trigger.dev v4.8.1

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.8.1

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-8-1

What's changed

Bug fixes

• Fix trigger deploy failing on self-hosted instances with custom base images. Stages built on a custom image now keep the trust store that image ships with. (b5ed66b74)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• Alerts can now watch the result of any supported query: raise when a value crosses a threshold, when matching rows stop appearing, or when new matching rows appear. Create them from the Query page, the Dashboard Agent or the API, and see the alert's values charted on its page.

All packages: v4.8.1

@trigger.dev/build, @trigger.dev/core, @trigger.dev/linear, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, @trigger.dev/slack, trigger.dev

Contributors

@Mariefay, Eric Allam, Wes Mason, github-actions[bot], @nicktrn, Katia Bulatova, Paul Cioanca

Full changelog: v4.8.0...v4.8.1

trigger.dev v4.8.0

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.8.0

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-8-0

What's changed

Improvements

• Route verified webhooks into agent sessions with chat.event({ endpoint, key }), and connect external chat surfaces with chat.channels.custom({ endpoint }). Both subscribe to a shared webhook endpoint, so an agent and your other webhook tasks can use the same provider URL. Channels support reply delivery, session binding, conversation seeding, and lifecycle reactions, and a failed turn posts a short line instead of the error (errorMessage sets it, as a string or a function of the failure). Use chat.createWatchToken() to watch a session from another surface. (d6955ee9f)

  A connector can also stream replies natively (stream()), mirror the session's state into the surface (lifecycle()), show tool calls as they run (progress()), stop a running turn from the surface (onControl()), post approvals and tool controls and resume the run from a verified click, download files only the surface can read (download()), and acknowledge or fold in messages that arrive mid-turn (received(), pendingMessages).

• Add hosted webhooks: declare an endpoint once with webhooks.endpoint.define({ id, source }) and Trigger.dev hosts its URL, verifies every request, and routes each event to the endpoint's subscribers. Subscribe tasks with webhook({ endpoint, filter, onEvent }), each with its own type-safe filter, and pause a run until a matching webhook arrives with webhooks.waiter.create() and webhooks.waiter.wait(). (d6955ee9f)

  export const stripe = webhooks.endpoint.define({
  id: "stripe",
  source: webhooks.stripe(),
  });
  
  export const fulfill = webhook({
  id: "fulfill",
  endpoint: stripe,
  filter: "event.type == 'checkout.session.completed'",
  onEvent: async ({ event }) => {},
  });
  
  const waiter = await webhooks.waiter.create(stripe, {
  match: { "event.data.object.metadata.orderId": order.id },
  });
  const { event } = await webhooks.waiter.wait(waiter).unwrap();

  Sources cover presets (webhooks.stripe(), webhooks.github(), webhooks.svix(), webhooks.discord(), and others), named providers (webhooks.clerk(), webhooks.shopify(), and more) and webhooks.custom<T>(config), and most carry a setup prompt an AI coding agent can follow to register the endpoint. Retries are deduplicated on the provider's own event or delivery id where it sends one. Filters, keys and waiter match paths share the event., header. and webhook. namespaces, and filters accept == null / != null presence checks and event any (...) over a payload that is an array of events. webhook() takes task() options such as queue, machine and retry. The HTTP API lists endpoints and deliveries, replays deliveries, and creates and cancels waiters, and both it and the MCP server can read an endpoint's setup prompt and generate or store its signing secret.

