@jaredwray/mockhttp 3.0.0 → 3.0.1

package/site/dist/changelog/{v0-2-1 → v3-0-1}/index.html

@@ -33,9 +33,9 @@
       }
     })();
   </script>
-  <title>MockHTTP - v0.2.1</title>
+  <title>MockHTTP - v3.0.1</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"BlogPosting","headline":"v0.2.1","description":"<ul>\n<li>moving to logging on a single line by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/15\">https://github.com/jaredwray/mockhttp/pull/15</a></li>\n<li>upgrading scalar to 1.25.82 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/16\">https://github.com/jaredwray/mockhttp/pull/16</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1\">https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1</a></p>","url":"https://mockhttp.org/changelog/v0-2-1/","publisher":{"@type":"Organization","name":"MockHTTP"},"datePublished":"2024-12-13"}
+{"@context":"https://schema.org","@type":"BlogPosting","headline":"v3.0.1","description":"<p>Security patches and Worker fixes. /healthz omits scheme, host, username, and password length.</p>\n<ul>\n<li>start the Worker during isolate startup (#248)</li>\n<li>report bin store health and keep a failed connect in process (#249)</li>\n<li>drop every second socket error that has no listener (#250)</li>\n<li>Add redacted URI diagnostics to /healthz (#254)</li>\n<li>open one MongoDB client per Worker request to stop 1101s on bins (#255)</li>\n<li>pin Node 24.22.1 and patched undici (#256)</li>\n</ul>","url":"https://mockhttp.org/changelog/v3-0-1/","publisher":{"@type":"Organization","name":"MockHTTP"},"datePublished":"2026-10-28"}
 </script>
 </head>
 
@@ -148,17 +148,91 @@
         </div>
         <div class="changelog-entry changelog-entry-single">
           <div class="changelog-entry-header">
-            <h1 class="changelog-entry-title">v0.2.1</h1>
+            <h1 class="changelog-entry-title">v3.0.1</h1>
             <span class="changelog-tag changelog-tag-release">Release</span>
           </div>
-          <span class="changelog-entry-date">December 13, 2024</span>
+          <span class="changelog-entry-date">October 28, 2026</span>
           <div class="changelog-entry-body">
-            <h2 id="whats-changed">What's Changed</h2>
+            <h2 id="jaredwraymockhttp301--2026-10-28">@jaredwray/mockhttp@3.0.1 — 2026-10-28</h2>
+<p>Security patches and Worker fixes. /healthz omits scheme, host, username, and password length.</p>
+<h3 id="bug-fixes">Bug Fixes</h3>
 <ul>
-<li>moving to logging on a single line by @jaredwray in <a href="https://github.com/jaredwray/mockhttp/pull/15">https://github.com/jaredwray/mockhttp/pull/15</a></li>
-<li>upgrading scalar to 1.25.82 by @jaredwray in <a href="https://github.com/jaredwray/mockhttp/pull/16">https://github.com/jaredwray/mockhttp/pull/16</a></li>
+<li>
+<p>start the Worker during isolate startup (#248)</p>
+</li>
+<li>
+<p>report bin store health and keep a failed connect in process (#249)</p>
+</li>
+<li>
+<p>drop every second socket error that has no listener (#250)</p>
+</li>
+<li>
+<p>Add redacted URI diagnostics to /healthz (#254)</p>
+</li>
+<li>
+<p>open one MongoDB client per Worker request to stop 1101s on bins (#255)</p>
+</li>
+<li>
+<p>pin Node 24.22.1 and patched undici (#256)</p>
+</li>
+<li>
+<p>force miniflare's sharp pin to 0.35.5 (#257)</p>
+</li>
+<li>
+<p>bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (#258)</p>
+</li>
+<li>
+<p>security - markdown-it 15.0.3 (CVE-2026-111758) (#260)</p>
+</li>
+<li>
+<p>omit scheme and URI identity from /healthz (#262)</p>
+<pre><code class="hljs language-json"><span class="hljs-punctuation">{</span>
+  <span class="hljs-attr">"status"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"ok"</span><span class="hljs-punctuation">,</span>
+  <span class="hljs-attr">"bins"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+    <span class="hljs-attr">"connected"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"uriPresent"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"uri"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+      <span class="hljs-attr">"atCount"</span><span class="hljs-punctuation">:</span> <span class="hljs-number">1</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"passwordHasPercent"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span>
+    <span class="hljs-punctuation">}</span>
+  <span class="hljs-punctuation">}</span>
+<span class="hljs-punctuation">}</span>
+</code></pre>
+</li>
 </ul>
-<p><strong>Full Changelog</strong>: <a href="https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1">https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1</a></p>
+<h3 id="documentation">Documentation</h3>
+<ul>
+<li>remove the empty vars note from the Cloudflare page (#253)</li>
+</ul>
+<h3 id="internal">Internal</h3>
+<ul>
+<li>point worker URI fixtures at example.invalid (#251)</li>
+<li>declare empty Worker vars in Wrangler (#252)</li>
+<li>list LICENSE in the published package files (#259)</li>
+</ul>
+<h3 id="contributors">Contributors</h3>
+<ul>
+<li>@jaredwray (13)</li>
+<li>@cursoragent (1)</li>
+</ul>
+<h3 id="full-list-of-changes">Full List of Changes</h3>
+<ul>
+<li>fix: restore Cloudflare Worker routes after the v3.0.0 startup crash by @jaredwray in #248</li>
+<li>Add GET /healthz and redact bin store errors by @jaredwray in #249</li>
