2026-09-20 - 2026-09-23
Overview
2 Pull requests merged by 1 user
Merged
#320 Say max_retries is the total attempt count, not a retry count
Merged
#318 Consolidate the data directory mode into one owner
3 Pull requests proposed by 1 user
Proposed
#319 Index the event-tier columns the sweeps, event log and retention scan
Proposed
#321 1.0.0 milestone: next into main
Proposed
#322 Default WEBHOOKER_ENVIRONMENT to prod
8 Issues closed from 1 user
Closed
#316 max_retries=N means N attempts in total, but the form label and the field name say retries
Closed
#288 Two constants define the data directory mode, in two packages that both create it
Closed
#303 Independent code audit
Closed
#278 Changing the password neither regenerates the current session nor invalidates any other one
Closed
#305 Notify drops tasks on full channel; pending deliveries only recover on process restart
Closed
#308 Listener bind failure leaves the process running with no listener instead of exiting non-zero
Closed
#309 SSRF blocking has no opt-out: cannot deliver to RFC1918/LAN targets — needs ALLOWED_TARGET_CIDRS
Closed
#310 Replay/redelivery does not exist and the UI shows no per-attempt results, despite README promises
7 Issues created by 1 user
Opened
#311 Review toward 1.0: identify and file all next steps
Opened
#312 The inbound query string is discarded: a sender's URL parameters never reach storage, the UI or a target
Opened
#313 Outbound User-Agent is the hardcoded webhooker/1.0, not the stamped build version
Opened
#314 No index on the columns the sweeps, recovery and the event log filter by
Opened
#315 script/test always runs verbose and never measures coverage, against the policy pattern
Opened
#316 max_retries=N means N attempts in total, but the form label and the field name say retries
Opened
#317 MAINTENANCE_MODE is a documented no-op configuration variable
15 Unresolved Conversations
Open
#98
Deprecated gomodguard linter in the org-standard .golangci.yml (needs an upstream decision)
Open
#306
Circuit breaker half-open state busy-loops queued tasks with a DB write per spin
Open
#307
WEBHOOKER_ENVIRONMENT defaults to dev, silently shipping insecure prod (no Secure cookies, CORS *)
Open
#246
A delivery can carry Content-Type twice when the inbound event also supplied one
Open
#267
webhooker_delivery_duration_seconds is absent from a scrape until the first delivery occurs
Open
#275
DeleteDB returns on the first failing suffix, so it can report a leftover file when the history is already destroyed
Open
#280
Archive writers are never closed at shutdown, so their -wal survives a clean stop
Open
#291
GetDB can open the same event database twice, and closing the loser drops the winner's file locks
Open
#270
The access log records the proxy's address, never the client's, so abuse cannot be traced from webhooker's own logs
Open
#271
HSTS is a hardcoded 2-year includeSubDomains preload commitment with no opt-out and no documentation of its value
Open
#282
make check fails on a fresh clone because script/check does not fetch the vendored assets
Open
#293
A pending delivery whose target was deleted is stranded forever
Open
#299
Startup recovery races the receiver and can deliver a fresh event twice
Open
#265
script/docker is no longer byte-identical to the model script, and CI-built images stamp version "unknown"
Open
#294
TestProcessRetryTask_LargeBody_FetchFromDB stays green when the fetch it exists to exercise is deleted