Features

• Per-attempt delivery latency: each attempt now records latency_ms, the time the destination took to respond or fail. GET /metrics/attempts adds avg_latency, p50_latency, p95_latency and p99_latency measures, which work with the existing dimensions, filters and granularity. Includes a ClickHouse and a Postgres migration that each add one nullable column. Attempts recorded before the upgrade return null. by @kunwar-axilio in #1079
• PUBLISH_PROXY_URL routes the RabbitMQ publish queue connection through an HTTP CONNECT proxy chain, so a broker that allowlists source IPs sees the proxy's address. It uses the same format as DESTINATIONS_WEBHOOK_PROXY_URL. TLS (amqps) runs end to end through the tunnel. by @alexluong in #1086

Fixes

• RabbitMQ consumers now reconnect after the connection drops, for example on a broker restart or a proxy restart. Previously the worker stopped after about 1 minute of receive errors. by @alexluong in #1087

New Contributors

• @kunwar-axilio made their first contribution in #1079

Full Changelog: v1.4.1...v1.5.0

Fixes

• Webhook templates (signature content and header, signing secret, compat headers) now have an explicit set of Sprig functions: join, upper, lower, trim, trimPrefix, trimSuffix, replace, b64enc, default. Go's built-in template functions (index, slice, printf, …) are unchanged. A template that uses a function outside this set fails to parse at startup. See custom signature templates. By @alexluong in #1077

Full Changelog: v1.4.0...v1.4.1

Features

• Compat signature for changing signature schemes. Webhook deliveries can carry a second signature in your previous format, sent alongside the primary one. Consumers can then move to the new scheme on their own schedule. Configure it with DESTINATIONS_WEBHOOK_COMPAT_*; nothing changes unless DESTINATIONS_WEBHOOK_COMPAT_SIGNATURE_HEADER_NAME is set. The primary signature also gains secret key decoding (DESTINATIONS_WEBHOOK_SIGNATURE_SECRET_ENCODING / _PREFIX). See the change webhook signature scheme guide. By @alexluong in #1069
• Redis TLS certificate verification. Set REDIS_TLS_VERIFY=true to verify the Redis server's certificate. For self-signed certificates, use SSL_CERT_FILE / SSL_CERT_DIR. The default is unchanged. By @hogklint in #1071

Refactors

• Standard Webhooks mode now runs on the default webhook provider. Standard mode is now a set of config values applied to the default webhook provider, and the duplicate provider is removed. Headers, signatures, secret generation and portal instructions are unchanged, and the compat signature now works in standard mode. New option DESTINATIONS_WEBHOOK_TIMESTAMP_FORMAT (rfc3339 or unix); the default mode keeps its current format. Standard mode now logs a startup warning for each set option it ignores. Standard-mode edge cases that changed:

  • Event metadata is sent only as prefixed headers (webhook-<key>). It was also sent as bare header names.
  • A user-supplied secret no longer needs the whsec_ prefix; a bare base64 secret is accepted, as with the official SDKs. A secret that doesn't decode now fails validation as invalid (was pattern).

  By @alexluong in #1072

Fixes

• GCP Pub/Sub subscriptions no longer expire. The dead-letter subscription has no consumer, so Pub/Sub deleted it after 31 days and dead-lettered messages were dropped until the next startup recreated it. By @alexluong in #1066
• Deployments sharing a Redis instance no longer contend on one infrastructure lock at startup. The lock key is now scoped by DEPLOYMENT_ID. Before, several deployments starting together could fail with failed to acquire lock after 5 attempts. By @alexluong in #1065
• Operator events you don't subscribe to no longer touch Redis suppression state. This prevents spurious opevent delivery failed errors and redelivered log messages. By @samadalishah in #1050
• Concurrent retry exhaustions on one destination no longer stall log processing waiting on the alert.attempt.exhausted_retries suppression window. Before, this caused context deadline exceeded nacks. By @alexluong in #1063
• TOPICS_ALLOW_WILDCARDS now applies to delivery matching as well as validation. When it's disabled, stored wildcard patterns are ignored without being deleted, so re-enabling the flag restores them. * still means all topics. By @Abdulmumin1 in #1051
• The portal shows empty metrics for destinations with no deliveries instead of an endless loading skeleton. By @alexbouchardd in #1070, #1073

New Contributors

• @samadalishah made their first contribution in #1050
• @hogklint made their first contribution in #1071

Full Changelog: v1.3.0...v1.4.0

Features

• Chain multiple forward proxies for webhook delivery: DESTINATIONS_WEBHOOK_PROXY_URL now accepts a whitespace-separated list of proxies, and Outpost tunnels through each in order with HTTP CONNECT by @alexluong in #1060
• Optional pprof profiling endpoints on the service HTTP port via PPROF_ENABLED / pprof_enabled (default off, unauthenticated, works for every service type) by @alexluong in #1056
• Configurable Redis connection pool size via REDIS_POOL_SIZE / redis.pool_size. Unset keeps go-redis's default of 10 × GOMAXPROCS; in cluster mode the value applies per node by @alexluong in #1055

