v0.7.1: embedded dashboard rebuilt with connection-management UI

v0.7.0

Added: unified connection management across WebSocket/SSE/MQTT/gRPC (admin + CLI APIs, dashboard view, auto-disconnect on mock update); workspace-scoped stateful resources + --workspace flag.

Fixed: gRPC multiple mocks per RPC via match variants (#30); GraphQL __typename on nested objects (#32); proxy origin-form 502 self-loop (#35); gRPC stream cancellation liveness (DELETE /grpc/connections now returns codes.Unavailable); SSE active-connections gauge leak.

Changed: install.sh fails loudly on bad release assets (#34).

v0.6.6

Security:
- Admin API: fix cross-origin localhost takeover (localhost auth bypass trusted any loopback request incl. browser fetch; admin CORS echoed *). Bypass now refuses cross-site/foreign-origin browser requests + validates Host (anti-DNS-rebinding); CORS allows loopback origins only.
- Admin API: /openapi.json and /insomnia.json now require the API key (were exempted by the .json static-asset rule).
- Bump Go build/CI to 1.26.4 and golang.org/x/net to v0.55.0 for stdlib/library advisories.

Merge pull request #15 from getmockd/fix/docker-embed-dashboard

fix: embed dashboard UI in Docker image

feat: AllowLocalhost default true, exempt dashboard assets from auth

- Default AllowLocalhost to true — dashboard works on localhost without
  --no-auth. Standard dev tool behavior (WireMock, Prometheus, Grafana).
- Exempt dashboard static assets (.js, .css, .html, etc.) from auth so
  the SPA and API key prompt can load even for remote access.
- Update test to explicitly disable localhost bypass.

chore: trigger v0.6.3 release

v0.6.2: Fix 6 security vulnerabilities, rewrite README

- google.golang.org/grpc v1.78.0 → v1.79.3 (critical CVE)
- h3, flatted, devalue updated in docs (5 npm vulns)
- README rewritten for launch: digital twin showcase, MCP section,
  tighter structure with collapsible features

v0.6.1: Fix --stateful flag, JSON schema workspaces, lint fixes

- fix(cli): --stateful with --path now generates table + 5 CRUD mocks
  with statefulBinding (list, create, get, update, delete). Without
  --path, creates bridge-only table as before.
- feat(schema): add workspaces section to JSON schema
- fix: resolve all CI lint issues (race, bodyclose, dupl, unused code)
- fix(ci): update smoke test for tables+extend CRUD flow

v0.6.0: Stateful tables + extend, workspace scoping, digital twins

v0.5.1 — Security patch: Go 1.26.1 (5 CVE fixes), mTLS VerifyConnecti…

…on fix, lint cleanup