deps: Bump ApiTestSpark from 1.8.0 to 2.0.1

[dependabot]

Updated ApiTestSpark from 1.8.0 to 2.0.1.

Release notes

Sourced from ApiTestSpark's releases.

2.0.1

Changelog

All notable changes to the ApiTestSpark project are documented here.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

[v2.0.1] - 2026-08-10

Fixed

• Double slash in constructed request URLs — added a joinUrl(base, path) helper (src/utils/urlUtils.ts) and replaced ad-hoc `${baseUrl}${path}` string concatenation with it in the request pipeline (ApiClient.request, createRestCaller) and the API Doc Builder capture forms. A base URL configured with a trailing slash combined with an endpoint path starting with a leading slash — a common shape from OpenAPI-imported paths — previously produced a doubled // in the request URL.

Contributors

• Mark Hazleton

[v2.0.0] - 2026-07-16

Added

• OAuth Token Configuration (browser-side) — configure OAuth2 client_credentials or password grant token acquisition per Environment on the Config screen. Tokens are acquired via the shared request pipeline (never a raw fetch), cached per Environment, and secrets/passwords are redacted before they reach the debug panel or telemetry. Remote API profiles can opt in to using the environment's OAuth token instead of a static Bearer token (remoteUseOAuthToken); EndpointTester blocks the request rather than silently falling back to a static token if no valid token can be acquired.
• OAuth Token Configuration (server-side) — new RemoteApiProfile.OAuth (RemoteApiProfileOAuth: TokenEndpointUrl, ClientId, ClientSecret) lets a remote API profile use an OAuth2 client_credentials bearer token acquired and cached entirely on the server. The token is injected into the remote spec proxy and, when EnableRemoteCallProxy is enabled, into proxied endpoint calls. The client secret and acquired token are never returned to the browser — /api-test-spark/config exposes only remoteOAuthConfigured: true/false, and the Config screen shows a read-only "configured on server" indicator for these profiles.

Migration Notes

• No breaking changes to existing configuration — this is an additive release. Existing RemoteOpenApiBearerToken/RemoteOpenApiApiKeyValue profiles are unaffected.
• To configure browser-side OAuth: open the Config screen, select an Environment, enter a token endpoint URL and client credentials, then check "Use environment OAuth token" on any Remote API profile that needs it.
• To configure server-side OAuth: set options.RemoteApiProfiles[].OAuth = new RemoteApiProfileOAuth { TokenEndpointUrl = ..., ClientId = ..., ClientSecret = ... } in Program.cs. Requires EnableRemoteCallProxy = true for the profile's proxied endpoint calls to carry the token.

Contributors

• Mark Hazleton

[v1.8.0] - 2026-06-21

Added

• Optional harness auth gate — new RequireAuthenticatedUser option on ApiTestSparkOptions. When enabled, all routes under /api-test-spark require an authenticated user, including SPA assets, /api-test-spark/config, /api-test-spark/remote-spec, and /api-test-spark/remote-call.
• Server-side proxy correlation tokens — proxied remote calls now resolve {request-guid} and {session-guid} tokens in RemoteDefaultHeaders on the server before forwarding requests.

Changed

• Fail-fast CI frontend gate — GitHub workflows now run npm run verify (lint + typecheck + build) before .NET build/test and publish steps.
• Config endpoint CORS cache safety — responses that emit Access-Control-Allow-Origin now also emit Vary: Origin.

Fixed

... (truncated)

2.0.0

Added

• OAuth Token Configuration (browser-side) — configure OAuth2 client_credentials or password grant token acquisition per Environment on the Config screen. Tokens are acquired via the shared request pipeline (never a raw fetch), cached per Environment, and secrets/passwords are redacted before they reach the debug panel or telemetry. Remote API profiles can opt in to using the environment's OAuth token instead of a static Bearer token (remoteUseOAuthToken); EndpointTester blocks the request rather than silently falling back to a static token if no valid token can be acquired.
• OAuth Token Configuration (server-side) — new RemoteApiProfile.OAuth (RemoteApiProfileOAuth: TokenEndpointUrl, ClientId, ClientSecret) lets a remote API profile use an OAuth2 client_credentials bearer token acquired and cached entirely on the server. The token is injected into the remote spec proxy and, when EnableRemoteCallProxy is enabled, into proxied endpoint calls. The client secret and acquired token are never returned to the browser — /api-test-spark/config exposes only remoteOAuthConfigured: true/false, and the Config screen shows a read-only "configured on server" indicator for these profiles.

Migration Notes

• No breaking changes to existing configuration — this is an additive release. Existing RemoteOpenApiBearerToken/RemoteOpenApiApiKeyValue profiles are unaffected.
• To configure browser-side OAuth: open the Config screen, select an Environment, enter a token endpoint URL and client credentials, then check "Use environment OAuth token" on any Remote API profile that needs it.
• To configure server-side OAuth: set options.RemoteApiProfiles[].OAuth = new RemoteApiProfileOAuth { TokenEndpointUrl = ..., ClientId = ..., ClientSecret = ... } in Program.cs. Requires EnableRemoteCallProxy = true for the profile's proxied endpoint calls to carry the token.

Contributors

• Mark Hazleton

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.