v2.9.5

Be sure to keep up with the latest releases by subscribing to the ATOM feed.

Changes

This release contains security and dependency updates, along with improvements to the build and release pipeline. There are no changes to the API.

Removed nodemailer from mountebank's runtime dependencies; it was only used by the test suite. The smtp imposter continues to depend on smtp-server and mailparser
Updated csv-parse to v7.0.2, used by the lookup behavior
Updated @xmldom/xmldom to v0.9.12, resolving a number of denial of service and XML injection advisories. mountebank uses it to parse XML for xpath predicates and selectors; matching behavior is unchanged
Updated smtp-server to v3.19.13, mailparser to v3.9.28, and winston to v3.19.0
Resolved denial of service advisories in qs, body-parser, and path-to-regexp, which mountebank pulls in through express. These were fixed by re-resolving the dependency tree; express itself is unchanged at v5.1.0
Security updates for multiple dependencies: nodemailer, brace-expansion, iconv-lite, html-to-text, htmlparser2, linkify-it, cors, errorhandler, jsonpath-plus, and prom-client
Added Dependabot configuration so dependency and security updates are picked up automatically
Hardened npm installs in CI against supply chain attacks
npm packages are now published using a trusted publisher, which authenticates over OIDC instead of a long-lived access token

Many thanks to the following kind folks for help with this release, either through bug reports, suggestions, or direct code contributions:

npm install -g @mbtest/mountebank@2.9.5