Svix provides an enterprise-ready webhooks service where developers send webhooks via a single API call and Svix handles deliverability, retries, security, and related webhook infrastructure. This source is useful if you want an open source webhooks server and supporting components, plus documentation and community resources, for building and running webhook dispatch and ingestion workflows.
Project status
- Actively maintained: the upstream was pushed on 2026-11-04, and the listed updates continue through late October.
- Updates have been frequent and span the server, bridge, SDKs, and CLI, sometimes with several component updates on the same day.
AI summary generated
Recent updates
server-v1.104.0
Svix Server OSS v1.104.0 rejects event type schemas that use external `$ref` targets, adds a nullable `expiry` field to `EndpointOut`, and raises the documented Rust MSRV to 1.95.0. The diff also shows substantial bridge configuration, container, and generated API/SDK changes that are not covered by the release notes.
BreakingFeaturesserver-v1.103.0
Svix Server OSS v1.103.0 raises the documented Rust MSRV to 1.94.0, updates the SeaORM and sqlx dependency lines, and includes security-related dependency and Docker image updates. It also introduces a breaking minimum length of 12 bytes for HMAC-based JWT secrets. The supplied diff primarily shows version metadata updates across the server and client SDKs, rather than the underlying server or dependency changes.
BreakingSecurityv2.9.1
SDKs + CLI v2.9.1 changes JavaScript SDK error handling for non-JSON 4xx responses and rebuilds the CLI Docker image for CVE-2026-111497. JavaScript callers that depend on the previous exception type may need to update their error handling.
BreakingSecuritybridge-v1.101.1
The release notes announce a Docker image rebuild for CVE-2026-111497 and optional dead-letter queue configuration for the Redis queue plugin. The diff also includes unannounced server dependency and compatibility changes, a new minimum length for HMAC JWT secrets, Rust API changes, and a JavaScript error-handling fix.
BreakingSecurityFeaturesv2.9.0
SDKs and CLI v2.9.0 updates the client libraries to the latest Svix Cloud API, including ElasticSearch support for Advanced Destinations. It also improves retry handling for transient network failures, normalizes Java and Kotlin server URLs, and sets 15-second default request timeouts in several SDKs.
BreakingFeaturesserver-v1.102.0
Svix Server OSS v1.102.0 includes a documented breaking configuration change related to the default allowlist for the webhook host name `backend`, and adds new configuration capabilities around returning rotated secrets and OpenTelemetry log exporting (per the release notes). The code diff also shows multiple SDK and bridge/plugin capability additions (not described in the provided release notes), including ElasticSearch destination support and new RabbitMQ consumer configuration.
BreakingSecurityFeaturesserver-v1.102.1
Version bump to server 1.102.1. The release notes state that Svix Server removed compromised eMudhra CA certificates from its TLS trust store.
BreakingSecuritybridge-v1.101.0
This release adds an alternative JavaScript transformation backend using rquickjs (QuickJS), intended to be faster than the existing Deno-based backend. It also switches the bridge process global allocator from jemalloc to mimalloc, adds a RabbitMQ queue option, and updates the TLS trust store. The code diff reveals additional behavioral and API changes around the new JS executor, allocator metrics, and the server health endpoint.
BreakingSecurityFeaturesv2.8.0
SDKs + CLI v2.8.0 adds cURL-style @filename support in the CLI for populating JSON request bodies. It also updates retry behavior in the C# SDK to honor cancellation during retry delays, fixes Ruby webhook raw secret handling, and adjusts Go SDK GetOrCreate behavior to use a consistent receiver and support nil options.
Featuresv2.7.0
SDKs and CLI were bumped to v2.7.0 with changes centered on secret rotation. Across languages, the SDKs now return the newly rotated secret from rotate-secret operations, and the C# SDK now correctly applies the configured TimeoutMilliseconds value.
BreakingFeaturesv2.6.2
v2.6.2 includes a fix for SDK methods that perform POST or PUT requests when the operation has no HTTP body parameters (notably impacting Java and Kotlin SDKs), plus a Go-side fix to ensure the v2 module is released correctly. The code diff also shows broader Go packaging changes (module path and generated import paths), indicating impacts beyond the small notes provided.
v2.6.1
Release v2.6.1 updates the SDKs and CLI clients to align with the latest Svix Cloud API spec. Code generation introduced new request/response models and endpoints, including changes to AutoConfig subscription creation signatures and additional fields for RabbitMQ sink configuration.
BreakingFeaturesv2.6.0
SDKs + CLI v2.6.0 adds PHP support for the destination and stream APIs and introduces a new PHP AutoConfigConsumer. It also drops support for Python 3.9 (minimum is now Python 3.10) and reverts an accidental Rust breaking change around AutoConfigConsumer method receiver types.
BreakingFeaturesv2.5.0
SDKs and CLI v2.5.0 adds AutoConfig support intended to create and rotate AutoConfig tokens, and includes a Kotlin fix for requests where a body was sent without a content-type. However, the generated code diff shows broader SDK surface changes beyond the documented items, including renames/restructuring of AutoConfig subscription internals and additional model/schema updates.
BreakingFeaturesv2.4.0
SDKs and CLI v2.4.0 adds support for a new destination-based AutoConfig flow (including the `auto_v2_` token format) and introduces a new destination API surface. The release also changes the return type of `AutoConfigConsumer.subscribe()` to return destination information, and adjusts CLI redirect-following behavior in listen mode.
BreakingFeaturesv2.3.0
SDKs + CLI v2.3.0 adds support for new streaming sink types, along with several Ruby SDK adjustments. The Ruby changes include additional accessors, accepting symbol keys in struct enums, and small bug fixes. The code diff also reveals additional behavior and API shape changes that are not mentioned in the release notes.
Featuresv2.2.0
This release bumps the Svix SDK/CLI version to 2.2.0 and introduces the documented webhook verification behavior change for JavaScript and PHP. It also updates the Rust crate to re-export several commonly used types from the crate root, simplifying imports.
Breakingserver-v1.101.0
Svix Server OSS v1.101.0 adds the `v1.message.bulk-expunge-content` v1 endpoint and addresses two operational issues: a Rustls crypto provider startup panic with Postgres `sslmode=verify-ca`, and incorrect Redis queue key prefixing during queue migrations. Code also reveals additional implementation changes around Redis migration gating and Bridge queue plugin behavior that are not explicitly called out in the release notes.
Featuresv2.1.0
This release is primarily about adding SDK support for a new bulk-expunge messages endpoint (cloud-only at the time of writing) and bumping library versions to 2.1.0. The diff also shows substantial internal changes to the Rust bridge/queue components and large dependency updates that are not mentioned in the release notes.
Featuresv2.0.0
SDKs and CLI v2.0.0 introduces multiple breaking API model changes across languages, primarily around configuration typing. It renames patch-related config types, splits non-patch config types into separate input and output variants, adjusts sink config field optionality, and makes Rust API and URL-normalization changes.
BreakingFeatures