github.com/hookdeck/outpost

Note: This release includes a new PostgreSQL migration and one behavior change (RETRY_POLL_BACKOFF_MS). Run outpost migrate apply --yes before starting v1.2, and review the v1.2 Upgrade Guide.

Features

• Custom dead-letter queue names for auto-provisioned SQS, RabbitMQ, and GCP Pub/Sub queues, so DLQs can follow your own naming convention instead of the derived default — this also unblocks BYO-queue deployments whose DLQs don't match the derived name by @ambroziepaval in #1033
• New outpost config list command, printing the effective configuration after defaults, YAML, and environment variables are resolved, with the same masking as the startup log. It skips validation, so it still works when a required field is missing by @zahradm in #1038

Performance

• The retry monitor now sleeps until the next retry actually comes due instead of polling Redis on a fixed interval, cutting idle Redis traffic from ~129.6M to ~86.4K commands per month per monitor. RETRY_POLL_BACKOFF_MS is redefined as a maximum idle sleep with a new default of 0 (auto) by @alexluong in #1026
• Each provider now shares one HTTP client with a sized connection pool. Outpost previously built a client per destination, each with Go's default of two idle connections, so connection reuse collapsed above two concurrent deliveries to the same destination by @alexluong in #1021

Fixes

• Invalid webhook signature templates now fail at startup and name the offending template. A malformed template previously passed startup and panicked the delivery worker on every event, including after restart by @alexluong in #1025
• OpenTelemetry exporter and protocol resolve per signal. All three signals previously read the same OTEL_EXPORTER/OTEL_PROTOCOL pair, so enabling one signal enabled the other two against localhost:4317. The spec's OTEL_EXPORTER_OTLP_*_PROTOCOL variables are now honored by @alexluong in #1019
• Stale deliveries_pkey and deliveries_default_pkey indexes renamed to attempts_* (migration 000010). Metadata-only, no table rewrite or downtime by @alexluong in #1031
• Creating a destination past MAX_DESTINATIONS_PER_TENANT returns 400 Bad Request instead of 500 by @alexluong in #1010
• CLI errors are printed before exiting non-zero. Every outpost failure previously exited 1 with nothing on stderr, which made outpost migrate failures indistinguishable from one another by @alexluong in #1034

Updates

• Go 1.26.5 and a dependency refresh, addressing the CVEs in #1012 — including x/text norm.Iter (GO-2026-5970), reachable through webhook delivery, pgx, and Kafka SCRAM — plus GO-2026-6061 in grpc xDS by @alexluong in #1030
• Docker base image upgraded from distroless/base-debian12 to debian13, as debian12 has reached security end of life by @8BitJonny in #1036
• RETRY_POLL_BACKOFF_MS documented in the configuration reference and its resolved value logged at startup by @alexluong in #1040
• Signature header template documentation no longer carries inline shell/JSON escaping, which broke .env, Compose, and YAML users; content and header template fields merged into one table by @alexluong in #1024
• configdocsgen retired — it wrote to a docs path that no longer exists after the Markdoc migration by @alexluong in #1035, #1037

Small Fixes & QoL

• Flaky and unrunnable test suites fixed: shared config map in parallel S3 subtests, at-least-once redelivery assumptions in the Kinesis consumer, and others by @alexluong in #1029

New Contributors

• @8BitJonny made their first contribution in #1036
• @zahradm made their first contribution in #1038

Full Changelog: v1.1.0...v1.2.0

Note: No breaking changes and no new migrations in this release. Review the Upgrade to v1.1 guide for behavior changes and deprecations before upgrading.