+<li>Use example.invalid for worker test URI fixtures by @jaredwray in #251</li>
+<li>Drop every second socket error that has no listener by @jaredwray in #250</li>
+<li>Declare empty Worker vars in Wrangler by @jaredwray in #252</li>
+<li>Remove the empty vars note from the Cloudflare page by @jaredwray in #253</li>
+<li>Add redacted URI diagnostics to /healthz by @jaredwray in #254</li>
+<li>fix: open one MongoDB client per Worker request to stop 1101s on bins by @jaredwray in #255</li>
+<li>security: pin Node 24.22.1 and patched undici by @jaredwray in #256</li>
+<li>fix: security - upgrade sharp to 0.35.5 (libheif RCE) by @jaredwray in #257</li>
+<li>fix: security - bump zod to 4.6.7 (GHSA-mrhx-c7xc-m3w5) by @jaredwray in #258</li>
+<li>chore: list LICENSE in the published package files by @jaredwray in #259</li>
+<li>fix: security - markdown-it 15.0.3 (CVE-2026-111758) by @jaredwray in #260</li>
+<li>fix: omit scheme and URI identity from /healthz by @jaredwray in #262</li>
+</ul>
+<p><strong>Full diff:</strong> <a href="https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1">https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1</a></p>
           </div>
         </div>
       </div>
@@ -173,7 +247,7 @@
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2024-12-13</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/changelog-latest.json

@@ -5,6 +5,19 @@
   "home_page_url": "https://mockhttp.org/",
   "feed_url": "https://mockhttp.org/changelog-latest.json",
   "items": [
+    {
+      "id": "v3-0-1",
+      "title": "v3.0.1",
+      "url": "https://mockhttp.org/changelog/v3-0-1/",
+      "date_published": "2026-10-28",
+      "date_modified": "2026-10-28",
+      "summary": "<p>Security patches and Worker fixes. /healthz omits scheme, host, username, and password length.</p>\n<ul>\n<li>start the Worker during isolate startup (#248)</li>\n<li>report bin store health and keep a failed connect in process (#249)</li>\n<li>drop every second socket error that has no listener (#250)</li>\n<li>Add redacted URI diagnostics to /healthz (#254)</li>\n<li>open one MongoDB client per Worker request to stop 1101s on bins (#255)</li>\n<li>pin Node 24.22.1 and patched undici (#256)</li>\n</ul>",
+      "content_html": "<h2 id=\"jaredwraymockhttp301--2026-10-28\">@jaredwray/mockhttp@3.0.1 — 2026-10-28</h2>\n<p>Security patches and Worker fixes. /healthz omits scheme, host, username, and password length.</p>\n<h3 id=\"bug-fixes\">Bug Fixes</h3>\n<ul>\n<li>\n<p>start the Worker during isolate startup (#248)</p>\n</li>\n<li>\n<p>report bin store health and keep a failed connect in process (#249)</p>\n</li>\n<li>\n<p>drop every second socket error that has no listener (#250)</p>\n</li>\n<li>\n<p>Add redacted URI diagnostics to /healthz (#254)</p>\n</li>\n<li>\n<p>open one MongoDB client per Worker request to stop 1101s on bins (#255)</p>\n</li>\n<li>\n<p>pin Node 24.22.1 and patched undici (#256)</p>\n</li>\n<li>\n<p>force miniflare's sharp pin to 0.35.5 (#257)</p>\n</li>\n<li>\n<p>bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (#258)</p>\n</li>\n<li>\n<p>security - markdown-it 15.0.3 (CVE-2026-111758) (#260)</p>\n</li>\n<li>\n<p>omit scheme and URI identity from /healthz (#262)</p>\n<pre><code class=\"hljs language-json\"><span class=\"hljs-punctuation\">{</span>\r\n  <span class=\"hljs-attr\">\"status\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-string\">\"ok\"</span><span class=\"hljs-punctuation\">,</span>\r\n  <span class=\"hljs-attr\">\"bins\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-punctuation\">{</span>\r\n    <span class=\"hljs-attr\">\"connected\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-literal\"><span class=\"hljs-keyword\">true</span></span><span class=\"hljs-punctuation\">,</span>\r\n    <span class=\"hljs-attr\">\"uriPresent\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-literal\"><span class=\"hljs-keyword\">true</span></span><span class=\"hljs-punctuation\">,</span>\r\n    <span class=\"hljs-attr\">\"uri\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-punctuation\">{</span>\r\n      <span class=\"hljs-attr\">\"atCount\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-number\">1</span><span class=\"hljs-punctuation\">,</span>\r\n      <span class=\"hljs-attr\">\"passwordHasPercent\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-literal\"><span class=\"hljs-keyword\">false</span></span>\r\n    <span class=\"hljs-punctuation\">}</span>\r\n  <span class=\"hljs-punctuation\">}</span>\r\n<span class=\"hljs-punctuation\">}</span>\n</code></pre>\n</li>\n</ul>\n<h3 id=\"documentation\">Documentation</h3>\n<ul>\n<li>remove the empty vars note from the Cloudflare page (#253)</li>\n</ul>\n<h3 id=\"internal\">Internal</h3>\n<ul>\n<li>point worker URI fixtures at example.invalid (#251)</li>\n<li>declare empty Worker vars in Wrangler (#252)</li>\n<li>list LICENSE in the published package files (#259)</li>\n</ul>\n<h3 id=\"contributors\">Contributors</h3>\n<ul>\n<li>@jaredwray (13)</li>\n<li>@cursoragent (1)</li>\n</ul>\n<h3 id=\"full-list-of-changes\">Full List of Changes</h3>\n<ul>\n<li>fix: restore Cloudflare Worker routes after the v3.0.0 startup crash by @jaredwray in #248</li>\n<li>Add GET /healthz and redact bin store errors by @jaredwray in #249</li>\n<li>Use example.invalid for worker test URI fixtures