GeezerVison

chore: release v4.8.5 (#5118)

## Summary
1 improvement, 1 server change.

## Improvements
- Deployed tasks on the `node`, `node-22`, `node-24` and `node-26`
runtimes now run on Node.js 22.23.5, 24.22.3 and 26.13.1, the November
2026 security releases. They fix several high severity issues in HTTP/2
and TLS, including CVE-2026-123863, CVE-2026-123864, CVE-2026-123865,
CVE-2026-123866, CVE-2026-123872 and CVE-2026-123874, plus
CVE-2026-126051 on Node.js 24 and 26. Existing deployments keep the old
runtime until you redeploy with this version.
([`b58c0f9e9`](b58c0f9))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- The webapp and supervisor images now run on Node.js 24.22.3, the
November 2026 security release.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## [email protected]

### Patch Changes

- Deployed tasks on the `node`, `node-22`, `node-24` and `node-26`
runtimes now run on Node.js 22.23.5, 24.22.3 and 26.13.1, the November
2026 security releases. Redeploy with this version to pick them up.
([`b58c0f9e9`](b58c0f9))
- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]


## @trigger.dev/[email protected]

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release v4.8.5 (#5118)

## Summary
1 improvement, 1 server change.

## Improvements
- Deployed tasks on the `node`, `node-22`, `node-24` and `node-26`
runtimes now run on Node.js 22.23.5, 24.22.3 and 26.13.1, the November
2026 security releases. They fix several high severity issues in HTTP/2
and TLS, including CVE-2026-123863, CVE-2026-123864, CVE-2026-123865,
CVE-2026-123866, CVE-2026-123872 and CVE-2026-123874, plus
CVE-2026-126051 on Node.js 24 and 26. Existing deployments keep the old
runtime until you redeploy with this version.
([`b58c0f9e9`](b58c0f9))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- The webapp and supervisor images now run on Node.js 24.22.3, the
November 2026 security release.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## [email protected]

### Patch Changes

- Deployed tasks on the `node`, `node-22`, `node-24` and `node-26`
runtimes now run on Node.js 22.23.5, 24.22.3 and 26.13.1, the November
2026 security releases. Redeploy with this version to pick them up.
([`b58c0f9e9`](b58c0f9))
- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]


## @trigger.dev/[email protected]

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release v4.8.5 (#5118)

## Summary
1 improvement, 1 server change.

## Improvements
- Deployed tasks on the `node`, `node-22`, `node-24` and `node-26`
runtimes now run on Node.js 22.23.5, 24.22.3 and 26.13.1, the November
2026 security releases. They fix several high severity issues in HTTP/2
and TLS, including CVE-2026-123863, CVE-2026-123864, CVE-2026-123865,
CVE-2026-123866, CVE-2026-123872 and CVE-2026-123874, plus
CVE-2026-126051 on Node.js 24 and 26. Existing deployments keep the old
runtime until you redeploy with this version.
([`b58c0f9e9`](b58c0f9))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- The webapp and supervisor images now run on Node.js 24.22.3, the
November 2026 security release.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## [email protected]

### Patch Changes

- Deployed tasks on the `node`, `node-22`, `node-24` and `node-26`
runtimes now run on Node.js 22.23.5, 24.22.3 and 26.13.1, the November
2026 security releases. Redeploy with this version to pick them up.
([`b58c0f9e9`](b58c0f9))
- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]


## @trigger.dev/[email protected]

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

docs: list the November 2026 Node.js runtime versions

Deployed tasks on node-22, node-24 and node-26 run on Node.js 22.23.5, 24.22.3 and 26.13.1 from CLI 4.8.5.

Publish docs: personal access token and CLI login expiry, trusted pub…

…lishing CLI minimum version

fix: remove ignored plugins changeset blocking release (#5108)

## Summary
Deletes the remaining changeset for `@trigger.dev/plugins`, which is
ignored in `.changeset/config.json`.

Its presence makes `changesets/action` choose release PR creation
instead of npm publishing, blocking the v4.8.4 release. Versioning
leaves this ignored changeset untouched.

After merging, manually dispatch `release.yml` with type `release` and
the new main commit SHA. Rerunning the failed run would check out the
old commit containing this changeset.

## Validation
- Confirmed the changeset only targets the ignored package.
- `git diff --cached --check` passed.
- No source code changed.

fix: remove ignored plugins changeset blocking release (#5108)

## Summary
Deletes the remaining changeset for `@trigger.dev/plugins`, which is
ignored in `.changeset/config.json`.

Its presence makes `changesets/action` choose release PR creation
instead of npm publishing, blocking the v4.8.4 release. Versioning
leaves this ignored changeset untouched.

After merging, manually dispatch `release.yml` with type `release` and
the new main commit SHA. Rerunning the failed run would check out the
old commit containing this changeset.

## Validation
- Confirmed the changeset only targets the ignored package.
- `git diff --cached --check` passed.
- No source code changed.

fix: remove ignored plugins changeset blocking release (#5108)

## Summary
Deletes the remaining changeset for `@trigger.dev/plugins`, which is
ignored in `.changeset/config.json`.

Its presence makes `changesets/action` choose release PR creation
instead of npm publishing, blocking the v4.8.4 release. Versioning
leaves this ignored changeset untouched.

After merging, manually dispatch `release.yml` with type `release` and
the new main commit SHA. Rerunning the failed run would check out the
old commit containing this changeset.

## Validation
- Confirmed the changeset only targets the ignored package.
- `git diff --cached --check` passed.
- No source code changed.

Publish docs: API key access, trusted publishing, OIDC and token expiry

chore: release v4.8.3 (#5085)

## Summary
8 improvements, 4 bug fixes.

## Improvements
- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))

## Bug fixes
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- The CLI and MCP login consent page now shows when and from which IP
address the login was started, and you get an email whenever a new CLI
or MCP login is authorized on your account.
- Searching, filtering to errors, and expanding or collapsing spans in
the run trace view are faster on large traces.
- Guide switching from shared root keys to individually managed API
keys, while keeping root key regeneration directly available.
- CLI and MCP login codes now work once, and every login mints its own
personal access token instead of reusing an existing CLI token.
- Fix run traces occasionally going missing when a span recorded an
exception with no message, type or stack trace.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## [email protected]

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
## @trigger.dev/[email protected]

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/[email protected]`
  - `@trigger.dev/[email protected]`
## @trigger.dev/[email protected]

### Patch Changes

- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Updated dependencies:
  - `@trigger.dev/[email protected]`

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>