What 1.0 promises

1.0.0-rc.1 is out on the rc tag, and this page is its contract. 1.0.0 is planned for early December 2026, after the candidate is held for at least four weeks.

The promisesCopy Anchor Link

From 1.0.0, Good Webhooks promises:

1. A frozen public surface for 1.x. The entry points, every exported name, and the interfaces a host implements stay compatible until 2.0.0. See public surface.
2. Breaking changes only in a major, after a deprecation. A deprecated API keeps working for the rest of the major. See releases and deprecation.
3. Only additive SQL in a 1.x minor. New nullable columns or indexes need an announcement in the previous minor, upgrade SQL, and a rollout order. Destructive schema changes wait for 2.0.0. See schema and rollout.
4. A published support matrix with a drop policy. Node.js and PostgreSQL lines are dropped only in a major, after upstream end of life. See supported configurations and the drop policy.
5. Support windows. The previous minor gets security fixes for three months, and the last 1.x minor gets them for six months after 2.0.0. See support windows.
6. Security response targets. An initial response within 14 days, and a fix for medium or higher severity within 60 days of confirmation. See the security policy.
7. Releases that survive the maintainer's absence. Releases run in GitHub Actions and publish through npm trusted publishing, with no stored token, and a written handover says how another maintainer takes over.

See also the upgrade matrix and Upgrade from 0.x.

What 1.0 does not promiseCopy Anchor Link

• Throughput beyond the published benchmark. The performance page states the measured profile and what it does not cover.
• Ordering. Deliveries can arrive out of order. See delivery guarantees.
• Deferred features. Features the roadmap lists as deferred are not part of 1.0.