by @jaredwray in #251</li>\n<li>Drop every second socket error that has no listener by @jaredwray in #250</li>\n<li>Declare empty Worker vars in Wrangler by @jaredwray in #252</li>\n<li>Remove the empty vars note from the Cloudflare page by @jaredwray in #253</li>\n<li>Add redacted URI diagnostics to /healthz by @jaredwray in #254</li>\n<li>fix: open one MongoDB client per Worker request to stop 1101s on bins by @jaredwray in #255</li>\n<li>security: pin Node 24.22.1 and patched undici by @jaredwray in #256</li>\n<li>fix: security - upgrade sharp to 0.35.5 (libheif RCE) by @jaredwray in #257</li>\n<li>fix: security - bump zod to 4.6.7 (GHSA-mrhx-c7xc-m3w5) by @jaredwray in #258</li>\n<li>chore: list LICENSE in the published package files by @jaredwray in #259</li>\n<li>fix: security - markdown-it 15.0.3 (CVE-2026-111758) by @jaredwray in #260</li>\n<li>fix: omit scheme and URI identity from /healthz by @jaredwray in #262</li>\n</ul>\n<p><strong>Full diff:</strong> <a href=\"https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1\">https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1</a></p>",
+      "content_text": "## @jaredwray/mockhttp@3.0.1 — 2026-10-28\r\n\r\nSecurity patches and Worker fixes. /healthz omits scheme, host, username, and password length.\r\n\r\n### Bug Fixes\r\n- start the Worker during isolate startup (#248)\r\n- report bin store health and keep a failed connect in process (#249)\r\n- drop every second socket error that has no listener (#250)\r\n- Add redacted URI diagnostics to /healthz (#254)\r\n- open one MongoDB client per Worker request to stop 1101s on bins (#255)\r\n- pin Node 24.22.1 and patched undici (#256)\r\n- force miniflare's sharp pin to 0.35.5 (#257)\r\n- bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (#258)\r\n- security - markdown-it 15.0.3 (CVE-2026-111758) (#260)\r\n- omit scheme and URI identity from /healthz (#262)\r\n\r\n  ```json\r\n  {\r\n    \"status\": \"ok\",\r\n    \"bins\": {\r\n      \"connected\": true,\r\n      \"uriPresent\": true,\r\n      \"uri\": {\r\n        \"atCount\": 1,\r\n        \"passwordHasPercent\": false\r\n      }\r\n    }\r\n  }\r\n  ```\r\n\r\n### Documentation\r\n- remove the empty vars note from the Cloudflare page (#253)\r\n\r\n### Internal\r\n- point worker URI fixtures at example.invalid (#251)\r\n- declare empty Worker vars in Wrangler (#252)\r\n- list LICENSE in the published package files (#259)\r\n\r\n### Contributors\r\n- @jaredwray (13)\r\n- @cursoragent (1)\r\n\r\n### Full List of Changes\r\n- fix: restore Cloudflare Worker routes after the v3.0.0 startup crash by @jaredwray in #248\r\n- Add GET /healthz and redact bin store errors by @jaredwray in #249\r\n- Use example.invalid for worker test URI fixtures by @jaredwray in #251\r\n- Drop every second socket error that has no listener by @jaredwray in #250\r\n- Declare empty Worker vars in Wrangler by @jaredwray in #252\r\n- Remove the empty vars note from the Cloudflare page by @jaredwray in #253\r\n- Add redacted URI diagnostics to /healthz by @jaredwray in #254\r\n- fix: open one MongoDB client per Worker request to stop 1101s on bins by @jaredwray in #255\r\n- security: pin Node 24.22.1 and patched undici by @jaredwray in #256\r\n- fix: security - upgrade sharp to 0.35.5 (libheif RCE) by @jaredwray in #257\r\n- fix: security - bump zod to 4.6.7 (GHSA-mrhx-c7xc-m3w5) by @jaredwray in #258\r\n- chore: list LICENSE in the published package files by @jaredwray in #259\r\n- fix: security - markdown-it 15.0.3 (CVE-2026-111758) by @jaredwray in #260\r\n- fix: omit scheme and URI identity from /healthz by @jaredwray in #262\r\n\r\n**Full diff:** [https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1](https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1)",
+      "tags": [
+        "Release"
+      ]
+    },
     {
       "id": "v3-0-0",
       "title": "v3.0.0",
@@ -251,19 +264,6 @@
       "tags": [
         "Release"
       ]
-    },
-    {
-      "id": "v0-6-1",
-      "title": "v0.6.1",
-      "url": "https://mockhttp.org/changelog/v0-6-1/",
-      "date_published": "2025-07-19",
-      "date_modified": "2025-07-19",
-      "summary": "<ul>\n<li>chore: adding in min for cloud run by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/60\">https://github.com/jaredwray/mockhttp/pull/60</a></li>\n<li>chore: upgrading xo to 1.2.1 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/61\">https://github.com/jaredwray/mockhttp/pull/61</a></li>\n<li>chore: upgrading vitest to 3.2.4 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/62\">https://github.com/jaredwray/mockhttp/pull/62</a></li>\n<li>chore: upgrading @scalar/api-reference to 1.32.9 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/63\">https://github.com/jaredwray/mockhttp/pull/63</a></li>\n</ul>",
-      "content_html": "<h2 id=\"whats-changed\">What's Changed</h2>\n<ul>\n<li>chore: adding in min for cloud run by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/60\">https://github.com/jaredwray/mockhttp/pull/60</a></li>\n<li>chore: upgrading xo to 1.2.1 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/61\">https://github.com/jaredwray/mockhttp/pull/61</a></li>\n<li>chore: upgrading vitest to 3.2.4 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/62\">https://github.com/jaredwray/mockhttp/pull/62</a></li>\n<li>chore: upgrading @scalar/api-reference to 1.32.9 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/63\">https://github.com/jaredwray/mockhttp/pull/63</a></li>\n<li>chore: upgrading hookified to 1.10.0 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/64\">https://github.com/jaredwray/mockhttp/pull/64</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/jaredwray/mockhttp/compare/v0.6.0...v0.6.1\">https://github.com/jaredwray/mockhttp/compare/v0.6.0...v0.6.1</a></p>",
