This release introduces highly requested capabilities, including Redis Streams integration for multi-replica scaling and client resume, native YAML configuration support, and configurable logging with transient target retries. Additionally, this version addresses security concerns by introducing shell-quoting validation to replay scripts and clarifying secure proxy trust requirements.

Features

• Redis Streams support: Added --redis-url and GOSMEE_REDIS_URL server options to enable durable, stream-backed webhook delivery across multi-replica deployments. Clients can now durably resume stream consumption using --resume-state-file.
• YAML configuration files: Supported loading configurations from platform-specific paths or custom locations using the --config / -F flag (or GOSMEE_CONFIG). Features a hierarchical precedence order where CLI arguments override environment variables, which override configuration values.
• Configurable log levels and target retries: Introduced the --log-level flag to specify verbosity (debug, info, warn, error) along with --target-retries to automatically retry transient delivery failures with exponential backoff.
• Durable delivery logs: Enabled client and server components to output correlation diagnostics containing platform delivery IDs, stream IDs, and error attributes.

Bug Fixes

• Fixed release notes generator script to exclude the vendor directory from git log parses and handle unexpected JSON response errors gracefully.

Security

• Shell injection prevention: Implemented strict shell-quoting in generated webhook replay scripts (curl and HTTPie modes) to prevent untrusted payload fields, such as header values and content-types, from executing breakout shell commands.
• Proxy trust safety guidance: Updated security documentation and the Nginx reverse-proxy example to enforce safe IP allowlisting. Warned against the direct exposure of proxy trust headers and shifted default header configurations from $proxy_add_x_forwarded_for to $remote_addr to mitigate IP-spoofing risks.

Performance Improvements

• Connection reuse: Enabled HTTP keep-alive connection reuse on target deliveries by ensuring response bodies are fully drained before closing.

Maintenance

• Configured Dependabot to group GitHub Actions dependency updates into single pull requests to minimize noise.
• Filtered build workflows to trigger only when relevant Go source files, dependencies, the Dockerfile, or workflow definitions are modified.
• Added a dedicated Security section to the automated release notes generator template.
• Updated the Homebrew formula definition for v0.31.1.

Dependencies

• Upgraded github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1.
• Upgraded golang.org/x/text from 0.38.0 to 0.39.0.
• Upgraded golang.org/x/crypto to 0.53.0.
• Upgraded golang.org/x/sys to 0.46.0.
• Bumps in GitHub Actions dependencies:
  • actions/checkout to v7.0.0
  • docker/login-action to v4.4.0
  • docker/metadata-action to v6.2.0