ARTEMIS-X Bump mockserver.version from 7.2.0 to 7.6.0

[dependabot]

Bumps mockserver.version from 7.2.0 to 7.6.0.
Updates org.mock-server:mockserver-netty from 7.2.0 to 7.6.0

Updates org.mock-server:mockserver-core from 7.2.0 to 7.6.0

Release notes

Sourced from org.mock-server:mockserver-core's releases.

MockServer 7.6.0

[7.6.0] - 2026-08-17

Changed

• The three Kubernetes container-integration cases that need Java-built images — helm_sidecar_injection (admission-webhook sidecar injection), helm_clustered_convergence, and helm_jgroups_dns_ping (both the -clustered Infinispan image) — now run blocking in CI instead of recording a skip. Previously the CI helm step ran with no JDK and never built those images, so all three recorded an honest but permanent SKIP — coverage that looked green while proving nothing. A new :maven: build container-test images (jars) step in the mockserver-container-tests pipeline builds the mockserver-netty, mockserver-k8s-webhook, and mockserver-state-infinispan jars from the tree (once, via the Maven-in-Docker reactor) and hands them to the helm step as Buildkite artifacts; the helm step downloads them and does cheap docker builds (a COPY into distroless) to produce the -clustered and mockserver-webhook images, then runs the suite. The jars travel as artifacts (~200 MB total) rather than docker saved images (~1.3 GB), mirroring the node-launcher / WAR hand-off. Both layers fail closed: the helm step exits non-zero if any jar artifact is absent, and the harness runs with REQUIRE_CLUSTERED_IMAGE=true/REQUIRE_WEBHOOK_IMAGE=true so an image that is expected-but-absent is recorded as a FAILURE, never a skip — a skip in CI is now impossible. Local container_integration_tests/integration_tests.sh is unchanged for a developer without the images: it still records a comprehensible SKIP (no fail-closed flag set), and the harness now also builds the mockserver-webhook image locally (build_webhook_docker) so the sidecar case runs blocking in local dev too — it was never built by the harness before, so that case had always skipped.

Added

• Two new rules in the always-on check-false-green-guards.sh CI gate. Rule 4 fails the build if a CI step runs the container-integration harness with the helm/k3d cases active but does not export both REQUIRE_CLUSTERED_IMAGE=true and REQUIRE_WEBHOOK_IMAGE=true — the exact way the three image-dependent Kubernetes cases could silently revert to a green SKIP. It is keyed on the step's behaviour (invokes integration_tests.sh without SKIP_HELM_TESTS=true), not on a filename, so a rename or a second helm-running step is covered automatically. Rule 5 fails the build if a mockserver-core test that performs a JVM-global logging side effect (reaching LogManager.readConfiguration's handler reset() via the static ConfigurationProperties logging setters or a forced fresh <clinit>) is not in the sequential-tests include list — the shape behind a release-blocking flake that ParallelStaticStateGuardTest structurally cannot catch. Both rules fail closed on an empty corpus and carry a rotating allow-list. See https://github.com/mock-server/mockserver-monorepo/blob/HEAD/docs/operations/false-green-guards.md.
• A jarPath launcher option and matching MOCKSERVER_JAR_PATH environment variable for mockserver-node, pointing start_mockserver at a pre-provisioned mockserver-netty jar-with-dependencies instead of downloading one from Maven Central. When set, that exact jar is launched and no download is attempted; a configured-but-missing path is a hard error (... refusing to fall back to downloading a release) rather than a silent fall-back to a released jar, so a missing artifact fails loudly. Mirrors the existing MOCKSERVER_BINARY_BASE_URL bring-your-own-artifact path for the standalone binary, and serves air-gapped/corporate installs as well as testing a locally-built jar (jarPath takes precedence over mockServerVersion/artifactory*; the option beats the env var). The Node launcher integration tests now use it in CI: a new :maven: build node launcher jar step builds the jar from the tree and the launcher-test step downloads it as an artifact and launches it via MOCKSERVER_JAR_PATH — so the suite finally tests the repo's own code instead of the last release. Previously it ran a downloaded release chosen by package.json's version, so a mockserver-core fix could not green it and a regression could not red it; that released jar also carried the shipped dynamic-CA generation race (fixed on master in 4cff56e61) and flaked ~8% of runs. The launcher step fails closed if the tree-built jar is absent rather than reverting to a download, and local npm test outside CI is unchanged (with neither the option nor the env var set it still downloads as before).
• A structural wire-contract test for the LLM provider codecs (LlmCodecStructuralContractTest), breaking the self-derivation weakness in the golden-file drift test. LlmCodecGoldenFileTest regenerates its golden bodies from the codec itself (-Dmockserver.updateLlmGoldens=true), so a structural codec defect — a renamed field, a wrong SSE event name, a dropped finish_reason — bakes straight into its own golden and the byte-for-byte drift

... (truncated)

Changelog

Sourced from org.mock-server:mockserver-core's changelog.

