Mockoon 9.0.0 Portable

Many new features were added (new rule types, new WebSocket routes, etc.) which resulted in modifications of the data files schema. If you are using your data files with the CLI or serverless package, or if you are sharing your setup with your team, we recommend you migrate every application to the new version at the same time to avoid any compatibility issues.
Note for teams using our Cloud: We recommend that all team members update their application to the new version at the same time to ensure a smooth transition (more information). API deployed in our Cloud instances will continue running following the old schema (v8) until they are redeployed (more information).
We updated the libraries and application dependencies to their latest versions.
The most notable change is the migration to Faker.js version 9, which includes numerous function removals and some modifications to signatures and parameters. However, this should have minimal impact on your templates, as most functions were already deprecated in version 8 and have been automatically migrated to the new syntax (see Faker.js v9 migration guide).
Another potential breaking change is the fix of a JSONPath RCE vulnerability. If you were using JSONPath in your templates, some advanced filters might not work as expected anymore. We whitelisted the most common and safe filters, like $[?(@.status==='enabled' && @.id===1)]. If you encounter any issues, please let us know.
Fixes:
We sanitized the helpers supporting a JSONPath to prevent RCE vulnerabilities. (Issue #1551)
Custom ids were not kept in CRUD routes when updating by id (PUT /resources/:id), this is now fixed. (Issue #1548)
We fixed an issue where deactivated inputs in the rules interface were not staying deactivated after navigating to another view. (Issue #1517)
When navigating from a CRUD route secondary response to the primary response, while being on a tab not available on the primary response, the UI stayed on the tab. This is now fixed. (Issue #1552)
Chores:
We renewed the Windows Code Signing certificate and migrated to Azure Trusted Signing. (Issue #1514)
We renewed the Apple Code Signing certificates. (Issue #1513)
[?? Potential breaking change for your templates] We updated the libraries and applications dependencies to their latest versions to fix some reported vulnerabilities (notably the JSONPath CVE). As a result, we also migrated to Faker.js version 9 (see Faker.js v9 migration guide). (Issue #1562)

CRUD filtering and searching:
This new feature adds search and filter options to the main GET endpoint of a CRUD route, using query parameters. Many operators are available to filter your data like _eq,_gt,_lte, or _start. They can filter on any property of the data, including nested properties using the dot notation:
/users?name_eq=John&age_gt=18&address.city_start=New
You can also use the search parameter to search for a string in all properties of the data:
/users?search=john
Global variables:
Mockoon now supports global variables that can be set and accessed using the setGlobalVar and getGlobalVar helpers at runtime.
{{setGlobalVar 'myVar' 'myValue'}}
{{getGlobalVar 'myVar'}}
These variables can be used anywhere templating is supported, like the response body or headers. Their values are reset when the environment is stopped or restarted.
OpenAPI import improvements:
The OpenAPI v3 specification server.url is now correctly parsed when it only contains a path (no protocol or domain). (Issue #1221)
The CLI is now correctly reporting the OpenAPI import errors alongside Mockoon's format parser errors. (Issue #1229)
Files with .yml extensions are now selectable in the OpenAPI import dialog. (Issue #1229)
CLI and Serverless new Faker.js options:
New flags were added to the CLI, and new options to the Serverless package, to allow setting the Faker.js locale and seed.
For the CLI, use the --faker-locale and --faker-seed flags. More information in the CLI's documentation.
For the Serverless package, use the fakerOptions.locale and fakerOptions.seed options
Desktop application:
Fix the data bucket name not being displayed on a CRUD route view when creating from the template modal. (Issue #1234)
Fix the Faker.js locale not being applied from the settings on startup. (Issue #1222)
Fix callbacks not being removed from the route response's callbacks view when deleted, in the case multiple responses were present. (Issue #1215)

New response fallback mode:
Dynamic rules with templating:
The templating helpers are now supported in the rule values letting you create dynamic rules. (Issue #988)
Changes to templating helpers:
Two new templating helpers have been added to allow array filtering and object creation. (Issues #1103)
Properties with dots are now supported in the queryParam and queryParamRaw templating helpers. Escape the dots when you want to reach values contained in a property with dots. See the examples in our documentation. (Issue #1115)
The eq templating helper is now compatible with strings. (Issue #1114)
| Other changes:
Templating helpers in Handlebars files with .hbs or .handlebars are now correctly parsed. (Issue #1120)