• The generate_webhook_secret and set_webhook_secret MCP tools take an optional previousSecretTtlSeconds to keep accepting a webhook endpoint's old signing secret while the provider switches to the new one (up to 7 days), and report when the old secret stops working. (98adb6662)

• Realtime streams now reconnect and resume when the stream backend reports a failed read mid-stream, instead of ending early as if the stream had finished. This affects runs.subscribeToRun with streams, useRealtimeRunWithStreams, and chat streams. (23730b034)

• HMAC webhook verifier configs accept additionalSignatureHeaders: more headers that can carry a signature, matched as alternatives to signatureHeader. Providers that send a second signature during a secret rotation (Hookdeck's x-hookdeck-signature-2) keep verifying through the rotation. (08d1ddbd3)

• Add webhooks.hookdeck(), a source for deliveries relayed through a Hookdeck connection. It verifies the x-hookdeck-signature header with the project's signing secret, keeps verifying while the secret is being rolled (Hookdeck sends the previous secret's signature in x-hookdeck-signature-2), and deduplicates retries on x-hookdeck-eventid. The event is the original provider's payload, so pass its type: webhooks.hookdeck<Stripe.Event>(). If the Hookdeck project's header prefix was changed, pass it as webhooks.hookdeck({ headerPrefix }) so retries keep deduplicating. (51b39fbc6)

• Add @trigger.dev/linear: turn a chat.agent into a Linear agent. Assign it an issue or @mention it, and Linear's agent session becomes a durable Trigger.dev session: the reply posts back to Linear, tool calls show as activities, linearPlanTool() keeps the plan Linear shows as a checklist, and approvals are Approve and Deny options that resume the run. (1586c4a3f)

  import { linear, webhookSource } from "@trigger.dev/linear";
  
  const linearEvents = webhooks.endpoint.define({
  id: "linear",
  source: webhookSource(),
  });
  
  export const triage = chat.agent({
  id: "triage",
  channels: [
    linear({
      id: "linear",
      endpoint: linearEvents,
      token: process.env.LINEAR_ACCESS_TOKEN!,
    }),
  ],
  run: async ({ messages, signal, streamText }) =>
    streamText({ model, messages, abortSignal: signal }),
  });

  The first turn gets the issue's context and earlier comments, images and PDFs in the issue reach the model, a Stop in Linear winds the turn down, and errorMessage sets the text a failed turn shows.

• Add @trigger.dev/slack: turn a chat.agent into a native Slack agent. Each DM or channel thread is a durable session, the reply streams into the thread with the turn's tool calls shown as a plan, approvals are Approve and Deny buttons, and Slack's stop button stops the turn. (6e715da77)

  import { appMentions, slack, webhookSource } from "@trigger.dev/slack";
  
  const slackEvents = webhooks.endpoint.define({
  id: "slack",
  source: webhookSource(),
  });
  
  export const support = chat.agent({
  id: "support",
  channels: [
    slack({
      id: "slack",
      endpoint: slackEvents,
      token: process.env.SLACK_BOT_TOKEN!,
      startOn: appMentions(),
    }),
  ],
  run: async ({ messages, signal, streamText }) =>
    streamText({ model, messages, abortSignal: signal }),
  });

  startOn decides which channel messages start a session (appMentions() answers when the agent is @mentioned). Images and PDFs people share reach the model, messages sent while the agent is answering can be folded into the reply, tools can post their own buttons, and ownWorkspaceOnly ignores Slack Connect guests.

• The streamText passed to a chat.agent's run() now turns AI SDK telemetry on by default, so each model step and tool call shows up as a span in the run trace even when the agent doesn't store a prompt with chat.prompt.set(). An agent with telemetry: { recordUserMessage: false } gets these spans without prompt and response content, including when it stores a prompt (whose variables are left out of the span metadata). Pass experimental_telemetry: { isEnabled: false } at the call site to turn them off, or recordInputs: false / recordOutputs: false to keep them without content. (bd7cc3525)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• When regenerating an environment's API key you can now revoke the previous key immediately instead of keeping it working for 24 hours. Use this when a key may have leaked.
• Set KUBERNETES_POD_RESERVED_SOURCE_PORTS on the supervisor (for example 50080,50081) to stop runs using those ports for outbound connections, which is useful to avoid port clashes.
• Rotating a webhook endpoint's signing secret can keep the old one valid for a while, so you can rotate without failing deliveries that are still signed with it. The rotate and regenerate dialogs let you choose how long the old secret stays valid (up to 7 days, 24 hours by default). The rotate-secret and secret endpoints accept an optional previousSecretTtlSeconds and return previousSecretExpiresAt. With no value, the old secret stops working immediately, as before.
• Alerts are now checked every minute instead of every 5–10 minutes, so they raise and recover sooner.
• Run traces and trace APIs load faster for older runs.
• The API keys page now always lists your root API key, masked to its last 4 characters when it's hidden, so you can regenerate it and revoke the previous key. When the root key is hidden, the page points you to creating an API key for your backend.
• Runs whose deployment has no compute template now go to containers when they are triggered, instead of first passing through the compute worker queue.
• Runs now...

