Skip to content
Anvil

Version 0.5.0

Release date: November 6, 2026

Highlights

Section titled “Highlights”
  • Webhooks: applications tell each other what happened. CloudEvents in the body, signatures of Standard Webhooks, retries, protection against requests to internal addresses, and a receiver for Anvil applications. See Webhooks.
  • Outbox: messages to other systems are written in the transaction of the change and delivered later, with retries, also after a crash. See Outbox.

No breaking changes. One migration, see Upgrading to 0.5.0.

Security

Section titled “Security”
  • Webhooks only call HTTPS URLs whose host resolves to public addresses or to networks allowed in $webhookAllowedNetworks, and connect to the checked address. Redirects are not followed.
  • Development dependency symfony/filesystem updated to v8.1.11 (GHSA-6prc-h956-hxjq). It is not installed with Anvil.

Enhancements

Section titled “Enhancements”
  • service('outbox'): push() in the transaction of the change, idempotency key per tenant, handlers by name in $outboxHandlers, retries with backoff, lease for several servers, time budget per tick. Command anvil:outbox.
  • $durableEventHandlers let domain events go through the outbox.
  • Webhooks under Access → Webhooks ($webhooks = true): event patterns, kinds of records, optional changed values, secret with overlap on rotation, test event, deliveries with Send again, automatic disabling with a notification.
  • service('webhookReceiver') and WebhookSignature check received webhooks.
  • RunAs::system() runs code in a tenant as the system actor.