Fixes

• CLICKHOUSE_LOG_RETENTION_TTL_DAYS no longer crash-loops on ClickHouse versions before 25.7; the TTL expression now wraps the timestamp in toDateTime and existing tables are re-altered on next boot by @alexluong in #1044
• SIGTERM now reaches the server process: the container entrypoint execs outpost-server instead of spawning it as a child, so graceful shutdown works under Docker and Kubernetes by @alexluong in #1048

Updates

• Go 1.27.1 by @alexluong in #1061
• Released images are now signed with Sigstore/cosign and ship with SBOM and provenance attestations by @alexluong in #1046
• Release workflow pins GoReleaser and migrates off deprecated config by @alexluong in #1045
• New docs page on event and delivery log storage and retention, including CLICKHOUSE_LOG_RETENTION_TTL_DAYS by @alexluong in #1032
• Dropped the unused aws-sdk-go v1 dependency and gin's msgpack binding, reducing binary size and memory footprint by @alexluong in #1047, #1049
• Stabilized ClickHouse dedup tests and added a fail-fast timeout for a rare batcher shutdown deadlock in logmq tests by @alexluong in #1042, #1043

Full Changelog: v1.2.0...v1.3.0

Note: This release includes a new PostgreSQL migration and one behavior change (RETRY_POLL_BACKOFF_MS). Run outpost migrate apply --yes before starting v1.2, and review the v1.2 Upgrade Guide.

Features

• Custom dead-letter queue names for auto-provisioned SQS, RabbitMQ, and GCP Pub/Sub queues, so DLQs can follow your own naming convention instead of the derived default — this also unblocks BYO-queue deployments whose DLQs don't match the derived name by @ambroziepaval in #1033
• New outpost config list command, printing the effective configuration after defaults, YAML, and environment variables are resolved, with the same masking as the startup log. It skips validation, so it still works when a required field is missing by @zahradm in #1038

Performance

• The retry monitor now sleeps until the next retry actually comes due instead of polling Redis on a fixed interval, cutting idle Redis traffic from ~129.6M to ~86.4K commands per month per monitor. RETRY_POLL_BACKOFF_MS is redefined as a maximum idle sleep with a new default of 0 (auto) by @alexluong in #1026
• Each provider now shares one HTTP client with a sized connection pool. Outpost previously built a client per destination, each with Go's default of two idle connections, so connection reuse collapsed above two concurrent deliveries to the same destination by @alexluong in #1021

Fixes

• Invalid webhook signature templates now fail at startup and name the offending template. A malformed template previously passed startup and panicked the delivery worker on every event, including after restart by @alexluong in #1025
• OpenTelemetry exporter and protocol resolve per signal. All three signals previously read the same OTEL_EXPORTER/OTEL_PROTOCOL pair, so enabling one signal enabled the other two against localhost:4317. The spec's OTEL_EXPORTER_OTLP_*_PROTOCOL variables are now honored by @alexluong in #1019
• Stale deliveries_pkey and deliveries_default_pkey indexes renamed to attempts_* (migration 000010). Metadata-only, no table rewrite or downtime by @alexluong in #1031
• Creating a destination past MAX_DESTINATIONS_PER_TENANT returns 400 Bad Request instead of 500 by @alexluong in #1010
• CLI errors are printed before exiting non-zero. Every outpost failure previously exited 1 with nothing on stderr, which made outpost migrate failures indistinguishable from one another by @alexluong in #1034

Updates

• Go 1.26.5 and a dependency refresh, addressing the CVEs in #1012 — including x/text norm.Iter (GO-2026-5970), reachable through webhook delivery, pgx, and Kafka SCRAM — plus GO-2026-6061 in grpc xDS by @alexluong in #1030
• Docker base image upgraded from distroless/base-debian12 to debian13, as debian12 has reached security end of life by @8BitJonny in #1036
• RETRY_POLL_BACKOFF_MS documented in the configuration reference and its resolved value logged at startup by @alexluong in #1040
• Signature header template documentation no longer carries inline shell/JSON escaping, which broke .env, Compose, and YAML users; content and header template fields merged into one table by @alexluong in #1024
• configdocsgen retired — it wrote to a docs path that no longer exists after the Markdoc migration by @alexluong in #1035, #1037

Small Fixes & QoL

• Flaky and unrunnable test suites fixed: shared config map in parallel S3 subtests, at-least-once redelivery assumptions in the Kinesis consumer, and others by @alexluong in #1029

New Contributors

• @8BitJonny made their first contribution in #1036
• @zahradm made their first contribution in #1038

Full Changelog: v1.1.0...v1.2.0

Note: No breaking changes and no new migrations in this release. Review the Upgrade to v1.1 guide for behavior changes and deprecations before upgrading.

