Summary

5 new features, 12 improvements, 6 bug fixes.

Improvements

• Self-hosted instances can require custom deploy base images per runtime via the new DEPLOY_BASE_IMAGES and DEPLOY_BUILD_BASE_IMAGES webapp settings. The CLI builds on the images the instance specifies, and older CLIs are rejected with an upgrade message. (#5005)

• Add a replay_run tool to the MCP server, so your AI assistant can replay a run, optionally with a new payload, metadata, tags, machine, version, delay or other trigger options. It is hidden in --readonly mode. (ff2aa236e)

• Override a concurrency limit's perKey for a single concurrencyKey: concurrencyLimits.override(name, { concurrencyKey, perKey, ttl }) caps that one key under that one limit for a while (7 days by default, 30 at most), reset(name, { concurrencyKey }) clears it, and retrieve(name, { concurrencyKey }) shows the key's bound and when the override expires. (c49fd05f4)

• runs.replay() now takes options, so you can replay a run with a different payload, metadata, tags, queue, machine, version, delay and other trigger options. Anything you leave out comes from the original run, as before, and the payload is serialized like trigger(), so values like Date and BigInt keep their types. (ff2aa236e)

  import { runs } from "@trigger.dev/sdk";
  
  await runs.replay("run_1234", {
  payload: { userId: "user_456" },
  tags: ["replayed"],
  delay: "10m",
  });

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• Self-hosted instances can add a Cloudflare Turnstile bot check to the magic-link sign-in form by setting TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY. It's off unless both are set.
• Recent deployments started from the GitHub integration or a native CLI deploy can be redeployed from the deployments list, rebuilding the same commit or upload as a new deployment.
• Each webhook endpoint's request rate limit now comes from the organization's plan and can be raised per organization, and the limits page shows it.
• Each environment's webhook endpoints now share a rate limit that counts larger request bodies as more than one request, set by the organization's plan and shown on the limits page.
• Webhooks now appear in the dashboard side menu with a Beta badge, and organizations without access can request beta access from the Webhooks page. The New badges on Sessions, Prompts and Models are gone.
• The new API key dialog's access summary now shows Errors, Webhooks and Waitpoints access, and API keys with waitpoint access can create, list and retrieve waitpoint tokens.
• Log search uses whole-word matching for ASCII alphabetic terms, keeps substring matching for other terms, and incrementally searches older logs without blocking the page.
• Magic links now only sign you in from the browser that requested them, so a link opened elsewhere (including by an email security scanner) no longer logs anyone in. Self-hosted instances can turn this off with MAGIC_LINK_SAME_BROWSER_REQUIRED=false.
• The multi-factor authentication login page now focuses the code input, accepts pasted codes, and submits as soon as all six digits are entered.
• Dashboard tabs left in the background now pause their live updates after 30 seconds and catch up as soon as you return, so idle tabs stop reloading data nobody is looking at.
• Preview branch auto-archiving is now always available, with no feature flag to enable first.
• Large run traces now load in chunks and update live without reloading the page, on child run pages as well as root runs.
• The run page shows one clear trace status next to Cancel and Replay: whether the run is live, still loading, only partially shown, or failed to load (with a retry). Search, filters and the run actions now share a single full-width toolbar.
• Keep blank Vercel imports from overwriting existing values when the default-off empty environment variable feature is enabled.
• Errors on the login page, such as an expired or invalid magic link, no longer disappear a moment after the page loads in a new browser.
• Magic-link sign-in emails now always link to LOGIN_ORIGIN, whatever host the request came in on.
• Parent and root metadata updates from child tasks no longer stall behind a parent run that is being updated by many children at once, and can optionally be buffered in Redis so they survive a webapp restart.
• Revoking a personal access token is now permanent. Logging in with the CLI again issues a new token instead of reinstating the revoked one, so you can rotate a leaked CLI token by revoking it and running trigger logout then trigger login.
• Webhook deliveries from a provider's shared IP addresses are no longer throttled by other customers' traffic or by a spoofed X-Forwarded-For header; the per-IP limit now applies only to requests for endpoints that don't exist, and every ingest 429 includes Retry-After.