Release v19.100.0

Summary

Webhook delivery is safer and more predictable. A slow receiver no longer gets the same events delivered several times at once, webhook targets are checked against an address and host policy, and deactivated webhooks stay deactivated after a restart.

Added

• Webhook target validation, configured under Webhooks:
  • Validation chooses the mode. Warn, the default, logs a violation and still delivers. Enforce rejects the registration and blocks the connection. Enforce will become the default in the next major release (see #5151).
  • The rules: HTTPS only, no private, loopback, link-local, multicast or unspecified addresses (checked again when connecting, so DNS rebinding cannot get around it), and a host allow-list. AllowedHosts sets the list for all event stores, and EventStoreAllowedHosts replaces it for one event store. Entries are exact hosts or *.example.com.
  • The same rules apply to the OAuth authority and its token endpoint. (part of #5107)
• Webhooks:AllowInsecureHttp allows plain HTTP to local and Docker host receivers, but only when the kernel runs in Development. (part of #5107)

Changed

• In every mode, webhook and OAuth requests no longer follow redirects, cloud metadata addresses (169.254.169.254, fd00:ec2::254) are never contacted unless allow-listed, and registration errors no longer include the receiver's response body. (part of #5107)

Fixed

• A webhook delivery that runs longer than the observer's subscriber timeout is now cancelled, and the retry for that partition starts only after the abandoned request has finished. Before, a slow receiver could get the same events several times, some of them concurrently. (part of #5014)
• Deactivated webhooks no longer come back as active when read from MongoDB or SQL storage. (#4581)