.5.0.2730 by @dependabot in #2005
Jetty 11 support by @reta in #1942
Bump com.diffplug.spotless from 6.12.0 to 6.15.0 by @dependabot in #2081
Bump io.netty:netty-all from 4.1.86.Final to 4.1.89.Final by @dependabot in #2083
Bump versions.junitJupiter from 5.9.1 to 5.9.2 by @dependabot in #2059
Bump org.mockito:mockito-junit-jupiter from 4.11.0 to 5.1.1 by @dependabot in #2077
Bump org.mockito:mockito-core from 4.11.0 to 5.1.1 by @dependabot in #2078
Bump versions.xmlUnit from 2.9.0 to 2.9.1 by @dependabot in #2060
Bump commons-fileupload:commons-fileupload from 1.4 to 1.5 by @dependabot in #2089
Bump com.diffplug.spotless from 6.15.0 to 6.16.0 by @dependabot in #2095
Bump org.sonarqube from 3.5.0.2730 to 4.0.0.2929 by @dependabot in #2093
Bump versions.jsonUnit from 2.36.0 to 2.36.1 by @dependabot in #2088
Bump log4j-over-slf4j from 2.0.0 to 2.0.6 by @dependabot in #2053
Bump commons-io:commons-io from 2.10.0 to 2.11.0 by @dependabot in #2092
Bump net.minidev:json-smart from 2.4.8 to 2.4.9 by @dependabot in #2099
Bump org.mockito:mockito-core from 5.1.1 to 5.2.0 by @dependabot in #2100
Bump org.mockito:mockito-junit-jupiter from 5.1.1 to 5.2.0 by @dependabot in #2101
Support disabling of browser proxy pass-through by @kapishmalik in #2087
Skips NPE when a multipart could not be parsed by @sickmartian in #2035
New Feature: not() in verify #1892 by @SatyamAK in #2006
[#2102] add requestIp to template model by @bmarwell in #2103
#2004 Make proxy timeout configurable by @lpradel in #2058
Fixed clock skew problems with dynamically created certificates by @DrMetallius in #2019
Bump com.diffplug.spotless from 6.16.0 to 6.17.0 by @dependabot in #2104
Allow fixing class loader in ClasspathFileSource by @derari in #2054
Bump io.netty:netty-all from 4.1.89.Final to 4.1.90.Final by @dependabot in #2105
Bump org.slf4j:log4j-over-slf4j from 2.0.6 to 2.0.7 by @dependabot in #2106
Bump net.minidev:json-smart from 2.4.9 to 2.4.10 by @dependabot in #2107
Feature/multi value matcher for query params and headers by @kapishmalik in #2110
Bump org.ow2.asm:asm from 9.4 to 9.5 by @dependabot in #2117
Bump versions.jsonUnit from 2.36.1 to 2.37.0 by @dependabot in #2112
Bump com.jayway.jsonpath:json-path from 2.7.0 to 2.8.0 by @dependabot in #2118
Refactor/use lambdas by @timtebeek in #2114
Fix of #1679 - Respect keyStoreType when loading keystores. by @kaarefc in #2003
Reference Slack in the issue template by @oleg-nenashev in #2127
Add community badges to the README by @oleg-nenashev in #2124
Fix the Slack link in the contributing guide by @oleg-nenashev in #2129
JSON schema matcher by @tomakehurst in #2134
Add support filename template by @craftsman228 in #2136
Bump com.fasterxml.jackson:jackson-bom from 2.14.2 to 2.15.0 by @dependabot in #2159
Bump com.networknt:json-schema-validator from 1.0.78 to 1.0.80 by @dependabot in #2142
Bump org.mockito:mockito-junit-jupiter from 5.2.0 to 5.3.1 by @dependabot in #2158
Bump org.mockito:mockito-core from 5.2.0 to 5.3.1 by @dependabot in #2160
Adding missing equals Methods and Tests by @jnt0r in #2037
Bump io.netty:netty-all from 4.1.90.Final to 4.1.91.Final by @dependabot in #2125
Bump versions.junitJupiter from 5.9.2 to 5.9.3 by @dependabot in #2163
Bump io.netty:netty-all from 4.1.91.Final to 4.1.92.Final by @dependabot in #2161
code changes for adding support for form parameter matching by @kapishmalik in #2157
Use HTTPs Slack redirect link by @oleg-nenashev in #2169
