Changelog

Patch — quieter retries on flaky destinations

Improved

• Adaptive backoff: when a destination has >30% error rate over 5 minutes, the worker temporarily drops parallel attempts to that destination from N to 2 to avoid making things worse. Reverts automatically once the error rate falls.
• Dashboard "events" filter now accepts a comma-separated list of statuses (e.g. failed,discarded).

Fixed

• Replay events with a custom headers override no longer drop the original endpoint signature when the override doesn't include it. (Reported by Stefano P. — thanks.)
• CLI: hookcastle events tail on Windows PowerShell no longer breaks on terminal width < 100 columns.

Per-destination concurrency, custom retry schedules, smaller dashboard

The biggest release since 2.0. Two long-requested features and a dashboard rewrite that I'm finally happy with.

New

• Per-destination concurrency limits. You can now cap the number of in-flight requests to a given endpoint. Useful when your customer's webhook receiver chokes on more than ~5 concurrent requests.
• Custom retry schedules. Per-endpoint retry_policy object accepts an explicit array of seconds-between-attempts and a retry_on_4xx boolean. The default schedule (12 attempts over 24h) is still the default.
• Idempotency keys on POST /v1/events. 24h dedup window.

Improved

• Dashboard event-list now renders 10× faster. Dropped a heavy component for a plain table; turns out a virtualized table with 50 rows is overkill.
• Webhook signature header changed from v1=<hex> only to t=<ts>,v1=<hex> for replay protection. Old format still accepted; will be removed in v3.

Fixed

• Events with a 256-byte body that included a multi-byte UTF-8 sequence on the boundary were rejected as >256 KiB. (Off-by-one in the size check.)

Patch

Fixed

• Project-level API keys created before Jan 28 didn't see events in the dashboard until a hard refresh, due to a stale cached project_id mapping. (Postgres upgrade aftermath.)
• Stripe-style signature helper in hookcastle-node wasn't exporting verifyStripeStyle() — now is.

Vendor signature helpers, fan-out destinations

New

• Built-in signature verification helpers for Stripe, GitHub, and Shopify-style HMAC schemes — verify on receipt without writing the boilerplate. Docs.
• An event's destination can now be an array. Each URL gets its own delivery attempt and retry track; one URL failing doesn't affect the others.

Improved

• Median delivery latency down from 198ms to 142ms after replacing a CDN-routed health-check loop with a direct one.

Patch

Fixed

• Web dashboard: timezone display for created_at respected the browser locale on the events list but not on the detail page. Now consistent.
• CLI: hookcastle login opened the wrong browser when $BROWSER was set with arguments.

CLI 1.0, Go SDK

New

• hookcastle CLI 1.0 — tail events, replay, manage endpoints. github.com/hookcastle/hookcastle-cli.
• Go SDK (1.21+). Same API shape as the Node and Python ones.

Searchable delivery log

New

• Full-text search on event payloads (default off, opt-in per project — costs storage). Useful for digging out a specific delivery from yesterday at 3am.
• Export the delivery log to JSON or CSV from the dashboard.

Major rewrite of the delivery engine

v1 used a single Postgres table for the queue and pulled rows with SELECT … FOR UPDATE SKIP LOCKED. It worked, until it didn't, around 200 events/sec sustained. v2 splits the queue from the log: ingest writes to an in-memory ring buffer, the workers pull from there, and the durable log is a write-only Postgres table. Sustained throughput is now >3,000 events/sec on the same hardware.

Breaking changes

• API path moved from /api/ to /v1/. The old path returns 410 with a Location hint until end of 2026.
• Event status retrying merged into delivering — there was no functional difference and it was confusing.

The v1 era

v1 was the first internal version of HookCastle, used at a previous company before being spun out. It worked. It also had a 600-line stored procedure that nobody could read. v2 deleted it. If you need v1.x release notes for compliance reasons, email us.