Bump com.testingbot:TestingBotTunnel from 4.8 to 5.0

[dependabot]

Bumps com.testingbot:TestingBotTunnel from 4.8 to 5.0.

Release notes

Sourced from com.testingbot:TestingBotTunnel's releases.

TestingBot Tunnel 5.0 is a major release: a move to Jetty 12 and Java 17, self-contained downloads that need no Java at all, and a set of controls over what the tunnel may reach and how it gets there.

Upgrading from 4.x? Existing command lines keep working, but read Upgrading from 4.x first -- a few defaults changed.

Breaking changes

• Requires Java 17 (was 11). On an older Java the tunnel now says so, instead of failing with "A JNI error has occurred". Or use one of the self-contained downloads below.
• Local listeners bind 127.0.0.1, not every interface: the Selenium relay (--se-port), the local proxy (--localproxy), the metrics port and --web. None of them authenticates, and the relay attaches your account key and secret to everything it forwards. Use --bind-address 0.0.0.0 to accept connections from other machines. The Docker image already sets this.
• Successful requests no longer log a line. --log-http defaults to errors; --log-http url restores a line per request. The Selenium relay now honours --log-http too.
• /readyz reports ready only after the startup self-test passes, so a half-working tunnel that used to look healthy now returns 503 until it is.

Downloads

Platform	File
Any OS with Java 17+	TestingBotTunnel-5.0.jar
Linux x64 / arm64	testingbot-tunnel-linux-x64.tar.gz, testingbot-tunnel-linux-arm64.tar.gz
macOS Intel / Apple silicon	testingbot-tunnel-macos-x64.tar.gz, testingbot-tunnel-macos-arm64.tar.gz (signed and notarized)
Windows x64	testingbot-tunnel-windows-x64.zip

The platform archives bundle a trimmed Java runtime, so nothing needs to be installed. Every file has a .sha256 next to it.

• Docker: docker run -e TESTINGBOT_KEY=... -e TESTINGBOT_SECRET=... testingbot/tunnel:5.0
• Maven Central: com.testingbot:TestingBotTunnel:5.0

Highlights

Restricting what the tunnel can reach

• --allow-hosts: name what the tunnel is for and refuse everything else (*.suffix for subdomains)
• --fast-fail-regexps exceptions with !, e.g. .*,!ok\.com
• --localhost-policy deny: refuse traffic to this machine's loopback, checked on the address actually dialled
• All three are enforced on plain HTTP, CONNECT and WebSocket upgrades

Corporate networks and upstream proxies

• --pac-local: choose egress per destination from a PAC file, evaluated by a purpose-built restricted interpreter; --pac-test checks one URL
• --proxy-auth-scheme negotiate: Kerberos/SPNEGO to the upstream proxy; --krb5-hosts for intranet sites that use Kerberos
• --proxy-testingbot: a separate proxy for reaching TestingBot itself
• --cacert-file: trust an extra CA, for TLS-intercepting proxies
• SOCKS5 upstream proxies, --connect-to, --ws-proxy-mode, multi-server --dns, --http-dial-timeout / --http-idle-timeout

Security

• --ssh-host-key / --ssh-host-key-policy require: pin the tunnel server's SSH host key
• Upstream proxy credentials are only ever sent to the proxy they were issued for
• Credentials and credential-shaped query values are redacted from logs

Operations and observability

• /healthz and /readyz on the metrics port, and --ready for health checks; the Docker image has a HEALTHCHECK
• --log-http per module (proxy:, forwarder:), --log-format json, request-id correlation
• --config file, and a TESTINGBOT_* environment alias for every option
• --header / --response-header to edit headers on plain HTTP; --nobump-domains

... (truncated)

Changelog

Sourced from com.testingbot:TestingBotTunnel's changelog.

5.0

Breaking changes from 4.x

• Requires Java 17 (was 11). The tunnel checks the runtime version itself and reports it plainly instead of failing as "A JNI error has occurred"
• Local listeners bind 127.0.0.1 instead of every interface: the Selenium relay (--se-port), the local proxy (--localproxy), the insight endpoints (--metrics-port) and --web. None of them authenticates, and the relay attaches the account key and secret to everything it forwards. Use --bind-address 0.0.0.0 to accept connections from other machines
• The Docker image sets TESTINGBOT_BIND_ADDRESS=0.0.0.0, because a loopback bind inside a container makes published ports unreachable; narrow it on the host side of the publish instead
• Successful requests no longer produce a log line. --log-http defaults to errors; --log-http url restores a line per request
• The Selenium relay honours --log-http too, where it previously logged every request unconditionally
• Built on Jetty 12's core Handler API with no Servlet layer, which changes the internals for anyone embedding the jar

Restricting what the tunnel can reach

• --allow-hosts: name what the tunnel is for and refuse everything else, the inverse of --fast-fail-regexps. Supports *.suffix for subdomains
• --fast-fail-regexps entries may be prefixed with ! to make an exception, so .*,!ok\.com refuses everything but ok.com and its subdomains. An exception must cover a whole host, so it cannot be satisfied by a name that merely ends with one
• --localhost-policy deny: refuse tunnel traffic reaching this machine's loopback. Enforced on the address actually dialled, not only on the name, so a rebinding answer cannot walk past it
• All three are enforced on every way out: plain HTTP, CONNECT and WebSocket upgrades