[7.6.0] - 2026-08-17

Changed

• The three Kubernetes container-integration cases that need Java-built images — helm_sidecar_injection (admission-webhook sidecar injection), helm_clustered_convergence, and helm_jgroups_dns_ping (both the -clustered Infinispan image) — now run blocking in CI instead of recording a skip. Previously the CI helm step ran with no JDK and never built those images, so all three recorded an honest but permanent SKIP — coverage that looked green while proving nothing. A new :maven: build container-test images (jars) step in the mockserver-container-tests pipeline builds the mockserver-netty, mockserver-k8s-webhook, and mockserver-state-infinispan jars from the tree (once, via the Maven-in-Docker reactor) and hands them to the helm step as Buildkite artifacts; the helm step downloads them and does cheap docker builds (a COPY into distroless) to produce the -clustered and mockserver-webhook images, then runs the suite. The jars travel as artifacts (~200 MB total) rather than docker saved images (~1.3 GB), mirroring the node-launcher / WAR hand-off. Both layers fail closed: the helm step exits non-zero if any jar artifact is absent, and the harness runs with REQUIRE_CLUSTERED_IMAGE=true/REQUIRE_WEBHOOK_IMAGE=true so an image that is expected-but-absent is recorded as a FAILURE, never a skip — a skip in CI is now impossible. Local container_integration_tests/integration_tests.sh is unchanged for a developer without the images: it still records a comprehensible SKIP (no fail-closed flag set), and the harness now also builds the mockserver-webhook image locally (build_webhook_docker) so the sidecar case runs blocking in local dev too — it was never built by the harness before, so that case had always skipped.

Added

• Two new rules in the always-on check-false-green-guards.sh CI gate. Rule 4 fails the build if a CI step runs the container-integration harness with the helm/k3d cases active but does not export both REQUIRE_CLUSTERED_IMAGE=true and REQUIRE_WEBHOOK_IMAGE=true — the exact way the three image-dependent Kubernetes cases could silently revert to a green SKIP. It is keyed on the step's behaviour (invokes integration_tests.sh without SKIP_HELM_TESTS=true), not on a filename, so a rename or a second helm-running step is covered automatically. Rule 5 fails the build if a mockserver-core test that performs a JVM-global logging side effect (reaching LogManager.readConfiguration's handler reset() via the static ConfigurationProperties logging setters or a forced fresh <clinit>) is not in the sequential-tests include list — the shape behind a release-blocking flake that ParallelStaticStateGuardTest structurally cannot catch. Both rules fail closed on an empty corpus and carry a rotating allow-list. See https://github.com/mock-server/mockserver-monorepo/blob/master/docs/operations/false-green-guards.md.
• A jarPath launcher option and matching MOCKSERVER_JAR_PATH environment variable for mockserver-node, pointing start_mockserver at a pre-provisioned mockserver-netty jar-with-dependencies instead of downloading one from Maven Central. When set, that exact jar is launched and no download is attempted; a configured-but-missing path is a hard error (... refusing to fall back to downloading a release) rather than a silent fall-back to a released jar, so a missing artifact fails loudly. Mirrors the existing MOCKSERVER_BINARY_BASE_URL bring-your-own-artifact path for the standalone binary, and serves air-gapped/corporate installs as well as testing a locally-built jar (jarPath takes precedence over mockServerVersion/artifactory*; the option beats the env var). The Node launcher integration tests now use it in CI: a new :maven: build node launcher jar step builds the jar from the tree and the launcher-test step downloads it as an artifact and launches it via MOCKSERVER_JAR_PATH — so the suite finally tests the repo's own code instead of the last release. Previously it ran a downloaded release chosen by package.json's version, so a mockserver-core fix could not green it and a regression could not red it; that released jar also carried the shipped dynamic-CA generation race (fixed on master in 4cff56e61) and flaked ~8% of runs. The launcher step fails closed if the tree-built jar is absent rather than reverting to a download, and local npm test outside CI is unchanged (with neither the option nor the env var set it still downloads as before).
• A structural wire-contract test for the LLM provider codecs (LlmCodecStructuralContractTest), breaking the self-derivation weakness in the golden-file drift test. LlmCodecGoldenFileTest regenerates its golden bodies from the codec itself (-Dmockserver.updateLlmGoldens=true), so a structural codec defect — a renamed field, a wrong SSE event name, a dropped finish_reason — bakes straight into its own golden and the byte-for-byte drift test then passes forever, confirming only that the codec is consistent with itself (token counts were already

... (truncated)

Commits

• 99005f7 release: set version 7.6.0
• d7cf692 fix(ci): stage the clustered libs inside the reactor, not a second Maven run
• c47c770 ci: guard the two false-green paths that reviews found this session
• d8461d0 test(core): run the fresh-clinit tests sequentially, they reset every logger
• e8386bf ci: build the Kubernetes test images so the three helm cases actually run
• d06a069 docs(changelog): mark the TLS-defaults change as BREAKING BEHAVIOUR, not BREA...
• f932718 test(k8s): prove sidecar injection and JGroups DNS discovery against a real c...
• 2653f59 fix(helm): repair the sidecar-injection webhook, broken out of the box
• dac07db ci: fail the build when a new false-green test shape appears
• 0dfebd4 test(k8s): let the Helm suite's k3d cluster start behind a TLS-inspection proxy
• Additional commits viewable in compare view

Updates org.mock-server:mockserver-client-java from 7.2.0 to 7.6.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)