-      "content_text": "## What's Changed\r\n* chore: adding in min for cloud run by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/60](https://github.com/jaredwray/mockhttp/pull/60)\r\n* chore: upgrading xo to 1.2.1 by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/61](https://github.com/jaredwray/mockhttp/pull/61)\r\n* chore: upgrading vitest to 3.2.4 by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/62](https://github.com/jaredwray/mockhttp/pull/62)\r\n* chore: upgrading @scalar/api-reference to 1.32.9 by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/63](https://github.com/jaredwray/mockhttp/pull/63)\r\n* chore: upgrading hookified to 1.10.0 by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/64](https://github.com/jaredwray/mockhttp/pull/64)\r\n\r\n\r\n**Full Changelog**: [https://github.com/jaredwray/mockhttp/compare/v0.6.0...v0.6.1](https://github.com/jaredwray/mockhttp/compare/v0.6.0...v0.6.1)",
-      "tags": [
-        "Release"
-      ]
     }
   ]
 }

package/site/dist/changelog.json

@@ -5,6 +5,19 @@
   "home_page_url": "https://mockhttp.org/",
   "feed_url": "https://mockhttp.org/changelog.json",
   "items": [
+    {
+      "id": "v3-0-1",
+      "title": "v3.0.1",
+      "url": "https://mockhttp.org/changelog/v3-0-1/",
+      "date_published": "2026-10-28",
+      "date_modified": "2026-10-28",
+      "summary": "<p>Security patches and Worker fixes. /healthz omits scheme, host, username, and password length.</p>\n<ul>\n<li>start the Worker during isolate startup (#248)</li>\n<li>report bin store health and keep a failed connect in process (#249)</li>\n<li>drop every second socket error that has no listener (#250)</li>\n<li>Add redacted URI diagnostics to /healthz (#254)</li>\n<li>open one MongoDB client per Worker request to stop 1101s on bins (#255)</li>\n<li>pin Node 24.22.1 and patched undici (#256)</li>\n</ul>",
+      "content_html": "<h2 id=\"jaredwraymockhttp301--2026-10-28\">@jaredwray/mockhttp@3.0.1 — 2026-10-28</h2>\n<p>Security patches and Worker fixes. /healthz omits scheme, host, username, and password length.</p>\n<h3 id=\"bug-fixes\">Bug Fixes</h3>\n<ul>\n<li>\n<p>start the Worker during isolate startup (#248)</p>\n</li>\n<li>\n<p>report bin store health and keep a failed connect in process (#249)</p>\n</li>\n<li>\n<p>drop every second socket error that has no listener (#250)</p>\n</li>\n<li>\n<p>Add redacted URI diagnostics to /healthz (#254)</p>\n</li>\n<li>\n<p>open one MongoDB client per Worker request to stop 1101s on bins (#255)</p>\n</li>\n<li>\n<p>pin Node 24.22.1 and patched undici (#256)</p>\n</li>\n<li>\n<p>force miniflare's sharp pin to 0.35.5 (#257)</p>\n</li>\n<li>\n<p>bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (#258)</p>\n</li>\n<li>\n<p>security - markdown-it 15.0.3 (CVE-2026-111758) (#260)</p>\n</li>\n<li>\n<p>omit scheme and URI identity from /healthz (#262)</p>\n<pre><code class=\"hljs language-json\"><span class=\"hljs-punctuation\">{</span>\r\n  <span class=\"hljs-attr\">\"status\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-string\">\"ok\"</span><span class=\"hljs-punctuation\">,</span>\r\n  <span class=\"hljs-attr\">\"bins\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-punctuation\">{</span>\r\n    <span class=\"hljs-attr\">\"connected\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-literal\"><span class=\"hljs-keyword\">true</span></span><span class=\"hljs-punctuation\">,</span>\r\n    <span class=\"hljs-attr\">\"uriPresent\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-literal\"><span class=\"hljs-keyword\">true</span></span><span class=\"hljs-punctuation\">,</span>\r\n    <span class=\"hljs-attr\">\"uri\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-punctuation\">{</span>\r\n      <span class=\"hljs-attr\">\"atCount\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-number\">1</span><span class=\"hljs-punctuation\">,</span>\r\n      <span class=\"hljs-attr\">\"passwordHasPercent\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-literal\"><span class=\"hljs-keyword\">false</span></span>\r\n    <span class=\"hljs-punctuation\">}</span>\r\n  <span class=\"hljs-punctuation\">}</span>\r\n<span class=\"hljs-punctuation\">}</span>\n</code></pre>\n</li>\n</ul>\n<h3 id=\"documentation\">Documentation</h3>\n<ul>\n<li>remove the empty vars note from the Cloudflare page (#253)</li>\n</ul>\n<h3 id=\"internal\">Internal</h3>\n<ul>\n<li>point worker URI fixtures at example.invalid (#251)</li>\n<li>declare empty Worker vars in Wrangler (#252)</li>\n<li>list LICENSE in the published package files (#259)</li>\n</ul>\n<h3 id=\"contributors\">Contributors</h3>\n<ul>\n<li>@jaredwray (13)</li>\n<li>@cursoragent (1)</li>\n</ul>\n<h3 id=\"full-list-of-changes\">Full List of Changes</h3>\n<ul>\n<li>fix: restore Cloudflare Worker routes after the v3.0.0 startup crash by @jaredwray in #248</li>\n<li>Add