Egress and upstream proxies

• --pac-local: choose egress per destination from a proxy auto-config file, evaluated by a restricted interpreter written for this purpose -- no JavaScript engine is embedded, and unsupported syntax is refused with its line number rather than approximated. --pac-test evaluates one URL and exits
• --pac-local-sha256: pin the PAC document. A plain http:// PAC URL is refused unless pinned, since its contents decide where traffic and proxy credentials go; redirects are refused rather than followed
• --proxy-auth-scheme negotiate with --proxy-spn, --krb5-keytab and --krb5-principal: SPNEGO/Kerberos to the upstream proxy, on all three egress paths
• --krb5-hosts: send SPNEGO to named origins as well, for intranet sites that authenticate with Kerberos. An allowlist, never wildcarded
• --proxy-testingbot and --proxy-testingbot-userpwd: a separate proxy for reaching TestingBot itself. Credentials are not inherited from --proxy-userpwd, and are never sent to a proxy they were not issued for -- including one named by a PAC file
• --cacert-file: trust an additional certificate authority, for networks where a proxy intercepts TLS
• --ws-proxy-mode: how a ws:// upgrade traverses --proxy, connect (default, per RFC 6455) or get
• --connect-to: dial one host:port for requests naming another, leaving the URL, Host header and TLS SNI untouched
• --dns-timeout, --dns-round-robin: per-server timeout and round-robin across the --dns list
• --http-dial-timeout, --http-idle-timeout. The dial timeout also bounds the SSH control connection, which previously had none: a peer that accepted the socket and sent no banner blocked startup and every reconnect
• Upstream proxy credentials are scoped to the whole configured endpoint -- protocol, host and port. CONNECT and WebSocket upgrades compared only the hostname, so a PAC file naming 127.0.0.1 on any other port was sent --proxy-userpwd or the SOCKS5 credentials
• A PAC file is evaluated with the URL the request actually uses, so a rule written on a path is followed by traffic and not only by --pac-test. CONNECT still uses a synthetic https://host:port/, since it carries no path
• A proxy named only by a PAC file receives absolute-form request targets, and a PAC DIRECT answer sends origin-form even when --proxy is configured
• The API client authenticates to the upstream proxy with Negotiate when --proxy-auth-scheme negotiate is set. It only ever sent username and password, so on a proxy requiring Kerberos the tunnel could not register at all

Observability

• --log-http: per-request logging at none, url, headers or errors, settable per module (proxy:, forwarder:). forwarder:body logs the Selenium relay's request body with credentials redacted by key
• --log-format json: one object per record, so a collector need not guess where a stack trace ends
• --request-id-header: correlation id on every request, reusing an incoming value
• /healthz and /readyz on the metrics port, and --ready to query a running tunnel and exit 0 or 1
• --doctor diagnoses the configuration it was actually given, including the whole Kerberos chain and any --cacert-file subjects

Embedding the tunnel in another application

• App.awaitReady(Duration) and App.getSetupFailure(): boot() returns once the tunnel is created, which is not the same as it being able to carry traffic, and a caller had nothing to wait on but its own polling loop
• Readiness is per tunnel: two tunnels in one JVM each answer for themselves on their own metrics port, where /readyz previously answered from a process-wide gauge for whichever wrote last -- and stopping one reported the other as down
• stop() restores the JVM's default Authenticator and forgets the SOCKS credentials it registered, so a stopped tunnel's proxy password is no longer offered for the rest of the process's life, and a tunnel per job no longer stacks one authenticator per job
• The startup self-test asks the API it was configured with rather than naming api.testingbot.com literally, so an embedder pointing at another endpoint is not failed by its own diagnostic
• The new-version notice is logged rather than written to the host application's stderr

Other

• --config: read options from a file. Every long option also has a TESTINGBOT_* environment alias derived from its name; precedence is command line, then config file, then environment
• --header and --response-header: add, replace or remove headers on plain HTTP
• --nobump-domains: disable SSL bumping for named hosts only

... (truncated)

Commits

• 70287b7 Bump the minor-and-patch group with 9 updates (#57)
• ec3dc15 Bump the minor-and-patch group across 1 directory with 7 updates (#56)
• d27775f Bump actions/setup-java from 4.8.0 to 6.0.1 (#55)
• f7c7766 Bump softprops/action-gh-release from 3.0.2 to 3.0.3 (#53)
• 0f76beb Bump actions/checkout from 4.3.1 to 7.0.1 (#52)
• 47384c4 Bump actions/setup-java from 4 to 6 (#41)
• 1141508 Bump actions/checkout from 4 to 7 (#42)
• 61f4360 Bump the minor-and-patch group across 1 directory with 4 updates (#46)
• bb9ff3e Fix the project review's nine findings, and make embedded mode work (#49)
• 1ca57c0 Wait for conditions in tests instead of sleeping for a guess
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)