Changelog

Changed

• The backend and production image now build with Go 1.27.0; the full race-tested suite continues to pass on the new toolchain.
• GitHub Actions now uses Node.js 24-compatible checkout and setup-go releases, with the Go version sourced directly from go.mod to keep CI and production aligned.

Added

• Named response variants can now be selected explicitly with X-Quickmock-Variant or __quickmock_variant, making exact edge cases reproducible on demand.
• Ordered conditional rules select variants from the request method, path, query, headers, or JSON body using equals, not_equals, contains, and exists operators.
• One mock can now expose up to 50 method-and-path routes. Paste an OpenAPI 3.x JSON or YAML document into the builder to generate the workspace routes and example responses.
• New API documentation and a machine-readable OpenAPI 3.1 contract cover creation, variants, rules, workspaces, and inspector privacy.

Security

• Request logs are private by default for new mocks. The admin token unlocks a path-scoped HttpOnly inspector session; creators can also disable storage of request bodies or sender IPs.

Changed

• SEO/GEO metadata now publishes reciprocal language sitemap entries, includes the documentation page and updated freshness signals, and marks mock, workspace, sharing, and inspector URLs as non-indexable.

Security

• The request inspector's fallback polling endpoints now have their own per-IP budget, limiting automated bursts without affecting normal live updates.
• Mock responses can no longer widen a service worker's scope, and redirect responses accept only relative, HTTP, or HTTPS destinations.
• The built-in abuse filter now rejects common SSRF primitives, executable handler configurations, and known backlink-page fingerprints. Self-hosters can also configure an IP/CIDR denylist.

Fixed

• Container logs now rotate by default, and graceful shutdown no longer attempts to persist empty request-log records while draining a closed queue.

Security

• Creating a mock from the site — the form on the home page and the one-click button on a template page — is now rejected when another site triggered it in your browser. Scripted access is unaffected: curl, CI jobs, and the public API send no browser origin headers and keep working exactly as before.
• Those same two actions now have their own rate-limit budget, separate from the one that serves mock traffic, so a runaway script can't spend your quota of active mocks.

Changed

• The header no longer overflows on a phone: the Templates section made six links too many for one line, so the GitHub link moved down to the footer next to the other author links, and the remaining navigation wraps onto its own row instead of running off the screen.
• Running your own instance: the server now warns at startup about environment variables left over from the old MOCKAPI_ prefix. Nothing has read them since the rename, so until now a stale key silently left the default in place — including QUICKMOCK_BASE_URL, which the new origin check depends on.

Added

• New /templates section: ten ready-made mock configurations across four categories (payments, developer tools, auth & identity, general purpose) — Stripe and Shopify webhooks, GitHub push events, Slack's url_verification handshake, OAuth2/OIDC discovery and JWKS, RFC 9457 error bodies, and more.
• Every template's "Create this mock" button creates it in one click, and the "Open it in the mock builder to tweak first" link opens the same config pre-filled in the regular mock form so you can adjust fields, headers, or status codes before saving.
• Each template page breaks down the payload's key fields and lists exactly how the mock differs from the real service it imitates — no pretending a static mock is the genuine API.

Fixed

• The home page's "you've hit the active-mock limit" banner used to show the request-body size limit instead of the actual mock-count limit, plus a stray %!(EXTRA int=…) tail. It now shows the correct number with nothing extra appended.

Added

• A mock's lifetime is now capped: ttl_seconds can't exceed 30 days (server-configurable), whether set at creation or later.
• The mock page grows an "Extend" button that pushes the expiry further out, up to that same 30-day cap from the mock's creation date — it requires the admin token, same as editing or deleting the mock.
• Response body templates gained four tokens: {{random.pick:a|b|c}} picks one option per hit, {{seq}} counts hits, plus {{faker.price}} and {{faker.lorem}}.
• The request inspector can filter by HTTP method, and its "Download JSON" link now exports the full captured request/response history (including sender IPs) — requires the admin token, unlike the config export.

Added

• Creating a mock now returns a one-time admin token, shown once in a copyable banner on the mock page — save it, because it can't be shown again.
• Editing a mock, deleting it, or clearing its logs now needs that token: send it as Authorization: Bearer <token>. Reading a mock, its logs, and the live inspector still work by slug alone, no token required.
• Mocks created before this release keep working without a token until they expire. New guide: Manage mocks from any device.

Added

• The request inspector streams over Server-Sent Events: new requests appear instantly, with no polling, and the page falls back to polling automatically where SSE is unavailable.
• Export a mock's config as JSON from its page (no logs, no IPs) and import it on the create form — from a file or pasted text, entirely in your browser. The format matches POST /api/mocks, so exports are replayable via the API.
• An anti-spam content filter blocks abusive mock creation. Operators can replace the built-in pattern list (QUICKMOCK_SPAM_PATTERNS_FILE), disable it, or allowlist IPs (QUICKMOCK_SPAM_ALLOW_IPS).

Added

• One checkbox on the create form turns on a permissive, credential-free CORS preset (Access-Control-Allow-Origin: * and friends) and answers OPTIONS preflight with 204 — call a mock from browser JS on any origin, no proxy.
• New use-case guide: Mock an API with CORS.

