Bump mockserver-client from 6.1.0 to 7.2.0

[dependabot]

Bumps mockserver-client from 6.1.0 to 7.2.0.

Release notes

Sourced from mockserver-client's releases.

MockServer 7.2.0

[7.2.0] - 2026-06-22

Security

• Control-plane role-based authorization (off by default). With controlPlaneAuthorizationEnabled and a controlPlaneScopeMapping (e.g. platform-admins=admin,qa-team=mutate,viewers=read), an authenticated principal's scopes/groups are mapped to one of three hierarchical roles (admin ⊇ mutate ⊇ read): reads require read, every mutating operation requires mutate, and a principal lacking the role gets 403 Forbidden (recorded in the audit log). Fail-closed — use together with control-plane OIDC authentication. Covers all HttpState.handle operations plus the Netty-serviced /mockserver/configuration, /openapi.yaml and /llm/optimisationReport reads/writes. Not yet covered: the lifecycle endpoints (/bind, /stop, /status) and per-tool MCP authorization. See docs/code/tls-and-security.md.
• JWT control-plane validation rejects HMAC algorithms. JWTValidator verifies against a public-key JWK set, so it now accepts only asymmetric algorithms (RS*/ES*/PS*/EdDSA) and rejects HMAC (HS256/384/512), closing an algorithm-confusion forgery vector. Switch to an asymmetric key if you relied on HMAC.
• SCIM bearer-token enforcement now fails closed. When enforcement is enabled but no expected token is configured, requests are rejected instead of accepting any token, and the comparison is constant-time.
• Opt-in secret redaction in the event log and dashboard (redactSecretsInLog, default off). Masks sensitive header values (Authorization, Cookie, x-api-key, …) and configured JSON body fields in retrieved/exported logs and the dashboard event view. Matching and verification still see the original values, so behaviour is unchanged.
• Dashboard dompurify pinned to 3.4.11 via an npm overrides entry, clearing all 16 open Dependabot DOMPurify advisories (mXSS / DOM-clobbering / prototype-pollution).

Added

AI, LLM & agent protocols (LLM / MCP / A2A)

• LLM and MCP mock builders in every client. Idiomatic LLM-mocking (completions, tool calls, streaming physics, usage, embeddings, multi-turn conversations, provider failover) and MCP-server-mocking (tools, resources, prompts over JSON-RPC 2.0) builders are now available in all eight clients (Java, Node, Python, Ruby, Go, Rust, .NET, PHP), all producing the same wire JSON.
• LLM optimisation export. Proxy your agent's LLM calls through MockServer, then export a one-click optimisation brief (Markdown) or structured JSON bundle (LlmOptimisationReport) from captured traffic. Nine deterministic signals detect repeated system prompts, low cache-hit rates, unused tool schema, model overspend, large resent context, deterministic tool calls, oversized tool results, output-token bloat and duplicate calls — each with token counts, estimated USD saving, and structured fix guidance (copy-paste config snippet or example expectation where applicable). An in-product verdict (A–F grade and "$X recoverable" headline computed via per-call MAX attribution so the total is always ≤ actual spend) and two new session KPIs (cache-hit rate and one-shot rate) appear in the dashboard and the Markdown brief. New LLM Optimise dashboard screen (with verdict banner, "Copy verdict" button, and updated hero cards), GET /mockserver/llm/optimisationReport endpoint, and export_optimisation_report MCP tool. Export-only and deterministic; secrets are redacted. The Anthropic codec now maps the top-level system field so cache and repeated-prompt signals fire on Anthropic traffic.
• More embedding providers and rerank mocking. httpLlmResponse embeddings now cover Gemini, Ollama and Bedrock (Titan / Cohere-on-Bedrock) in addition to OpenAI/Azure, all deterministic and L2-normalised. A new rerank action mocks Cohere and Voyage rerank endpoints in the provider-correct envelope.

... (truncated)

Changelog

Sourced from mockserver-client's changelog.

