v1.7.0

⚠️ Breaking Changes

See the v1.7 Upgrade Guide for details.

• Third-party OpenTelemetry instrumentation is off by default. With OpenTelemetry enabled, Redis command spans and the message queue clients' spans and metrics are no longer exported; set OTEL_ENABLED_INSTRUMENTATIONS=redis,mq to keep them. GCP Pub/Sub destination gRPC telemetry is no longer exported and can't be turned back on. Outpost's own metrics, spans and audit logs are unchanged. by @alexluong in #1146

Features

• Faster, lighter retries, especially on the ClickHouse log store: attempt lookups no longer slow down as log retention grows, retries that come due together are capped (RETRY_MAX_CONCURRENCY, default 100) and spread out, and RETRY_LOOKUP_BATCH_SIZE optionally combines their lookups into one query. by @alexluong in #1152, #1153, #1155, #1158
• ClickHouse connection settings: CLICKHOUSE_MAX_OPEN_CONNS, CLICKHOUSE_DIAL_TIMEOUT_SECONDS and CLICKHOUSE_READ_TIMEOUT_SECONDS. Defaults are unchanged. by @alexluong in #1153
• iso8601_milli_no_offset value for DESTINATIONS_WEBHOOK_TIMESTAMP_FORMAT: UTC with milliseconds and no offset (2026-10-05T15:02:25.447), for receivers that parse the header with Python's datetime.fromisoformat. by @alexbouchardd in #1131

Fixes

• Fixed race conditions that could drop a retry or dead-letter it early: when it was rescheduled while still running, or when it ran before its failed attempt reached the log store. Retry delays shorter than LOG_BATCH_THRESHOLD_SECONDS (default 10 s) are now raised to it. by @alexluong in #1151, #1154, #1157
• Redis queues, including the retry scheduler, recover after Redis or Dragonfly restarts and empties its script cache. Before, they failed with NOSCRIPT until Outpost restarted. by @alexluong in #1156
• A failed delivery whose attempt log fails to publish is redelivered instead of acked, so its attempt record and retry are not lost. by @theluckystrike in #1134
• Tenant upsert and destination create and update requests with a body over 10 KB are accepted; before, they answered 422 invalid JSON. Request bodies other than publish are capped at 1 MiB and answered 413 above it. by @alexluong in #1119
• PUT /tenants/:id sent with Transfer-Encoding: chunked reads its body. Before, the metadata was ignored, or cleared on an existing tenant. by @alexluong in #1121
• A NUL byte or invalid UTF-8 in a path or query parameter or a cursor returns 400 instead of a 500 from PostgreSQL. by @Mohil-Ahuja in #1143
• Credentials in the 5xx request log are redacted whatever the key's case, and a body that isn't a JSON object is logged as its size only. by @alexluong in #1120
• Tenant JWTs are checked against the deployment they're sent to: a token whose deployment_id claim differs from DEPLOYMENT_ID gets 401. Tokens issued by Outpost keep working, as do tokens without the claim. by @alexluong in #1118

Updates

• Go 1.27.2 and golang.org/x/net and x/text bumps for security fixes by @chiliec in #1148
• The ManagedConfig OpenAPI schema allows null values, so SDKs generated from this release parse GET /config on managed Outpost by @leggetter in #1133
• DESTINATIONS_PROXY_URL added to the ManagedConfig OpenAPI schema, with DESTINATIONS_WEBHOOK_PROXY_URL marked deprecated by @alexluong in #1101
• v1.7 upgrade guide by @alexluong in #1159
• Docs: self-hosting data model page, operator events for managed vs self-hosted, supervisor workers list by @alexbouchardd in #1130, #1132, #1137; retry timing and the LOG_BATCH_SIZE and LOG_BATCH_THRESHOLD_SECONDS config rows by @alexluong in #1157; removed the guides redirect by @leggetter in #1136
• Lighter local dev stack by @alexluong in #1129

New Contributors

• @theluckystrike made their first contribution in #1134
• @Mohil-Ahuja made their first contribution in #1143

Full Changelog: v1.6.0...v1.7.0