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.8.1"

Changes

See commit history for detailed changes in this release.

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.8.0"

Changes

See commit history for detailed changes in this release.

This is a security release. Update the CLI and redeploy to pick up the fixes.

Security fixes

• Deployed tasks on the node, node-22, node-24 and node-26 runtimes now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Existing deployments keep the old runtime until you redeploy with this version.
• Self-hosted: the webapp and supervisor images now run on Node.js 24.22.1. The supervisor no longer trusts certificates issued under the compromised emSign (eMudhra) certificate authorities, and the webapp image builds its database migration tool with Go 1.26.10, which rejects the compromised eMudhra intermediates.

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Then redeploy your tasks with npx trigger.dev@latest deploy.

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.7.7

All packages are at v4.7.7: @trigger.dev/build, @trigger.dev/core, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, trigger.dev

Full changelog: v4.7.6...v4.7.7

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.7.7"

Changes

See commit history for detailed changes in this release.

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.7.6

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-7-6

What's changed

Highlights

• Added MCP tools for monitoring alerts: list_alert_capabilities, list_alerts, create_alert, and resolve_alert, so an MCP client can discover what a project can watch and manage alerts directly. Health capabilities expose customizable threshold params, discoverable via list_alert_capabilities and settable via create_alert. (99ea13007)

Improvements

• Deploy images no longer trust the emSign roots removed after the October 2026 eMudhra CA key compromise, or the Sectigo AAA root that cross-signs the compromised intermediates. Node and Bun tasks now refuse TLS connections through the compromised eMudhra intermediates, including their Sectigo AAA cross-signed copies. (dac3b033e)
• NODE_EXTRA_CA_CERTS set as an environment variable now reaches the task process at startup instead of being overwritten by the image's empty default. (fee21c38c)
• Python tasks and pip in deploy images now verify TLS against the image's trust store instead of a pinned certifi bundle, so they also refuse the compromised eMudhra intermediates. (fee21c38c)

Bug fixes

• Fix timestamp and other Date fields being logged as {} in structured log lines. (7a5a1f144)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• Ask Trigger's message box is now a single panel holding your message, its context, New chat and Send, with a note that Ask Trigger is an AI assistant and can make mistakes. The chat header has a simpler layout menu and history list, and the Fullscreen layout is now called Full page.
• The webapp Docker image no longer trusts the root certificates that chain to the compromised eMudhra intermediate CAs, so connections to servers presenting certificates from those intermediates now fail.

All packages: v4.7.6

@trigger.dev/build, @trigger.dev/core, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, trigger.dev

Contributors

@nicktrn, Katia Bulatova, Eric Allam, Chris Arderne, github-actions[bot], Saadi Myftija, pullfrog[bot], @d-cs, James Ritchie

Full changelog: v4.7.5...v4.7.6

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.7.5

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-7-5

What's changed

Improvements

• Add trigger.dev tasks trigger <task id> to trigger a task from your terminal. It uses the dev environment unless you pass --env, and --wait waits for the run and prints its output or error, exiting with code 1 if it failed. The runs commands now use the same dev branch as trigger dev when you pass --env dev. (d5dc48424)

  npx trigger.dev@latest tasks trigger hello-world --payload '{"name":"Ada"}' --wait