We introduced two breaking changes in this major release:
The logs format changed to be standardized across all Mockoon applications and packages. See the logs standardization section below for more details.
The CLI was refactored to remove the PM2 dependency. See the CLI section below for more details.
Logs standardization and credentials filtering:
Logging has been standardized across all Mockoon applications and packages. This means that the logs will now be formatted the same way in the desktop application log file, the CLI's console and log file, and the serverless package's console logging. This will make it easier to read and parse the logs. As part of this change, we also added a new setting to enable full transaction logging to both the desktop application and the serverless package. It is the equivalent of the CLI's --log-transaction flag.
Some events' logging formats changed. If you are using the logs in your scripts, you need update them to match the new format. The new format is the following:
Server start event:
Before:
"level": "info",
"message": "Server started on port 3000",
"timestamp": "YYYY-MM-DDTHH:mm:ss.sssZ",
"mockName": "mockoon-demo-api"
After:
"level": "info",
"message": "Server started on port 3010",
"timestamp": "YYYY-MM-DDTHH:mm:ss.sssZ",
"app": "mockoon-server",
"environmentName": "mockoon-demo-api",
"environmentUUID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
Transaction:
Before:
"level": "info",
"message": "GET /test | 200",
"timestamp": "YYYY-MM-DDTHH:mm:ss.sssZ",
"mockName": "mockoon-demo-api",
"transaction": {...}
After:
"level": "info",
"message": "Transaction recorded",
"timestamp": "YYYY-MM-DDTHH:mm:ss.sssZ",
"app": "mockoon-server",
"environmentName": "mockoon-demo-api",
"environmentUUID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"requestMethod": "GET",
"requestPath": "/testheader",
"requestProxied": false,
"responseStatus": 200,
"transaction": {...}
(Issue #1063)
Finally, the new logging format automatically filters out credentials from the logs. It means that if you are using the --log-transaction flag or the full transaction logging settings, the authentication keys present in the Authorization or Proxy-Authorization headers are anonymized. (Issue #688)
Desktop application:
The logs are now formatted the same way as the CLI and the serverless package (JSON). See logs standardization section above for more details. (Issue #1063)
A new setting is available to enable full transaction logging. (Issue #1063)
enable full transaction logging in the settings dialog:
A new context menu item is available to move an environment's data file to a new location without having to close and reopen it. (Issue #1062)
move environment file to a new folder:
The id property used to manipulate data in single resource routes (GET /res/:id, PUT /res/:id, etc.) in a CRUD endpoint can now be set to something else like "uuid", "custom_id", etc. (Issue #1041)
customize the crud id property:
You can now search for routes in collapsed folders. (Issue #960)
OpenAPI:
A bug was fixed where OpenAPI export was crashing due to an incompatibility with CRUD routes. (Issue #1066)
When exporting to OpenAPI format, inline bodies are now used to populate the example property (Issue #352):
"paths": {
"/test": {
"get": {
"responses": {
"200": {
"description": "",
"content": {
"application/json": {
"example": "{"response": "success"}"
Changes to templating helpers:
The data and dataRaw helpers are now compatible with values coming from other helpers like queryParam. (Issues #1069)
We added a new boolean parameter to the oneOf helper to allow the user to stringify the result of the helper. (Issues #1074)
The faker helper is now compatible with Faker.js methods containing a number (internet.ipv4 and internet.ipv6). (Issues #1078)
CLI:
The logs format changed to match the desktop application and the serverless package. See logs standardization section above for more details. (Issue #1063)
We refactored the CLI to remove the dependency to PM2, which was subject to some security vulnerabilities. Another reason for this refactoring, was that, having multiple other ways to manage running CLI instances (i.e. containers), embedding a process manager felt a bit outdated and overkill. The CLI is now easier to maintain and more lightweight. As a consequence, the following changes were made:
The list and stop commands were removed together with the --pname flag which was used to customize PM2's process name.
The --daemon-off flag was removed and running the CLI as a foreground process is now the default.
The dockerize command was simplified and reduced to its core promise: it will now only generate the Dockerfile and copy (or download) the provided data files next to it. Head over to the CLI documentation for more details.
(Issue #1081)
Serverless package:
The package now logs all events and transactions to stdout (console) in the same logging format used by the desktop application and the CLI. (Issues #1063 and #978)
A new option is available to enable full transaction logging. (Issue #1063)

UI redesign:
To improve some features' discoverability and declutter the interface a bit, we redesigned the main header. We also polished the interface a bit here and there.
Here are the most significant changes:
New header design:
We transformed the main header into a new menu with tabs to make the proxy mode and logs more easily discoverable. We also split the environment settings into three new sections: the environment headers, the proxy options, and the environment settings.
The environment's information previously available in the header are now in the "Settings" tab.
Environment's menu improvements:
We made small adjustments to the environment menu:
You can edit the environment's name directly in the menu.
We removed the "CORS" icon as the option is always enabled and moved the "HTTPS" icon next to the URL.
The "Truncate long paths" option in the application settings (ctrl+comma) also applies now to the environment menu. If enabled, environment URLs won't be truncated anymore.
new-api:
Headers and rules "click-to-confirm" delete button
Headers and rules lists now uses a click-to-confirm delete button:
Responses list improvements:
The route responses menu is now split into two lines as it was becoming too cluttered.
File and body information display improvements:
We reorganized the "Status & body" tab. More precisely, we removed the redundant Content-Type information and replaced it with a small "footer" under the body editor. This footer will always display the effective Content-Type taking the order of precedence into account:
environment headers ? file mime type ? route headers
Ability to provide custom TLS certificate:
You can now provide a custom TLS certificate to serve your mocks over HTTPS. Mockoon still uses the same self-signed certificate as before if you don't provide a custom one.
New response rules for cookies:
A new response rule is available to check a cookie's value or presence:
New templating helpers:
New Handlebar helpers are available: join, len, gt, lt, gte, lte, eq, toFixed, round, stringify, slice. Head over to the helpers documentation to learn how to use them.
Misc:
When creating a new environment, the default name won't be "New environment" anymore but will be taken from the chosen environment's file name.
Cookie domains are now removed when forwarded with the proxy mode.
Bug fixes:
Fixed setVar helper which could not handle Object, 0 or Arrays.
Fixed switch/case helpers which wouldn't work properly with number.
We switched from using a (heavy) icons font to using inline SVG to solve the icons flickering issue when loading the application.