Delete the issue template which is now a part of .github by @oleg-nenashev in #2168
Update the WireMock Java contributor guide and README by @oleg-nenashev in #2187
Add tests for $ref in json schema matching by @Mahoney in #2162
Replace com.google.common.base.Function (partly) by @pks-1981 in #2121
Bump com.google.guava:guava from 31.1-jre to 32.0.0-jre by @dependabot in #2195
Bump com.fasterxml.jackson:jackson-bom from 2.15.0 to 2.15.2 by @dependabot in #2199
Bump com.networknt:json-schema-validator from 1.0.80 to 1.0.83 by @dependabot in #2196
Bump org.sonarqube from 4.0.0.2929 to 4.1.0.3113 by @dependabot in #2194
Bump io.netty:netty-all from 4.1.92.Final to 4.1.93.Final by @dependabot in #2191
Bump versions.jsonUnit from 2.37.0 to 2.38.0 by @dependabot in #2188
2197 | added field "mappings" to StubMapping and its processing if it exists by @DjerohN in #2198
Bump commons-io:commons-io from 2.11.0 to 2.12.0 by @dependabot in #2180
Replace com.google.common.base.Optional with Java 11 implementation by @pks-1981 in #2120
Bump net.minidev:json-smart from 2.4.10 to 2.4.11 by @dependabot in #2183
Configure default ObjectMapper with JavaTimeModule by @mark-henry in #2130
Fix JUnit5 extension bug when using both declarative + programmatic simultaneously by @parawanderer in #2123
Fix broken hashcode by @ullenius in #2116
Replace com.google.common.base.Function (partly) by @pks-1981 in #2200
Bump org.sonarqube from 4.1.0.3113 to 4.2.0.3129 by @dependabot in #2201
Bump org.scala-lang:scala-library from 2.13.10 to 2.13.11 by @dependabot in #2203
Bump commons-io:commons-io from 2.12.0 to 2.13.0 by @dependabot in #2208
Improve handlebars performance on large templates by @Mahoney in #2211
Add WireMock co-maintainers role and document the merge process by @oleg-nenashev in #2207
Replace Guava classes by @pks-1981 in #2215
Remove Optional from the Jetty settings class by @pks-1981 in #2214
Bump com.google.guava:guava from 32.0.0-jre to 32.0.1-jre by @dependabot in #2212
Bump org.sonarqube from 4.2.0.3129 to 4.2.1.3168 by @dependabot in #2217
MatchesJsonSchemaPattern will return no match for null input by @Mahoney in #2223
Remove duplicate dependencies by @picimako in #2177
Bump io.netty:netty-all from 4.1.93.Final to 4.1.94.Final by @dependabot in #2229
Bump com.networknt:json-schema-validator from 1.0.83 to 1.0.85 by @dependabot in #2233
Bump org.mockito:mockito-core from 5.3.1 to 5.4.0 by @dependabot in #2226
Add WireMock Java Co-Maintainers as codeowners by @oleg-nenashev in #2243
Bump com.google.guava:guava from 32.0.1-jre to 32.1.1-jre by @dependabot in #2242
Replace com.google.common.io.BaseEncoding by java.util.Base64 by @pks-1981 in #2225
Refactor/prefer the java standard library instead of guava by @timtebeek in #2206
Add changelog generation with Release Drafter by @oleg-nenashev in #2213
Replace com.google.common.base.MoreObjects.firstNonNull & com.google.common.base.Preconditions.checkArgument by Java alternatives by @pks-1981 in #2228
Sub-events and V2 extensions by @tomakehurst in #2238
Replace com.google.common.base.Charsets.UTF_8 -> java.nio.charset.StandardCharsets.UTF_8. Tests. by @pks-1981 in #2246
add-exports in eclipse configuration by @tomasbjerre in #2245
Fixed @wiremocktest not working with @DisabledInNativeImage by @DarkAtra in #2219
feat: add a requestedFor method allowing to pass Http method as parameter by @ytvnr in #2175