GET /healthz and redact bin store errors by @jaredwray in #249</li>\n<li>Use example.invalid for worker test URI fixtures by @jaredwray in #251</li>\n<li>Drop every second socket error that has no listener by @jaredwray in #250</li>\n<li>Declare empty Worker vars in Wrangler by @jaredwray in #252</li>\n<li>Remove the empty vars note from the Cloudflare page by @jaredwray in #253</li>\n<li>Add redacted URI diagnostics to /healthz by @jaredwray in #254</li>\n<li>fix: open one MongoDB client per Worker request to stop 1101s on bins by @jaredwray in #255</li>\n<li>security: pin Node 24.22.1 and patched undici by @jaredwray in #256</li>\n<li>fix: security - upgrade sharp to 0.35.5 (libheif RCE) by @jaredwray in #257</li>\n<li>fix: security - bump zod to 4.6.7 (GHSA-mrhx-c7xc-m3w5) by @jaredwray in #258</li>\n<li>chore: list LICENSE in the published package files by @jaredwray in #259</li>\n<li>fix: security - markdown-it 15.0.3 (CVE-2026-111758) by @jaredwray in #260</li>\n<li>fix: omit scheme and URI identity from /healthz by @jaredwray in #262</li>\n</ul>\n<p><strong>Full diff:</strong> <a href=\"https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1\">https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1</a></p>",
+      "content_text": "## @jaredwray/mockhttp@3.0.1 — 2026-10-28\r\n\r\nSecurity patches and Worker fixes. /healthz omits scheme, host, username, and password length.\r\n\r\n### Bug Fixes\r\n- start the Worker during isolate startup (#248)\r\n- report bin store health and keep a failed connect in process (#249)\r\n- drop every second socket error that has no listener (#250)\r\n- Add redacted URI diagnostics to /healthz (#254)\r\n- open one MongoDB client per Worker request to stop 1101s on bins (#255)\r\n- pin Node 24.22.1 and patched undici (#256)\r\n- force miniflare's sharp pin to 0.35.5 (#257)\r\n- bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (#258)\r\n- security - markdown-it 15.0.3 (CVE-2026-111758) (#260)\r\n- omit scheme and URI identity from /healthz (#262)\r\n\r\n  ```json\r\n  {\r\n    \"status\": \"ok\",\r\n    \"bins\": {\r\n      \"connected\": true,\r\n      \"uriPresent\": true,\r\n      \"uri\": {\r\n        \"atCount\": 1,\r\n        \"passwordHasPercent\": false\r\n      }\r\n    }\r\n  }\r\n  ```\r\n\r\n### Documentation\r\n- remove the empty vars note from the Cloudflare page (#253)\r\n\r\n### Internal\r\n- point worker URI fixtures at example.invalid (#251)\r\n- declare empty Worker vars in Wrangler (#252)\r\n- list LICENSE in the published package files (#259)\r\n\r\n### Contributors\r\n- @jaredwray (13)\r\n- @cursoragent (1)\r\n\r\n### Full List of Changes\r\n- fix: restore Cloudflare Worker routes after the v3.0.0 startup crash by @jaredwray in #248\r\n- Add GET /healthz and redact bin store errors by @jaredwray in #249\r\n- Use example.invalid for worker test URI fixtures by @jaredwray in #251\r\n- Drop every second socket error that has no listener by @jaredwray in #250\r\n- Declare empty Worker vars in Wrangler by @jaredwray in #252\r\n- Remove the empty vars note from the Cloudflare page by @jaredwray in #253\r\n- Add redacted URI diagnostics to /healthz by @jaredwray in #254\r\n- fix: open one MongoDB client per Worker request to stop 1101s on bins by @jaredwray in #255\r\n- security: pin Node 24.22.1 and patched undici by @jaredwray in #256\r\n- fix: security - upgrade sharp to 0.35.5 (libheif RCE) by @jaredwray in #257\r\n- fix: security - bump zod to 4.6.7 (GHSA-mrhx-c7xc-m3w5) by @jaredwray in #258\r\n- chore: list LICENSE in the published package files by @jaredwray in #259\r\n- fix: security - markdown-it 15.0.3 (CVE-2026-111758) by @jaredwray in #260\r\n- fix: omit scheme and URI identity from /healthz by @jaredwray in #262\r\n\r\n**Full diff:** [https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1](https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1)",
+      "tags": [
+        "Release"
+      ]
+    },
     {
       "id": "v3-0-0",
       "title": "v3.0.0",
@@ -381,19 +394,6 @@
       "tags": [
         "Release"
       ]
-    },
-    {
-      "id": "v0-2-1",
-      "title": "v0.2.1",
-      "url": "https://mockhttp.org/changelog/v0-2-1/",
-      "date_published": "2024-12-13",
-      "date_modified": "2024-12-13",
-      "summary": "<ul>\n<li>moving to logging on a single line by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/15\">https://github.com/jaredwray/mockhttp/pull/15</a></li>\n<li>upgrading scalar to 1.25.82 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/16\">https://github.com/jaredwray/mockhttp/pull/16</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1\">https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1</a></p>",
-      "content_html": "<h2 id=\"whats-changed\">What's Changed</h2>\n<ul>\n<li>moving to logging on a single line by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/15\">https://github.com/jaredwray/mockhttp/pull/15</a></li>\n<li>upgrading scalar to 1.25.82 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/16\">https://github.com/jaredwray/mockhttp/pull/16</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1\">https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1</a></p>",
