What’s new

Client keys now evaluate on Shoal’s edge network in 30+ regions, so browser and mobile SDKs get results in ~10 ms without downloading your rules.

• New: POST /v2/evaluate accepts client keys and returns only resulting values. See Evaluate.
• New: Webhooks for rollout.step and rollout.guard_triggered.
• Improved: the JavaScript SDK is 18% smaller (4.1 kB gzipped).

Attach a metric to a rollout and Shoal pauses or rolls back automatically when it crosses a threshold. Read the rollouts guide.

guard:
  metric: checkout_error_rate
  max: 0.02
  action: rollback

• Fixed: SDKs behind some corporate proxies could stop receiving updates after 60 minutes. They now reconnect with jittered backoff.
• Fixed: shoal generate --check reported a diff on Windows line endings.

• New: reusable segments — define “Beta testers” once and target it from any flag.
• New: semver_gte, semver_lt and semver_eq operators for app versions.
• Improved: the rules editor shows how many users matched each rule in the last 24 hours.

Webhook requests are now signed with HMAC-SHA256 in the Shoal-Signature header.

• Security: verify the signature before trusting a payload — see verifying signatures.
• Breaking: the legacy X-Shoal-Token header was removed. Endpoints that relied on it must switch to signature verification.

A rewritten SDK with typed flags, local evaluation and rule-based targeting.

• New: @shoal/sdk with zero dependencies, ESM + CJS, edge support.
• New: shoal generate for type-safe flag keys.
• Breaking: package renamed from shoal-js; methods renamed. Follow the migration guide.