Bump com.networknt:json-schema-validator from 1.0.85 to 1.0.86 by @dependabot in #2251
Bump net.minidev:json-smart from 2.4.11 to 2.5.0 by @dependabot in #2252
Prove matches json schema works for path params by @Mahoney in #2257
Remove dependencies on new:ing collections with Guava (refs #2111) by @tomasbjerre in #2254
Bump org.mockito:mockito-junit-jupiter from 5.3.1 to 5.4.0 by @dependabot in #2227
Add mising schema properties by @picimako in #2253
Replace Guava Files management with STL (refs #2111) by @tomasbjerre in #2256
Add convenient method for matching absence of query param in a request by @G-Basak in #2192
Add convenient method for matching absence of form param in a request by @G-Basak in #2193
Add patch() Method with URL in WireMock HTTP client by @Joel-Schaltenbrand in #2261
Bump org.sonarqube from 4.2.1.3168 to 4.3.0.3225 by @dependabot in #2279
ServerEvent: replace Guava predicate and function with STL (refs #2111) by @tomasbjerre in #2255
Improve error message in AbstractFileSource#assertFilePathIsUnderRoot() by @oleg-nenashev in #2267
Update Spotless to 6.17.0 and Google Java Format to 1.17.0 by @oleg-nenashev in #2272
Bump com.diffplug.spotless from 6.17.0 to 6.20.0 by @dependabot in #2278
Fix ParseJsonHelper not storing parsed result in variable (if any) when json is empty by @G-Basak in #2277
ConsoleNotifyingWiremockNetworkTrafficListener accepts custom encoding by @gsmith85 in #2139
Fix admin request crashing when timing responseSendTime is null by @emilianoalvarez91 in #2275
Bump io.netty:netty-all from 4.1.94.Final to 4.1.95.Final by @dependabot in #2282
Bump versions.junitJupiter from 5.9.3 to 5.10.0 by @dependabot in #2285
Fix flood json string can not be null or empty from mapping matcher by @emilianoalvarez91 in #2247
Add IntelliJ Run Configurations by @picimako in #2274
Adds WiremockNetworkTrafficListeners by @gsmith85 in #2283
Bump io.netty:netty-all from 4.1.95.Final to 4.1.96.Final by @dependabot in #2286
Include IntelliJ run configurations in CONTRIBUTING.md by @picimako in #2290
Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.13.0 by @dependabot in #2287
Replace Guava by JDK (Partly) by @pks-1981 in #2289
Correctly handle scenarios with transformed stubs by @gsmith85 in #2140
Add a beforeResponseSent serve event listener hook by @tomakehurst in #2295
Bump com.google.guava:guava from 32.1.1-jre to 32.1.2-jre by @dependabot in #2291
Update the release drafter config for beta versioning by @oleg-nenashev in #2300
Replace Guava by JDK (Partly) by @pks-1981 in #2297
Bump jetty-bom from 11.0.12 to 11.0.15 by @Purely-Jonas in #2302
Allow configuring webhook to forbid target endpoints by @Mahoney in #2307
Fix HttpsBrowserProxyAcceptanceTest by @pks-1981 in #2314
Restore old edit task for 2.x backwards compatibility by @tomakehurst in #2315
Bump org.mockito:mockito-core from 5.4.0 to 5.5.0 by @dependabot in #2320
Bump org.mockito:mockito-junit-jupiter from 5.4.0 to 5.5.0 by @dependabot in #2319
Direct pushes
Remove deprecated API routes (47d420) @tomakehurst
Add deprecation warning to the legacy recorder (7b8a7d) @tomakehurst
Fixed JRE11 only test cases with broken Mockito verifications due to HTTP client call signature changing (5ec352e) @tomakehurst
New ASCII art on standalone startup (166c3b3) @tomakehurst
Change the standalone CLI entrypoint from com.github.tomakehurst.wiremock.standalone.WireMockServerRunner to wiremock.Run (166c3b3) @tomakehurst