[7.2.0] - 2026-06-22

Security

• Control-plane role-based authorization (off by default). With controlPlaneAuthorizationEnabled and a controlPlaneScopeMapping (e.g. platform-admins=admin,qa-team=mutate,viewers=read), an authenticated principal's scopes/groups are mapped to one of three hierarchical roles (admin ⊇ mutate ⊇ read): reads require read, every mutating operation requires mutate, and a principal lacking the role gets 403 Forbidden (recorded in the audit log). Fail-closed — use together with control-plane OIDC authentication. Covers all HttpState.handle operations plus the Netty-serviced /mockserver/configuration, /openapi.yaml and /llm/optimisationReport reads/writes. Not yet covered: the lifecycle endpoints (/bind, /stop, /status) and per-tool MCP authorization. See docs/code/tls-and-security.md.
• JWT control-plane validation rejects HMAC algorithms. JWTValidator verifies against a public-key JWK set, so it now accepts only asymmetric algorithms (RS*/ES*/PS*/EdDSA) and rejects HMAC (HS256/384/512), closing an algorithm-confusion forgery vector. Switch to an asymmetric key if you relied on HMAC.
• SCIM bearer-token enforcement now fails closed. When enforcement is enabled but no expected token is configured, requests are rejected instead of accepting any token, and the comparison is constant-time.
• Opt-in secret redaction in the event log and dashboard (redactSecretsInLog, default off). Masks sensitive header values (Authorization, Cookie, x-api-key, …) and configured JSON body fields in retrieved/exported logs and the dashboard event view. Matching and verification still see the original values, so behaviour is unchanged.
• Dashboard dompurify pinned to 3.4.11 via an npm overrides entry, clearing all 16 open Dependabot DOMPurify advisories (mXSS / DOM-clobbering / prototype-pollution).

Added

AI, LLM & agent protocols (LLM / MCP / A2A)

• LLM and MCP mock builders in every client. Idiomatic LLM-mocking (completions, tool calls, streaming physics, usage, embeddings, multi-turn conversations, provider failover) and MCP-server-mocking (tools, resources, prompts over JSON-RPC 2.0) builders are now available in all eight clients (Java, Node, Python, Ruby, Go, Rust, .NET, PHP), all producing the same wire JSON.
• LLM optimisation export. Proxy your agent's LLM calls through MockServer, then export a one-click optimisation brief (Markdown) or structured JSON bundle (LlmOptimisationReport) from captured traffic. Nine deterministic signals detect repeated system prompts, low cache-hit rates, unused tool schema, model overspend, large resent context, deterministic tool calls, oversized tool results, output-token bloat and duplicate calls — each with token counts, estimated USD saving, and structured fix guidance (copy-paste config snippet or example expectation where applicable). An in-product verdict (A–F grade and "$X recoverable" headline computed via per-call MAX attribution so the total is always ≤ actual spend) and two new session KPIs (cache-hit rate and one-shot rate) appear in the dashboard and the Markdown brief. New LLM Optimise dashboard screen (with verdict banner, "Copy verdict" button, and updated hero cards), GET /mockserver/llm/optimisationReport endpoint, and export_optimisation_report MCP tool. Export-only and deterministic; secrets are redacted. The Anthropic codec now maps the top-level system field so cache and repeated-prompt signals fire on Anthropic traffic.
• More embedding providers and rerank mocking. httpLlmResponse embeddings now cover Gemini, Ollama and Bedrock (Titan / Cohere-on-Bedrock) in addition to OpenAI/Azure, all deterministic and L2-normalised. A new rerank action mocks Cohere and Voyage rerank endpoints in the provider-correct envelope.
• MockServer's MCP control plane gains prompts/list, prompts/get and sampling/createMessage over

... (truncated)

Commits

• 4eaa8a4 build: consolidate duplicate stop_MockServer.sh + fix over-broad kill
• e55cced feat(clients): callbacks across the clients (class + object/closure)
• ba57c6c feat(clients): control-plane auth + TLS/mTLS parity across clients, editor sc...
• af1e972 feat(clients): Load Scenario Registry API across all 8 client libraries
• 975cf26 feat(scenarios): typed stateful-scenario parity across all clients, validatio...
• 876fe6f feat(clients): migrate all 8 clients' load-scenario model to Load Profile v2 ...
• aabf392 feat(clients): load scenarios in all 8 clients + SRE control-plane parity (Go...
• 0c46bcf chore(examples): make example code portable — drop stale spec URL and hardcod...
• 5136e24 fix(clients): connection lifecycle and error reporting (Python/Node/Ruby)
• 2210cf0 feat(clients): test-framework fixtures and idiomatic auto-cleanup (Go/Node/Ru...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)