-      "content_text": "## What's Changed\r\n* moving to logging on a single line by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/15](https://github.com/jaredwray/mockhttp/pull/15)\r\n* upgrading scalar to 1.25.82 by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/16](https://github.com/jaredwray/mockhttp/pull/16)\r\n\r\n\r\n**Full Changelog**: [https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1](https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1)",
-      "tags": [
-        "Release"
-      ]
     }
   ]
 }

package/site/dist/docs/bins/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Bins</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Bins","description":"","url":"https://mockhttp.org/docs/bins/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Bins","description":"","url":"https://mockhttp.org/docs/bins/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -312,6 +312,7 @@ here is stored against bin <code>:id</code></li>
 <ul>
 <li><a href="#quick-start">Quick Start</a></li>
 <li><a href="#endpoints">Endpoints</a></li>
+<li><a href="#storage-health">Storage health</a></li>
 <li><a href="#end-to-end-webhook-debugging-example">End-to-End Webhook Debugging Example</a></li>
 <li><a href="#captured-request-shape">Captured Request Shape</a></li>
 <li><a href="#body-encoding-examples">Body Encoding Examples</a>
@@ -401,8 +402,67 @@ curl http://localhost:3000/bins/abc123def456/requests
 <td><code>/b/:id</code> and <code>/b/:id/*</code></td>
 <td>Capture requests sent to a bin</td>
 </tr>
+<tr>
+<td>GET</td>
+<td><code>/healthz</code></td>
+<td>Check whether bin storage is reachable</td>
+</tr>
 </tbody>
 </table>
+<h2 id="storage-health">Storage health</h2>
+<p><code>GET /healthz</code> is on the Node server and the Worker. This route does not create a bin.</p>
+<p>A memory store sends HTTP 200:</p>
+<pre><code class="hljs language-json"><span class="hljs-punctuation">{</span>
+  <span class="hljs-attr">"status"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"ok"</span><span class="hljs-punctuation">,</span>
+  <span class="hljs-attr">"bins"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+    <span class="hljs-attr">"store"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"memory"</span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"connected"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"latencyMs"</span><span class="hljs-punctuation">:</span> <span class="hljs-number">1</span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"uriPresent"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span>
+  <span class="hljs-punctuation">}</span>
+<span class="hljs-punctuation">}</span>
+</code></pre>
+<p>The Worker uses MongoDB when <code>MONGODB_URI</code> is set. The check opens a client, sends an admin ping, and then closes the client. The timeout is short. The check does not keep the client after a failure.</p>
+<p>A successful ping sends HTTP 200. <code>store</code> is <code>mongo</code>.</p>
+<p>A failed ping sends HTTP 503:</p>
+<pre><code class="hljs language-json"><span class="hljs-punctuation">{</span>
+  <span class="hljs-attr">"status"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"error"</span><span class="hljs-punctuation">,</span>
+  <span class="hljs-attr">"bins"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+    <span class="hljs-attr">"store"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"mongo"</span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"connected"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"uriPresent"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"uri"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+      <span class="hljs-attr">"length"</span><span class="hljs-punctuation">:</span> <span class="hljs-number">78</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"leadingWhitespace"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"trailingWhitespace"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"newline"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"wrappedQuotes"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"atCount"</span><span class="hljs-punctuation">:</span> <span class="hljs-number">2</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"passwordReserved"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">[</span><span class="hljs-string">"@"</span><span class="hljs-punctuation">]</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"passwordHasPercent"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span>
+    <span class="hljs-punctuation">}</span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"error"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+      <span class="hljs-attr">"name"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"MongoParseError"</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"message"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"Invalid connection string. Percent-encode reserved characters in the username and password (@ : / ? # [ ] $)."</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"code"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">null</span></span>
+    <span class="hljs-punctuation">}</span>
+  <span class="hljs-punctuation">}</span>
+<span class="hljs-punctuation">}</span>
+</code></pre>
+<p>A MongoDB result includes <code>bins.uri</code> on success and on failure. A memory result omits <code>bins.uri</code>. The response does not include the scheme, the host, the username, or the password length.</p>