New Contributors

@i-whammy made their first contribution in #1826
@reta made their first contribution in #1942
@kapishmalik made their first contribution in #2087
@sickmartian made their first contribution in #2035
@SatyamAK made their first contribution in #2006
@bmarwell made their first contribution in #2103
@lpradel made their first contribution in #2058
@DrMetallius made their first contribution in #2019
@derari made their first contribution in #2054
@kaarefc made their first contribution in #2003
@craftsman228 made their first contribution in #2136
@DjerohN made their first contribution in #2198
@mark-henry made their first contribution in #2130
@parawanderer made their first contribution in #2123
@ullenius made their first contribution in #2116
@DarkAtra made their first contribution in #2219
@ytvnr made their first contribution in #2175
@G-Basak made their first contribution in #2192
@Joel-Schaltenbrand made their first contribution in #2261
@gsmith85 made their first contribution in #2139
@emilianoalvarez91 made their first contribution in #2275
@Purely-Jonas made their first contribution in #2302

Fixes

#2223 - prevent exception being thrown when a stub using matchesJsonSchema is present and the request body is empty - thanks @Mahoney

Enhancements

#2214 - further removal of Guava code - thanks @pks-1981

Enhancements

#2157 - Added form parameter matching - finally, thanks @kapishmalik !
#2121, #2200, #2120 - replace Guava functional code with native Java - thanks @pks-1981
#2130 - Added support for Java time when serialising to/from JSON - thanks @mark-henry
#2198 - Added support for mulit-stub mapping files to the remote loader function - thanks @DjerohN
Switched away from using Optional to store and set the maxEntries config parameter.

Fixes

#2211 - Improve rendering performance for large response templates - thanks @Mahoney
#2116 - Fixed broken hashCode - thanks @ullenius
#2123 - Fixed bug running declarative + programmatic JUnit5 extension - thanks @parawanderer

Enhancements

• Added matchesJsonSchema matcher.
• Added support for customising the filenames produced when stubs are saved or recorded via a Handlebars template at startup - thanks @craftsman228

Fixes

• Prevent slf4j being shaded into the webhooks JAR.
• Added missing equals() and hashCodeI() methods to matcher classes - thanks @jnt0r

Fixes

Excluded slf4j from being shaded into the webhooks JAR

Fixed request log behaviour broken in last release where a null stubMapping element was returned rather than a default when the request was not matched.

Enhancements

#2110 Add support for matching multi-valued headers and query parameters with includes and hasExactly - thanks @kapishmalik

Fixes

#2003 Respect keystore type when loading keystores - thanks @kaarefc
#2114 Refactor to lambdas - thanks @timtebeek
Fixed NPE exception thrown when rendering a diff report for a path template matched stub
Fixed a bug where disabling browser proxy pass-through also disabled proxy stubs

Some bug fixes, dependency updates and a couple of new features.

Fixes

#2035 - skips NPE when a multipart could not be parsed - thanks @sickmartian
#2019 - fixed clock skew problem with certificate generation - thanks Alexander Gazarov
Fixed exception thrown when using path template matching when request URL does not match structure
Fixed diff reporting when path templates or variables do not match

Enhancements

#2087 - added support for disabling proxy pass-through - thanks Kapish Malik
#2006 - added NOT matcher that inverts other matchers - thanks Arihant Kaushik
#2103 - added request IP to template model - thanks Benjamin Marwell
#2058 - made proxy timeout configurable - thanks Lukas Pradel
#2054 - allow fixing class loader in ClasspathFileSource - thanks Arian Treffer

Dependency updates, bug fixes and a performance regression fix.

Fixes

#2072 - fixed multipart upload parsing behaviour so that a full buffer doesn't cause the request to hang.

Now forcibly closes all connections on server shutdown so we don't have to wait for the grace period to expire each time (which had the effect of trebling build time).

Fixed the build output so that that we're not putting a spurious fat JAR with an -all classifier in the thin JAR artifact.

WireMock standalone can be downloaded here: https://repo1.maven.org/maven2/com/github/tomakehurst/wiremock-standalone/3.0.0-beta-34/wiremock-standalone-3.0.0-beta-4.jar

This release upgrades a number of dependencies and adds URL path templating support.

Enhancements

• Support for matching URLs by path template.
• Support for matching path variables in the same manner as query, headers etc.
• Support for addressing path variables by name in response templates.

See https://github.com/wiremock/wiremock.org-sources/blob/3.0.0-beta/_docs/request-matching.md#path-templates for docs.

This is the start of a series of beta releases of WireMock that will add some major new features and introduce some breaking changes, although we'll try to make these as painless as possible.