Features

• Configurable webhook system header names: pin the exact name of each system header (DESTINATIONS_WEBHOOK_EVENT_ID_HEADER_NAME, _TIMESTAMP_, _TOPIC_, _SIGNATURE_) or set to an empty string to disable it. Deprecates the DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_*_HEADER flags by @ambroziepaval in #992
• IAM role authentication for AWS SQS: AWS_SQS_ACCESS_KEY_ID and AWS_SQS_SECRET_ACCESS_KEY are now optional; when omitted, Outpost uses the AWS SDK default credential chain (EKS Pod Identity, IRSA, instance profiles) by @ambroziepaval in #996
• New attempt.success and attempt.failed operator events, emitted once per delivery attempt. If you subscribe with OPERATION_EVENTS_TOPICS=*, note these fire at full delivery throughput — see the upgrade guide before upgrading by @alexluong in #989
• Delivery retry tasks that repeatedly fail to process now back off exponentially and dead-letter to deliverymq-retry-dlq after 5 receives instead of retrying forever. Tasks stuck in a retry loop before the upgrade drain into the DLQ shortly after upgrading — that's expected and surfaces previously invisible failures by @LendritIbrahimi in #997
• Stored response body size cap: destination response bodies larger than DESTINATIONS_WEBHOOK_MAX_RESPONSE_BODY_BYTES (default 128 KiB) are replaced with a placeholder so oversized attempt logs can't exceed queue message limits; set 0 to disable by @alexluong in #975
• Faster log processing: alert evaluation and operator event delivery now run in parallel per destination by @alexluong in #987

Fixes

• RabbitMQ connections redial automatically after a drop instead of wedging publishing until restart; during a broker outage, publishes fail fast with a 5-second redial cooldown by @LendritIbrahimi in #999
• exhausted_retries alerts are now suppressed per destination instead of per event, so a high-volume failing destination no longer floods your alert sink by @alexluong in #995
• Destination topics are normalized on write, so equivalent topic lists compare consistently by @mvanhorn in #994

New Contributors

• @ambroziepaval made their first contribution in #992
• @LendritIbrahimi made their first contribution in #999

Full Changelog: v1.0.7...v1.1.0

Features

• Wildcard topic subscriptions: destinations can now subscribe to topic patterns like user.*, *.created, or order.*.completed in addition to exact topics and the existing catch-all * by @Abdulmumin1 in #912

Fixes

• Alert tracking keys are now tenant-scoped, preventing two tenants that use the same destination ID from corrupting each other's consecutive-failure counts and auto-disable behavior by @mvanhorn in #967
• Events published without metadata are normalized to an empty map, fixing a Postgres log store insert failure (and a Postgres/ClickHouse read inconsistency) introduced by the pgx upgrade by @alexluong in #973

Updates

• Updated Go dependencies and toolchain (1.26.4) to patch known CVEs by @alexluong in #940, #983
• Webhook proxy docs moved to the self-hosting section and trimmed to operator scope by @alexluong in #906
• Cleaned up an unused package alias in the SDK test suite by @alexluong in #971

New Contributors

• @Abdulmumin1 made their first contribution in #912

Full Changelog: v1.0.6...v1.0.7

What's Changed

• Alert dimensions now support default/disable semantics via a single config key — leave it unset for the built-in default, set an empty string to disable, or set a value to override the threshold. Applies to ALERT_CONSECUTIVE_FAILURE_COUNT and ALERT_EXHAUSTED_RETRIES_WINDOW_SECONDS by @alexluong in #964

Full Changelog: v1.0.5...v1.0.6

Fixes

• Webhook secret rotation now correctly defaults the previous-secret invalidation window to 24h on every rotation, not just the first — previously later rotations carried forward a stale (often already-expired) timestamp, stripping the previous secret from API responses by @alexluong in #951
• Duplicate log messages are now handled idempotently — at-least-once duplicates in the same batch no longer fail the whole batch or re-run alert evaluation per copy by @alexluong in #953
• Per-event format errors (e.g. an aws_s3 key_template referencing a missing field) are now recorded as normal failed deliveries that retry and surface to the customer, instead of being silently dead-lettered and paging on-call by @alexluong in #957
• OpenAPI spec ManagedConfig now accurately reflects the supported configs by @alexbouchardd in #943
• Fixed portal font loading by @alexbouchardd in #944

Updates

• Clarified signature behavior in the docs by @alexbouchardd in #945
• Overhauled the local dev stack: unified into a single Compose project with opt-in dependency/add-on flags, added make health/make smoke, and repaired make up/test by @alexluong in #930, #952
• Aligned the docs-eval scenario with the TS SDK publish() shape and surfaced failing checks in CI logs by @leggetter in #950

Full Changelog: v1.0.4...v1.0.5