+<p><code>uri.passwordReserved</code> lists raw reserved characters in the password. The list is empty when the password has only reserved characters. <code>uri.passwordHasPercent</code> is true when the password contains <code>%</code>. The response does not contain the connection string or the password. The logs do not contain the connection string, the username, the password, or the host. <code>uriPresent</code> is a boolean.</p>
+<p><code>Invalid connection string</code> is the driver text. MockHTTP adds the percent-encode hint only for that text or for <code>unescaped characters</code>. A DNS error stays a DNS error. <code>Invalid connection string</code> means that the URI has a second <code>@</code>. It also means that you did not encode a reserved character in the username or the password. Encode these characters:</p>
+<ul>
+<li><code>@</code> as <code>%40</code></li>
+<li><code>:</code> as <code>%3A</code></li>
+<li><code>/</code> as <code>%2F</code></li>
+<li><code>?</code> as <code>%3F</code></li>
+<li><code>#</code> as <code>%23</code></li>
+<li><code>[</code> as <code>%5B</code></li>
+<li><code>]</code> as <code>%5D</code></li>
+<li><code>$</code> as <code>%24</code></li>
+</ul>
+<p>A correct <code>mongodb+srv://</code> URI does not fail at parse time. A DNS failure or a network failure has a different error name.</p>
 <h2 id="end-to-end-webhook-debugging-example">End-to-End Webhook Debugging Example</h2>
 <p>A complete walkthrough using curl:</p>
 <pre><code class="hljs language-bash">BASE=http://localhost:3000
@@ -702,7 +762,7 @@ mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</s
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/configuration/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Configuration</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Configuration","description":"","url":"https://mockhttp.org/docs/configuration/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Configuration","description":"","url":"https://mockhttp.org/docs/configuration/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -544,7 +544,7 @@ GET /status/429/foo/bar
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/hosted/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - MockHttp.org Live</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"MockHttp.org Live","description":"","url":"https://mockhttp.org/docs/hosted/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"MockHttp.org Live","description":"","url":"https://mockhttp.org/docs/hosted/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -318,7 +318,7 @@
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/how-to-deploy/cloudflare/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Cloudflare</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Cloudflare","description":"Deploy MockHTTP as a Cloudflare Worker. Workers Assets serve the docs site, and the Worker handles mock API routes.","url":"https://mockhttp.org/docs/how-to-deploy/cloudflare/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Cloudflare","description":"Deploy MockHTTP as a Cloudflare Worker. Workers Assets serve the docs site, and the Worker handles mock API routes.","url":"https://mockhttp.org/docs/how-to-deploy/cloudflare/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -345,7 +345,12 @@
 </tr>
 </tbody>
 </table>
-<p>The rate limiter key is the <code>cf-connecting-ip</code> header, then the first address in <code>x-forwarded-for</code>, then <code>unknown</code>. A limited request returns <code>429</code> with <code>retry-after: 60</code>. That limiter is shared across isolates. Bins are not. The default store is in memory inside the isolate that handled the request, so a bin created on one request can be missing when another isolate or location handles the next one.</p>
+<p>The rate limiter key is the <code>cf-connecting-ip</code> header, then the first address in <code>x-forwarded-for</code>, then <code>unknown</code>. A limited request returns <code>429</code> with <code>retry-after: 60</code>. That limiter is shared across isolates.</p>
+<p>Bins stay in memory in the isolate when <code>MONGODB_URI</code> is not set. A bin from one request can be absent when a different isolate handles the next request. When <code>MONGODB_URI</code> is set, bins are stored in MongoDB. Each request opens its own client on its first bin operation and closes it after the response, through <code>ctx.waitUntil</code>. No client is shared between requests: workerd rejects I/O on a socket that a different request opened, and a shared client made bin requests fail with error 1101. It does not connect while the isolate starts. Each bin request therefore pays one connection setup, which is a few round trips to Atlas.</p>
+<p>Percent-encode reserved characters in the username and the password. <code>@</code> is <code>%40</code>. An unencoded <code>@</code> makes the driver throw <code>Invalid connection string</code> before it contacts Atlas.</p>
+<p><code>GET /healthz</code> reports the bin store. A successful admin ping returns HTTP 200 and <code>bins.connected: true</code>. A failed ping returns HTTP 503 with the driver error name, a redacted message, and a code. The body has <code>uriPresent</code> (boolean). It does not have the scheme. On the Node server, this route reports the memory store.</p>
