# What 1.0 promises

> The promises Good Webhooks makes from 1.0.0, and where each one is defined.

Source: https://good-webhooks.dev/docs/upgrading/contract

1.0.0-rc.1 is out on the `rc` tag, and this page is its contract. 1.0.0 is planned for early December 2026, after the candidate is held for at least four weeks.

## The promises [#the-promises]

From 1.0.0, Good Webhooks promises:

1. **A frozen public surface for 1.x.** The entry points, every exported name, and the interfaces a host implements stay compatible until 2.0.0. See [public surface](https://good-webhooks.dev/docs/operations/compatibility.md#public-surface).
2. **Breaking changes only in a major, after a deprecation.** A deprecated API keeps working for the rest of the major. See [releases](https://good-webhooks.dev/docs/operations/compatibility.md#releases) and [deprecation](https://good-webhooks.dev/docs/operations/compatibility.md#deprecation).
3. **Only additive SQL in a 1.x minor.** New nullable columns or indexes need an announcement in the previous minor, upgrade SQL, and a rollout order. Destructive schema changes wait for 2.0.0. See [schema and rollout](https://good-webhooks.dev/docs/operations/compatibility.md#schema-and-rollout).
4. **A published support matrix with a drop policy.** Node.js and PostgreSQL lines are dropped only in a major, after upstream end of life. See [supported configurations](https://good-webhooks.dev/docs/operations/compatibility.md#supported-configurations) and the [drop policy](https://good-webhooks.dev/docs/operations/compatibility.md#drop-policy).
5. **Support windows.** The previous minor gets security fixes for three months, and the last 1.x minor gets them for six months after 2.0.0. See [support windows](https://good-webhooks.dev/docs/operations/compatibility.md#support-windows).
6. **Security response targets.** An initial response within 14 days, and a fix for medium or higher severity within 60 days of confirmation. See the [security policy](https://github.com/pplytas/good-webhooks/blob/main/SECURITY.md).
7. **Releases that survive the maintainer's absence.** Releases run in GitHub Actions and publish through npm trusted publishing, with no stored token, and a [written handover](https://github.com/pplytas/good-webhooks/blob/main/docs/handover.md) says how another maintainer takes over.

See also the [upgrade matrix](https://good-webhooks.dev/docs/upgrading/matrix.md) and [Upgrade from 0.x](https://good-webhooks.dev/docs/upgrading/from-0x.md).

## What 1.0 does not promise [#what-10-does-not-promise]

- **Throughput beyond the published benchmark.** The [performance page](https://good-webhooks.dev/docs/operations/performance.md) states the measured profile and what it does not cover.
- **Ordering.** Deliveries can arrive out of order. See [delivery guarantees](https://good-webhooks.dev/docs/concepts/delivery-guarantees.md).
- **Deferred features.** Features the [roadmap](https://github.com/pplytas/good-webhooks/blob/main/docs/roadmap.md#deferred-with-the-evidence-that-would-unblock-each) lists as deferred are not part of 1.0.