Comparing changes

(cherry picked from commit 02b441d)

The webapp and supervisor images now run on Node.js 24.22.1, the October 2026 security release. Mono-RevId: 50dcded1de5ced64c1efce5f0604c5ef1c42c371 (cherry picked from commit 985712e)

Mono-RevId: ba5ac3f785512fdde799f2cd954c8f15c25ecfd2 (cherry picked from commit 82a7870)

Mono-RevId: acde560ac6ade661e28982a0a921dea6abe7ee76 (cherry picked from commit 39483a7)

… security releases Pins the deploy base images built on Node.js 22.23.4, 24.22.1 and 26.12.1, which fix CVE-2026-111497 (Brotli decoder out-of-bounds write) and several TLS hostname verification bypasses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

## Summary 2 new features, 2 improvements, 2 bug fixes. ## Improvements - Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Redeploy with this CLI version to pick up the patched runtime. ([`447ab134f`](447ab13)) ## Server changes These changes affect the self-hosted Docker image and Trigger.dev Cloud: - When regenerating an environment's API key you can now revoke the previous key immediately instead of keeping it working for 24 hours. Use this when a key may have leaked. - Rotating a webhook endpoint's signing secret can keep the old one valid for a while, so you can rotate without failing deliveries that are still signed with it. The rotate and regenerate dialogs let you choose how long the old secret stays valid (up to 7 days, 24 hours by default). The `rotate-secret` and `secret` endpoints accept an optional `previousSecretTtlSeconds` and return `previousSecretExpiresAt`. With no value, the old secret stops working immediately, as before. - Runs now get a `TRIGGER_DASHBOARD_URL` environment variable with the dashboard's address, so a task can link to its run (`${TRIGGER_DASHBOARD_URL}/runs/${ctx.run.id}`) on any Trigger.dev instance. A `TRIGGER_DASHBOARD_URL` you set on the project still wins. - Alerts sent to Slack channels connected through a removed Slack installation deliver again. - The supervisor no longer trusts certificates issued under the compromised emSign (eMudhra) certificate authorities. ([#5047](#5047)) <details> <summary>Raw changeset output</summary> # Releases ## @trigger.dev/build@4.7.7 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.7.7` ## trigger.dev@4.7.7 ### Patch Changes - Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Redeploy with this CLI version to pick up the patched runtime. ([`447ab134f`](447ab13)) - Updated dependencies: - `@trigger.dev/build@4.7.7` - `@trigger.dev/core@4.7.7` - `@trigger.dev/schema-to-json@4.7.7` ## @trigger.dev/python@4.7.7 ### Patch Changes - Updated dependencies: - `@trigger.dev/build@4.7.7` - `@trigger.dev/core@4.7.7` - `@trigger.dev/sdk@4.7.7` ## @trigger.dev/react-hooks@4.7.7 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.7.7` ## @trigger.dev/redis-worker@4.7.7 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.7.7` ## @trigger.dev/rsc@4.7.7 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.7.7` ## @trigger.dev/schema-to-json@4.7.7 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.7.7` ## @trigger.dev/sdk@4.7.7 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.7.7` ## @trigger.dev/core@4.7.7 </details> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Navigation Menu

Repository navigation

Comparing changes

Open a pull request

Uh oh!

Commits on Oct 22, 2026

This comparison is taking too long to generate.

Uh oh!