chore: release v4.7.7 (#5047)

## Summary
2 new features, 2 improvements, 2 bug fixes.

## Improvements
- Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and
the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and
26.12.1, the October 2026 security releases. They fix CVE-2026-111497
(an out-of-bounds write in the Brotli decoder) and several TLS hostname
verification bypasses. Redeploy with this CLI version to pick up the
patched runtime.
([`447ab134f`](447ab13))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- When regenerating an environment's API key you can now revoke the
previous key immediately instead of keeping it working for 24 hours. Use
this when a key may have leaked.
- Rotating a webhook endpoint's signing secret can keep the old one
valid for a while, so you can rotate without failing deliveries that are
still signed with it. The rotate and regenerate dialogs let you choose
how long the old secret stays valid (up to 7 days, 24 hours by default).
The `rotate-secret` and `secret` endpoints accept an optional
`previousSecretTtlSeconds` and return `previousSecretExpiresAt`. With no
value, the old secret stops working immediately, as before.
- Runs now get a `TRIGGER_DASHBOARD_URL` environment variable with the
dashboard's address, so a task can link to its run
(`${TRIGGER_DASHBOARD_URL}/runs/${ctx.run.id}`) on any Trigger.dev
instance. A `TRIGGER_DASHBOARD_URL` you set on the project still wins.
- Alerts sent to Slack channels connected through a removed Slack
installation deliver again.
- The supervisor no longer trusts certificates issued under the
compromised emSign (eMudhra) certificate authorities.
([#5047](#5047))

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## trigger.dev@4.7.7

### Patch Changes

- Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and
the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and
26.12.1, the October 2026 security releases. They fix CVE-2026-111497
(an out-of-bounds write in the Brotli decoder) and several TLS hostname
verification bypasses. Redeploy with this CLI version to pick up the
patched runtime.
([`447ab134f`](447ab13))
- Updated dependencies:
  - `@trigger.dev/build@4.7.7`
  - `@trigger.dev/core@4.7.7`
  - `@trigger.dev/schema-to-json@4.7.7`
## @trigger.dev/python@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/build@4.7.7`
  - `@trigger.dev/core@4.7.7`
  - `@trigger.dev/sdk@4.7.7`
## @trigger.dev/react-hooks@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/redis-worker@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/rsc@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/schema-to-json@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/sdk@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/core@4.7.7

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]

.changeset/node-october-2026-security-images.md

@@ -2,8 +2,8 @@ apiVersion: v2
 name: trigger
 description: The official Trigger.dev Helm chart
 type: application
-version: 4.7.6
-appVersion: v4.7.6
+version: 4.7.7
+appVersion: v4.7.7
 home: https://trigger.dev
 sources:
   - https://github.com/triggerdotdev/trigger.dev

.server-changes/supervisor-distrust-emudhra-roots.md

@@ -1,5 +1,12 @@
 # @trigger.dev/build
 
+## 4.7.7
+
+### Patch Changes
+
+- Updated dependencies:
+  - `@trigger.dev/core@4.7.7`
+
 ## 4.7.6
 
 ### Patch Changes

hosting/k8s/helm/Chart.yaml

@@ -1,6 +1,6 @@
 {
   "name": "@trigger.dev/build",
-  "version": "4.7.6",
+  "version": "4.7.7",
   "description": "trigger.dev build extensions",
   "license": "MIT",
   "publishConfig": {
@@ -82,7 +82,7 @@
   },
   "dependencies": {
     "@prisma/config": "^6.10.0",
-    "@trigger.dev/core": "workspace:4.7.6",
+    "@trigger.dev/core": "workspace:4.7.7",
     "mlly": "^1.7.1",
     "pkg-types": "^1.1.3",
     "tinyglobby": "^0.2.2",

packages/build/CHANGELOG.md

@@ -1,5 +1,15 @@
 # trigger.dev
 
+## 4.7.7
+
+### Patch Changes
+
+- Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Redeploy with this CLI version to pick up the patched runtime. ([`447ab134f`](https://github.com/triggerdotdev/trigger.dev/commit/447ab134f6be37f8c59cc838c7ae89f5eca557db))
+- Updated dependencies:
+  - `@trigger.dev/build@4.7.7`
+  - `@trigger.dev/core@4.7.7`
+  - `@trigger.dev/schema-to-json@4.7.7`
+
 ## 4.7.6
 
 ### Patch Changes

packages/build/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trigger.dev",
-  "version": "4.7.6",
+  "version": "4.7.7",
   "description": "A Command-Line Interface for Trigger.dev projects",
   "type": "module",
   "license": "MIT",
@@ -84,9 +84,9 @@
     "@opentelemetry/api-logs": "0.219.0",
     "@opentelemetry/instrumentation": "0.219.0",
     "@s2-dev/streamstore": "^0.25.0",
-    "@trigger.dev/build": "workspace:4.7.6",
-    "@trigger.dev/core": "workspace:4.7.6",
-    "@trigger.dev/schema-to-json": "workspace:4.7.6",
+    "@trigger.dev/build": "workspace:4.7.7",
+    "@trigger.dev/core": "workspace:4.7.7",
+    "@trigger.dev/schema-to-json": "workspace:4.7.7",
     "ansi-escapes": "^7.0.0",
     "braces": "^3.0.3",
     "c12": "^1.11.1",

packages/cli-v3/CHANGELOG.md

@@ -1,5 +1,7 @@
 # internal-platform
 
+## 4.7.7
+
 ## 4.7.6
 
 ### Patch Changes

packages/cli-v3/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trigger.dev/core",
-  "version": "4.7.6",
+  "version": "4.7.7",
   "description": "Core code used across the Trigger.dev SDK and platform",
   "license": "MIT",
   "publishConfig": {

packages/core/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @trigger.dev/python
 
+## 4.7.7
+
+### Patch Changes
+
+- Updated dependencies:
+  - `@trigger.dev/build@4.7.7`
+  - `@trigger.dev/core@4.7.7`
+  - `@trigger.dev/sdk@4.7.7`
+
 ## 4.7.6
 
 ### Patch Changes