Changes in this release:

• Minimum Java version is now 11
• Jetty 11 upgrade (also considered beta as performance seems to have regressed a little vs. 9.x)
• Introduction of a stores abstraction (with default implementations that maintain current behaviour) so that persistent storage backends can be plugged in. API may be subject to change during the beta period.

Enhancements

• Add a negative contains matcher - thanks Damian Orzepowski
• Expose a Java API method for removing stubs by ID - thanks Patryk Fraczek
• Document the import API in the OpenAPI doc - thanks to user i-whammy
• Added the ability to restrict the addresses WireMock can proxy/record to, as a security measure.

Fixes

• Strip Maven directories from the standalone JAR as some were appearing that weren't related to dependencies actually present, confusing scanning tools - thanks to user krageon
• Dropped back to slf4j 1.7.36 and relocate it in the standalone JAR (ensuring 2.x users won't experience conflicts).

This will be the final 2.x.x release and also the last to support Java 8.

Fixes

• Fixed #1689 - incorrect HTTP version header - thanks to user Poojitha
• Fixed #1882 - bug preventing matching of date/time query params/headers with custom format - thanks Klaas Dellschaft
• #1930 - Fixed a partial path traversal vulnerability in the file source code - thanks Jonathan Leitschuh
• Fixed #1783 - proxyUrlPrefixToRemove ignored when using a response definition transformer - thanks to user Ross-H-Projects
• Fixed #1872 - create a request entity for POST, PUT etc. proxied requests when a content-length header is present, regardless of whether the size is 0.
• Fixed #1946 - maths helper now supports epoch dates as inputs.

Enhancements

• Added a public, non-static getScenarios() method allowing access to all scenarios.

All dependencies brought up to date including Jetty to 9.4.48.v20220622.

WireMock 2.33.1 was accidentally released using Java 11 rather than 8, resulting in class incompatibilities in places.

This release is functionally identical but built using Java 8.

Fixes

• Put name field back on scenario API object having accidentally removed it.
• Improved validation of scenario set and reset so that reasonable errors are returned when attempting to use non-existent scenario names or states.

This is primarily a maintenance release that brings all dependency versions up to date including a version of Jackson containing the fix for CVE-2020-36518.

Enhancements

• Added the ability to set and reset a single scenario's state
• Proxy will now send a request body for any request method.
• CORS response headers are now passed back from proxy responses when stub CORS is disabled.

Performance

• Improved performance of Request.getHeaders() - thanks Doug Roper.
• Improved performance of response body JSON parsing - thanks also Doug Roper.

Enhancements

• Closes #1614 - proper support for subclassing of the JUnit5 WireMockExtension
• Add support for put/delete file to/from a subfolder (#1087)
• Closes #956 - added the ability to fetch serve events for a specific stub ID
• Added ability to query unmatched serve events
• Added ability to verify requests using a custom matcher
• Upgraded to Apache HTTP Client 5.x
• Added WireMock.jsonResponse factory methods (#1428)
• #745 Need proxyUrlPrefixToRemove for proxy context url mapping (#1556)
• Removed dependence on Conscrypt for ALPN and HTTP/2
• Recognize multipart/related and multipart/mixed (#1415)
• Allow running Wiremock without HTTP Server (#1572)
• Allow standalone runner to fetch mappings from classpath (#1592)
• Added new command line parameters "--jetty-header-request-size" and "--jetty-header-response-size" for set a custom size of headers in Jetty. "--jetty-header-buffer-size" is deprecated.

Fixes

• Closes #1688 - fall back to HTTPS 1.1 only when no ALPN provider can be loaded
• Fixed #1643 - regression in date parsing preventing year and year/month only dates
• #1612 prevent applying scientific notation and rounding to big numbers by ObjectMapper (#1613)
• Fixed #1608 and #1585 - incorrect zoning of date/times in response templating when truncating

Code quality

• Enforce license headers with Spotless
• Enforce consistent code style with Spotless
• Upgrade to Gradle 7 + some Gradle config cleanup (#1639)
• Convert AcceptanceTestBase to JUnit Jupiter to limit future violations (#1669)
• Enable WireMock to be built on Java 11 and 17
• Drop JMock in favour of Mockito (#1630)