Features

• Configurable webhook system header names: pin the exact name of each system header (DESTINATIONS_WEBHOOK_EVENT_ID_HEADER_NAME, _TIMESTAMP_, _TOPIC_, _SIGNATURE_) or set to an empty string to disable it. Deprecates the DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_*_HEADER flags by @ambroziepaval in #992
• IAM role authentication for AWS SQS: AWS_SQS_ACCESS_KEY_ID and AWS_SQS_SECRET_ACCESS_KEY are now optional; when omitted, Outpost uses the AWS SDK default credential chain (EKS Pod Identity, IRSA, instance profiles) by @ambroziepaval in #996
• New attempt.success and attempt.failed operator events, emitted once per delivery attempt. If you subscribe with OPERATION_EVENTS_TOPICS=*, note these fire at full delivery throughput — see the upgrade guide before upgrading by @alexluong in #989
• Delivery retry tasks that repeatedly fail to process now back off exponentially and dead-letter to deliverymq-retry-dlq after 5 receives instead of retrying forever. Tasks stuck in a retry loop before the upgrade drain into the DLQ shortly after upgrading — that's expected and surfaces previously invisible failures by @LendritIbrahimi in #997
• Stored response body size cap: destination response bodies larger than DESTINATIONS_WEBHOOK_MAX_RESPONSE_BODY_BYTES (default 128 KiB) are replaced with a placeholder so oversized attempt logs can't exceed queue message limits; set 0 to disable by @alexluong in #975
• Faster log processing: alert evaluation and operator event delivery now run in parallel per destination by @alexluong in #987

Fixes

• RabbitMQ connections redial automatically after a drop instead of wedging publishing until restart; during a broker outage, publishes fail fast with a 5-second redial cooldown by @LendritIbrahimi in #999
• exhausted_retries alerts are now suppressed per destination instead of per event, so a high-volume failing destination no longer floods your alert sink by @alexluong in #995
• Destination topics are normalized on write, so equivalent topic lists compare consistently by @mvanhorn in #994

New Contributors

• @ambroziepaval made their first contribution in #992
• @LendritIbrahimi made their first contribution in #999

Full Changelog: v1.0.7...v1.1.0

Features

• Wildcard topic subscriptions: destinations can now subscribe to topic patterns like user.*, *.created, or order.*.completed in addition to exact topics and the existing catch-all * by @Abdulmumin1 in #912

Fixes

• Alert tracking keys are now tenant-scoped, preventing two tenants that use the same destination ID from corrupting each other's consecutive-failure counts and auto-disable behavior by @mvanhorn in #967
• Events published without metadata are normalized to an empty map, fixing a Postgres log store insert failure (and a Postgres/ClickHouse read inconsistency) introduced by the pgx upgrade by @alexluong in #973

Updates

• Updated Go dependencies and toolchain (1.26.4) to patch known CVEs by @alexluong in #940, #983
• Webhook proxy docs moved to the self-hosting section and trimmed to operator scope by @alexluong in #906
• Cleaned up an unused package alias in the SDK test suite by @alexluong in #971

New Contributors

• @Abdulmumin1 made their first contribution in #912

Full Changelog: v1.0.6...v1.0.7

What's Changed

• Alert dimensions now support default/disable semantics via a single config key — leave it unset for the built-in default, set an empty string to disable, or set a value to override the threshold. Applies to ALERT_CONSECUTIVE_FAILURE_COUNT and ALERT_EXHAUSTED_RETRIES_WINDOW_SECONDS by @alexluong in #964

Full Changelog: v1.0.5...v1.0.6

Fixes

• Webhook secret rotation now correctly defaults the previous-secret invalidation window to 24h on every rotation, not just the first — previously later rotations carried forward a stale (often already-expired) timestamp, stripping the previous secret from API responses by @alexluong in #951
• Duplicate log messages are now handled idempotently — at-least-once duplicates in the same batch no longer fail the whole batch or re-run alert evaluation per copy by @alexluong in #953
• Per-event format errors (e.g. an aws_s3 key_template referencing a missing field) are now recorded as normal failed deliveries that retry and surface to the customer, instead of being silently dead-lettered and paging on-call by @alexluong in #957
• OpenAPI spec ManagedConfig now accurately reflects the supported configs by @alexbouchardd in #943
• Fixed portal font loading by @alexbouchardd in #944

Updates

• Clarified signature behavior in the docs by @alexbouchardd in #945
• Overhauled the local dev stack: unified into a single Compose project with opt-in dependency/add-on flags, added make health/make smoke, and repaired make up/test by @alexluong in #930, #952
• Aligned the docs-eval scenario with the TS SDK publish() shape and surfaced failing checks in CI logs by @leggetter in #950

Full Changelog: v1.0.4...v1.0.5