[github-actions]

Summary

2 new features, 2 improvements, 2 bug fixes.

Improvements

• Deployed tasks on the node-22, node-24 and node-26 runtimes (and the default node runtime) now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Redeploy with this CLI version to pick up the patched runtime. (447ab134f)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• When regenerating an environment's API key you can now revoke the previous key immediately instead of keeping it working for 24 hours. Use this when a key may have leaked.
• Rotating a webhook endpoint's signing secret can keep the old one valid for a while, so you can rotate without failing deliveries that are still signed with it. The rotate and regenerate dialogs let you choose how long the old secret stays valid (up to 7 days, 24 hours by default). The rotate-secret and secret endpoints accept an optional previousSecretTtlSeconds and return previousSecretExpiresAt. With no value, the old secret stops working immediately, as before.
• Runs now get a TRIGGER_DASHBOARD_URL environment variable with the dashboard's address, so a task can link to its run (${TRIGGER_DASHBOARD_URL}/runs/${ctx.run.id}) on any Trigger.dev instance. A TRIGGER_DASHBOARD_URL you set on the project still wins.
• Alerts sent to Slack channels connected through a removed Slack installation deliver again.
• The supervisor no longer trusts certificates issued under the compromised emSign (eMudhra) certificate authorities. (#5047)

Raw changeset output

Releases

@trigger.dev/build@4.7.7

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.7

trigger.dev@4.7.7

Patch Changes

• Deployed tasks on the node-22, node-24 and node-26 runtimes (and the default node runtime) now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Redeploy with this CLI version to pick up the patched runtime. (447ab134f)
• Updated dependencies:
  • @trigger.dev/build@4.7.7
  • @trigger.dev/core@4.7.7
  • @trigger.dev/schema-to-json@4.7.7

@trigger.dev/python@4.7.7

Patch Changes

• Updated dependencies:
  • @trigger.dev/build@4.7.7
  • @trigger.dev/core@4.7.7
  • @trigger.dev/sdk@4.7.7

@trigger.dev/react-hooks@4.7.7

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.7

@trigger.dev/redis-worker@4.7.7

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.7

@trigger.dev/rsc@4.7.7

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.7

@trigger.dev/schema-to-json@4.7.7

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.7

@trigger.dev/sdk@4.7.7

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.7

@trigger.dev/core@4.7.7

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8af8e1b0-1c67-4c7a-95fe-1a54e9528155

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

🧭 Helm Chart Prerelease Published

Version: 4.7.7-pr5047.20ac6ac

Install:

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.7.7-pr5047.20ac6ac"

⚠️ This is a prerelease for testing. Do not use in production.