• Manage custom metric dashboards from code. query.dashboards lists, creates, updates and deletes custom dashboards and their widgets, and every widget query is checked when it is saved. The MCP server adds create_dashboard and set_dashboard_widgets, so your AI assistant can build a dashboard for you. (252624c92)

  import { query } from "@trigger.dev/sdk";
  
  await query.dashboards.create({
    title: "Email tasks",
    widgets: [
      {
        title: "Total runs",
        query: "SELECT count() AS total FROM runs",
        display: { type: "bignumber", column: "total", aggregation: "sum" },
      },
    ],
    });

• trigger deploy and trigger promote now say which environment they're targeting, and accept --prod as a shorthand for --env prod. When TRIGGER_ACCESS_TOKEN holds an environment API key and you don't pass --env, they now use that key's environment instead of assuming prod. Passing an --env that doesn't match the key is now an error, where before the deploy went to the key's environment. (70ea83d38)

  Preview deploys now detect the branch on CI providers that check out a detached HEAD, such as GitLab, Bitbucket, CircleCI, Buildkite, Travis CI, Jenkins and Azure Pipelines, instead of creating a branch called HEAD. Test links printed after a preview deploy now open the preview branch you deployed instead of staging.

  The MCP deploy tool no longer defaults to prod, so your AI assistant has to choose the environment.

• trigger dev works better when a coding agent like Claude Code, Cursor or Codex runs it: it skips the install prompts, lists the tasks it registered, and prints each run's dashboard URL and output. For everyone, a failed build now ends with a line saying it will rebuild when you fix the errors, and retried attempts and crashed task processes now show their errors. (d5dc48424)

• Redact span content before it leaves the worker. telemetry.spanProcessors in trigger.config.ts runs your own span processors ahead of every export, to Trigger.dev and to your own exporters, so you can redact or drop span content before it reaches the run trace. chat.agent also takes a telemetry option to stop recording the user's message and clientData on its spans. (32b36b143)

  export default defineConfig({
    telemetry: { spanProcessors: [new MyRedactingSpanProcessor()] },
  });
  
  chat.agent({
    id: "my-chat",
    telemetry: { recordUserMessage: false, recordClientData: false },
    run: async ({ messages, signal, streamText }) =>
      streamText({ model, messages, abortSignal: signal }),
    });

Bug fixes

• Fix run subscriptions crashing Node with Controller is already closed after you break out of the loop, and stop polling once you do. ApiClient subscribe methods also accept a custom fetchClient. (9f4295bff)

Other changes

• Update the @modelcontextprotocol/sdk dependency to ^1.31.0. (b5354d188)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• Recent deployments made with --local-bundle can now be redeployed from the deployments list, rebuilding the same bundle with its build-time environment variables.
• The API keys page now prompts you to create your first key instead of showing an empty table.
• The short link /_/billing now takes you straight to the billing page of your current organization.
• A batchTriggerAndWait could stay stuck executing after all of its child runs finished, if creating the batch was retried while the server was slow to respond. The parent now resumes with its child runs' results.
• The natural-language field on the schedule form returns a cron expression again instead of an error.
• Fixed runs failing to resume from a wait when the platform had already resumed them but the confirmation was lost.
• Run traces returned by the API no longer include internal debug events.
• Fixed natural-language schedule generation in the schedule side panel.
• A run whose process is killed is now only reported as out of memory when the machine actually ran out of memory. Any other kill (e.g. the machine being shut down or reclaimed) fails the attempt straight away as a crash, which is retried using your task's retry settings on the same machine size.

All packages: v4.7.5

@trigger.dev/build, @trigger.dev/core, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, trigger.dev

Contributors

Eric Allam, triggerdotdev-the-inspector[bot], @isshaddad, @nicktrn, Chris Arderne, Wes Mason, João Dias, github-actions[bot], Katia Bulatova, @d-cs, @D-K-P, mintlify[bot], claude[bot], Oskar Otwinowski, Saadi Myftija, @jack, @Mariefay

Full changelog: v4.7.4...v4.7.5

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.7.6"

Changes

See commit history for detailed changes in this release.

Installation

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.7.5"

Changes

See commit history for detailed changes in this release.