v0.16.0
Warning: This release contains significant breaking changes. Please review the v0.16 Migration Guide before upgrading.
⚠️ Breaking Changes
- Webhook signing secret prefix changed to
whsec_— New webhook destinations now generate secrets prefixed withwhsec_. SetDESTINATIONS_WEBHOOK_SIGNING_SECRET_TEMPLATE={{.RandomHex}}to preserve previous behavior. Existing destinations are unaffected. by @alexluong in #808, #792 - Event
destination_idreplaced withmatched_destination_ids— Events now return an array of matched destination IDs instead of a singledestination_id. Supports filtering viaGET /events?destination_id=. No backfill for existing events. by @alexluong in #801 - Delivery metadata timestamp switched from Unix to ISO 8601 — The
timestampfield in delivery metadata is now RFC 3339 format instead of Unix seconds. by @alexluong in #803 - Response data body stored as raw string —
response_data.bodyis now always a string, even for JSON responses. Theattempts.response_dataDB column migrated from JSONB to TEXT (migration000009). by @alexluong in #723 - Alert callbacks replaced by operator events —
ALERT_CALLBACK_URLremoved. Migrate toOPERATOR_EVENTS_*config with HTTP, AWS SQS, GCP Pub/Sub, or RabbitMQ sinks. Alert defaults also changed: consecutive failure count 20→100, auto-disable true→false. by @alexluong in #807, #813, #819 ORGANIZATION_NAMEconfig removed — UseHTTP_USER_AGENTdirectly for custom User-Agent strings. by @alexluong in #810
Features
- Apache Kafka destination provider with PLAIN, SCRAM-SHA-256, and SCRAM-SHA-512 SASL auth by @alexluong in #779
- Operator events system — subscribe to delivery failures, destination disabling, retry exhaustion, and subscription changes via HTTP, AWS SQS, GCP Pub/Sub, or RabbitMQ by @alexluong in #807
- Portal: JSON viewer with syntax highlighting, collapsible sections, and copy-to-clipboard by @alexluong in #800
- Portal: URL-based routing for create destination steps (browser back/forward works between steps) by @alexluong in #793
destination_typeadded to attempts table, API responses, and metrics (with filtering support) by @alexluong in #805- Configurable webhook signing secret template with
RandomHex,RandomBase64, andRandomAlphanumericvariables by @alexluong in #792 - Support empty webhook header prefix (set to whitespace to disable prefix) by @alexluong in #797
Refactors
- Idempotent AlertStore using Redis Sets (keyed by attemptID) instead of INCR/GET, making replayed messages safe by @alexluong in #804
- Eliminated hidden webhook defaults — config owns all defaults explicitly by @alexluong in #808
Fixes
- Manual retries now derive
attempt_numberfrom logstore instead of hardcoding 0 by @alexluong in #781 - Redis control plane keys scoped by deployment ID, preventing cross-deployment conflicts by @alexluong in #742
DELETE /destinationsnow returns{ "success": true }matching other delete endpoints by @alexluong in #798- Added missing
keyproperty toDestinationSchemaFieldin OpenAPI spec by @alexluong in #812
Updates
- Webhook signature verification docs updated and migrated to official SDK by @leggetter in #806
- Docs/examples: webhook defaults, SDK Node.js demo, API path fixes by @leggetter in #802
Full Changelog: v0.15.0...v0.16.0