What svix/svix-webhooks shipped

This week: JavaScript client cancels discarded retry response bodies, server worker caps endpoint response reads at 20000 bytes, and Ruby verification raises WebhookVerificationError for signature entries without a value. Also: QuickJs is now the bridge default engine, fixes for

This week in the repository: the JavaScript client now cancels discarded retry response bodies before backing off, so unread bodies no longer hold connections during retries. The server worker reads at most RESPONSE_MAX_SIZE (20000 bytes) of an endpoint response instead of buffering the full response in memory. Ruby verification now raises WebhookVerificationError for svix-signature entries without a value rather than NoMethodError. The bridge default engine changed from Deno to QuickJs, Cargo.lock was updated to fix two RUSTSEC advisories, and the JavaScript package overrides basic-ftp to fix an npm audit finding. The OpenAPI spec and client libraries were regenerated, and the compatibility validation script handles the new nullability format.

Svix Server OSS 1.104.0 is out: event type schemas with external $refs are now rejected, and EndpointOut has an expiry field. Bridge 1.101.1 adds dlq_config to the Redis plugin. PHP webhooks fix fromRaw and reject empty or non-base64 secrets.

This week brought two OSS releases and a set of fixes across the SDKs and bridge. Svix Server OSS 1.104.0 rejects event type schemas that reference external http or file $refs, adds an expiry field to EndpointOut, and raises the MSRV to 1.95.0. Svix Bridge 1.101.1 adds dlq_config to the Redis queue plugin, and the bridge SQS plugin now exposes max_payload_size. The PHP library fixes Webhook::fromRaw and rejects empty or non-base64 secrets, while the Java and Kotlin libraries retry on 423 responses and allow a configurable retry schedule. SDKs and CLI v2.9.1 makes the JavaScript client throw ApiException instead of SyntaxError on a non-JSON 4xx body.

SDKs + CLI v2.9.0 is out: SDKs now retry on timeouts and network errors, Python retries on HTTP 423 and I/O errors, and Java/Kotlin strip trailing slashes from server URLs. Server OSS v1.102.1 drops compromised eMudhra CA certs from the TLS trust store. Bridge v1.101.0 adds an rq

This week we shipped SDKs + CLI v2.9.0. Most SDKs previously retried only on 5xx responses, so timeouts, refused connections and DNS failures failed immediately; they now retry on timeouts and network errors. The Python library also retries on HTTP 423 and I/O errors, and the Java and Kotlin libraries strip trailing slashes from server URLs. Svix Server OSS v1.102.1 removes the compromised eMudhra CA certificates from the TLS trust store, and the Dockerfiles were updated to match. Svix Bridge v1.101.0 adds an rquickjs backend for transformations alongside Deno; it is opt-in via js_engine and faster for most programs, though it does not include some of the node.js APIs Deno supports. Deno will be removed in a future version, so please test your applications against the new backend.

This week: the C# library now sends System.Text.Json payloads as real JSON, the bridge's RabbitMQ plugin accepts consume prefetch count, the server drops the default backend allowlist entry, and rustls was bumped in server, bridge and CLI for security advisories.

This week's changes: the C# library now serializes System.Text.Json values in request bodies as their JSON, fixing payloads that previously went out as a placeholder object. The bridge's RabbitMQ queue plugin now accepts a consume prefetch count setting instead of ignoring it. The server no longer allows sending to the name backend by default, and rustls was bumped in the server, bridge and CLI to address security advisories.

SDKs + CLI v2.8.0 is out. CLI can load a request body from a file with @filename. C# retries now honor cancellation. Also in this week: JavaScript numRetries: 0, Go Application.GetOrCreate, Ruby raw signing keys and the Go v2 module path.

SDKs + CLI v2.8.0 is out. The CLI can now populate a request body from a file with cURL-style @filename syntax. The C# library waits between retries with Task.Delay so cancellation is honored. Also this week: the JavaScript library honors numRetries: 0, C# respects TimeoutMilliseconds, Go Application.GetOrCreate is fixed along with the v2 module path, and the Ruby library uses bytes passed to Webhook.new_using_raw_bytes as the raw signing key. Earlier releases this week included v2.7.0, which returns the new secret from rotate-secret methods, and v2.6.2, which fixed bodyless POST and PUT calls in Java and Kotlin.

Svix SDKs v2.6.0 and v2.6.1 shipped. PHP gets destination/stream APIs, Java/Kotlin fix empty body handling, Ruby/PHP fix URL formatting. Python 3.9 support dropped.

This week's Svix SDK releases (v2.6.0 and v2.6.1) address critical issues across multiple languages. Java and Kotlin SDKs now correctly handle POST/PUT/PATCH operations without request bodies. Ruby and PHP clients properly format server URLs. PHP SDK gains destination and stream API support. Python 3.9 support has reached end-of-life.

PHP client now supports struct enums and AutoConfigConsumer. Server sends logs to OpenTelemetry collectors. Security update for rustls.

This week we brought PHP client library to feature parity with other languages by adding struct enums support and AutoConfigConsumer. The server now routes log events through OpenTelemetry collectors, giving users complete observability of their webhook infrastructure. We also addressed a security advisory with a rustls update.