OCMLABS/MODULE-WEBHOOK · CHANGELOG

Webhooks module changelog

All notable changes to OCMLabs Webhooks are listed here. This module follows Semantic Versioning.

1.3.0 - 2026-10-02

Magento Open Source / Adobe Commerce 2.4.9 support. The module now installs on 2.4.7 through 2.4.9.
PHP 8.5 support, alongside PHP 8.2, 8.3 and 8.4.

Redeliver any logged delivery, whether it originally failed or succeeded. A “Redeliver” row action on the Delivery Log grid (with confirmation) and a button on the delivery detail page re-send the stored request body verbatim to the webhook’s URL, synchronously. The redelivery reuses the original X-Webhook-Delivery-Id (it is the same logical delivery), logs as the next attempt number under that UID with a “(redelivery)” marker, and carries an X-Webhook-Redelivery: 1 header so receivers can tell it apart. The signature is recomputed over the stored body with the webhook’s current secret.
New ACL resource OCMLabs_Webhook::log_redeliver (child of the delivery log resource), so the read-only log permission does not grant the ability to trigger outbound traffic.

Redelivery re-sends the stored request body, so it is only available on log entries that stored one - request bodies are kept when the “Log Payloads” setting is enabled at the time of delivery. Entries without a body show no Redeliver action.

The Send Test result modal now shows why a test delivery failed - template errors (with the line number), blocked destination URLs, and HTTP or timeout errors - instead of only “Success: No” with no explanation.
Send Test now renders templates against the same payload shape as real deliveries. Templates referencing enriched order data such as order.billing_address, order.shipping_address, order.payment, or order.items no longer fail with undefined-key errors during testing.

Sample data for Send Test and the “Available Template Variables” preview now includes the computed order.status_changed / order.previous_status fields for Order Updated and orig_customer for Customer Updated, matching what real deliveries carry.

Dynamic “Available Template Variables” panel on the webhook form: the universal meta.* variables are always documented, and a Load Variables for Selected Event button fetches the real, current variable set for the chosen event from live store data.

Delivery log grid now shows event display names (e.g. “Order Placed”) instead of system event names.
The Webhook ID column in the delivery log grid links directly to the webhook’s edit form.
Delivery log detail view explains why a request body is absent (payload logging disabled) instead of showing an empty field, and adds Back to Delivery Log navigation.

Saving a webhook no longer fails when its payload template references variables absent from the save-time sample data.

Adobe Commerce support via the ocmlabs/module-webhook-commerce metapackage. The module is now distributed as two packages: ocmlabs/module-webhook (Magento Open Source and Adobe Commerce) and the Commerce licensing metapackage.

Initial release.

Queue-based outbound webhooks: subscribe a destination URL to a store event and deliver a templated payload asynchronously, without blocking the shopper or admin request path.
10 curated events: Order Placed, Order Updated, Shipment Created, Invoice Created, Credit Memo Created, Customer Registered, Customer Updated, Product Saved, Product Deleted, Stock Level Changed.
Custom event subscriptions: any Magento event by name, behind a configuration flag.
Smarty payload templates with sandboxed execution, JSON-safe json / escape_json modifiers, and a prefilled default template per curated event.
Custom headers per webhook, templated with the same engine.
HMAC-SHA256 delivery signing (X-Webhook-Signature) and idempotency UUIDs (X-Webhook-Delivery-Id).
Per-webhook authentication: None, Bearer, or Basic, with credentials encrypted at rest.
Automatic retries with exponential backoff; template errors fail fast without retries.
Delivery log with per-attempt status, HTTP code, duration, request/response bodies, and automatic pruning on a configurable retention.
Synchronous “Send Test” button on the webhook form.
SSRF protection on destination URLs.
Ten disabled sample webhooks installed with the module, one per curated event.