+<p>When <code>MONGODB_URI</code> is set, <code>bins.uri</code> has the URI length and the <code>@</code> count. It also has flags for whitespace, a newline, and quote marks. It does not have the host, the username, or the password length. The body does not have the password or the full URI.</p>
+<p>The percent-encode hint is added only for <code>Invalid connection string</code> or <code>unescaped characters</code>. A DNS error keeps the driver text. <code>uri.passwordReserved</code> is empty when the password has only reserved characters. Worker logs still omit the URI, the username, the password, and the host.</p>
 <p>Taps are a library API (<code>mock.taps.inject</code>). They have no HTTP routes, so a deployed Worker has no way to inject one.</p>
 <p>Assets are checked before the Worker. A file under <code>site/dist</code> (the docs site, favicon, logos) is served as a static asset. A path that is not a file, such as <code>/get</code> or <code>/post</code>, is handled by the Worker.</p>
 <h2 id="deploy-your-own-worker">Deploy your own Worker</h2>
@@ -385,7 +390,7 @@ npx wrangler@4.127.0 deploy
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/how-to-deploy/docker/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Docker</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Docker","description":"Run MockHTTP from the jaredwray/mockhttp image, with Docker Compose, or by building the image from this repository.","url":"https://mockhttp.org/docs/how-to-deploy/docker/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Docker","description":"Run MockHTTP from the jaredwray/mockhttp image, with Docker Compose, or by building the image from this repository.","url":"https://mockhttp.org/docs/how-to-deploy/docker/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -399,7 +399,7 @@ docker run -d -p 3000:3000 jaredwray/mockhttp
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/how-to-deploy/wasmer/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Wasmer</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Wasmer","description":"Deploy the MockHTTP Node.js server to Wasmer Edge with app.yaml, Anybuild, and wasmer deploy.","url":"https://mockhttp.org/docs/how-to-deploy/wasmer/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Wasmer","description":"Deploy the MockHTTP Node.js server to Wasmer Edge with app.yaml, Anybuild, and wasmer deploy.","url":"https://mockhttp.org/docs/how-to-deploy/wasmer/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -360,7 +360,7 @@
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/https/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - HTTPS and HTTP/2</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"HTTPS and HTTP/2","description":"","url":"https://mockhttp.org/docs/https/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"HTTPS and HTTP/2","description":"","url":"https://mockhttp.org/docs/https/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -531,7 +531,7 @@
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Getting Started</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Getting Started","description":"","url":"https://mockhttp.org/docs/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Getting Started","description":"","url":"https://mockhttp.org/docs/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -375,7 +375,7 @@
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/library/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Library API</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Library API","description":"","url":"https://mockhttp.org/docs/library/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Library API","description":"","url":"https://mockhttp.org/docs/library/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -447,7 +447,7 @@
 <h4 id="async-registerimageroutesfastifyinstance"><code>async registerImageRoutes(fastifyInstance?)</code></h4>
 <p>Register image routes (jpeg, png, svg, webp) with content negotiation support.</p>
 <h4 id="async-registerbinroutesfastifyinstance"><code>async registerBinRoutes(fastifyInstance?)</code></h4>
-<p>Register the request bin routes — management at <code>/bins</code> and capture at <code>/b/:id</code>.</p>
+<p>Register the request bin routes. Management is at <code>/bins</code> and capture is at <code>/b/:id</code>. <code>GET /healthz</code> reports whether bin storage is reachable.</p>
 <h2 id="bins-request-capture">Bins (Request Capture)</h2>
 <p>Use <code>mockHttp.bins</code> to control request bins. See <a href="#request-bins">Request Bins</a> for usage examples.</p>
 <h3 id="binscreatebin"><code>bins.createBin()</code></h3>
@@ -549,7 +549,7 @@
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/taps/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Taps</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Taps","description":"","url":"https://mockhttp.org/docs/taps/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-20","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Taps","description":"","url":"https://mockhttp.org/docs/taps/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -481,7 +481,7 @@ mock.<span class="hljs-property">taps</span>.<span class="hljs-title function_">
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-20</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>