Added

• New /guide section: scenario-first landing pages for common tasks — mock a REST API, test retry logic, simulate flaky or slow APIs, inspect webhooks, return fake data, echo the request. Each page has a ready-to-run curl example; all are listed in the sitemap.
• Each guide now has a copy button on its curl examples and a one-click Create a mock CTA that opens the home form pre-filled with that recipe's config — method, body, delay, error rate, sequence — ready to submit.

Added

• Response sequences: a mock can now hold an ordered list of up to 10 extra responses (status + body + headers each) cycled per hit — 1st call → main response, 2nd → step 2, … then loop. Classic retry-logic testing. The position is a shared per-mock counter (Redis, with an in-process fallback), so every caller advances the same sequence.
• Error rate & delay jitter: a configurable share of requests (0–100%, rolled per request) can answer with an alternate status/body, and the response delay can be a min–max range for random latency jitter instead of a fixed value. All three settings combine, and a new X-Mockapi-Variant response header (default, error, or seq-i/n) shows which branch served each hit. Configurable from the create form (new “Flaky simulation” section) and the API.
• The “Who built this” section on the home page now links to the maintainer's personal site (deadsquirrel.dev), language-matched per locale.

Added

• New request.* dynamic tokens echo the incoming request back into the response body: {{request.method}}, {{request.path}}, {{request.ip}}, {{request.query.id}}, {{request.header.x-request-id}}, {{request.body}}, and JSON dot paths like {{request.body.user.name}}. Values are inserted verbatim and nothing extra is stored — a static mock can now answer with data from the request itself.

Fixed

• The 2026-05-20 entry below used to display Go-template escaping ({{`…`}}) around every token instead of the token itself — leftover from copying the markup out of an HTML template. Now it shows plain {{faker.uuid}} and friends.

Added

• Footer credit now links the author name to the maintainer's personal site (deadsquirrel.dev), language-matched per locale, with rel="me" as an identity signal.

Added

• This /changelog page itself, in EN and RU, with hreflang and an entry in sitemap.xml.
• Home page: a Quick glossary section (Mock API, Endpoint, TTL, Faker token, Content-Type) for readers landing here without context.
• Home page: a Who built this block with author bio and direct links to GitHub, LinkedIn, Telegram — and a Why I built Quickmock personal-story section, so the page isn't a faceless tool landing.
• Visible Last updated stamp at the bottom of the home page; dateModified mirrored into the WebApplication JSON-LD so AI crawlers see freshness.

Fixed

• ?lang=<code> in the URL now actually serves that language. Previously the canonical / hreflang links pointed at ?lang=ru but the resolver only read the cookie and Accept-Language, so a bot following the hreflang link saw English content — the multilingual signal was a lie.

Security

• Origin hardening for /m/*: the public mock router now strips request-altering headers a malicious caller could use to confuse downstream proxies, slugs were lengthened (more entropy), and internal error messages are redacted before they reach the wire — no DSN fragments, no stack frames.
• Language switcher (POST /language) now accepts same-origin absolute Referers, so the redirect-back path works behind reverse proxies that rewrite the Referer header. Cross-origin Referers are still rejected.

Fixed

• RealIP middleware now trusts X-Forwarded-For / X-Real-IP when the immediate peer is loopback or a private/link-local address. Previously XFF was honored only for loopback peers, so behind Docker Compose every request was attributed to the bridge gateway (e.g. 172.18.0.1) — making creator_ip and request_ip useless and turning the per-IP mock limit into a global one.
• Mock router now stores incoming request headers with lowercased keys, so request_headers->>'user-agent' works regardless of wire casing.
• UI: slug examples updated to the new 12-char format; Copy-URL button restored on the mock detail page.

Added

• Footer disclaimer and Terms-of-use modal: mocks are user-generated content, prohibited categories (malware, phishing, CSAM, attack infrastructure) are spelled out, and an abuse-report channel is published.
• Footer modal stays usable on small viewports — close button is no longer clipped on mobile.

Added

• Faker / now token substitution in response bodies: {{faker.uuid}}, {{faker.email}}, {{faker.name}}, {{now.iso8601}}, plus 18 more (people, IDs, network, text, time). The mock stores the template as-is and renders fresh random values on every hit, so one mock can serve different data per call. Full list lives under Dynamic tokens on the create form.

Fixed

• Docker Compose deploy now waits for the --wait healthcheck instead of polling /healthz in a shell loop, so deploys no longer print the cosmetic curl: (52) Empty reply while the proxy and Go process finish racing.
• POSTGRES_PASSWORD example in .env.example now warns against base64-encoded values — pgx's DSN parser chokes on + / = in the password.

Added

• Core mock engine: create, view, edit, delete; all HTTP methods including ANY.
• Public /m/:slug router with configurable status, body, headers, response delay (0–30 s), and TTL.
• Live request inspector: HTMX 2-second poll, per-mock counter, clear-logs.
• cURL import — paste a curl … command to pre-fill the create form.
• Code snippets on the mock detail page for JavaScript, Python, Go, and PHP.
• Read-only share preview at /share/:slug with Open Graph tags.
• Per-IP rate limit (5000 hits / 8 hours) and per-IP active-mock cap (50).
• 512 KB max response body, enforced by handler and a DB CHECK constraint.
• Docker Compose stack (app + Postgres + Redis + one-shot migration container) and a bare-metal systemd path.
• EN + RU localization, language switcher (cookie + Accept-Language).
• Privacy by design: no third-party JS, no analytics, no fonts CDN; CI enforces this on every build.