Skip to content

v.docker.4.7.7

v.docker.4.7.7: chore: release v4.7.7 (#5047)
@github-actions github-actions tagged this 22 Oct 08:13 
## Summary
2 new features, 2 improvements, 2 bug fixes.

## Improvements
- Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and
the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and
26.12.1, the October 2026 security releases. They fix CVE-2026-111497
(an out-of-bounds write in the Brotli decoder) and several TLS hostname
verification bypasses. Redeploy with this CLI version to pick up the
patched runtime.
([`447ab134f`](https://github.com/triggerdotdev/trigger.dev/commit/447ab134f6be37f8c59cc838c7ae89f5eca557db))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- When regenerating an environment's API key you can now revoke the
previous key immediately instead of keeping it working for 24 hours. Use
this when a key may have leaked.
- Rotating a webhook endpoint's signing secret can keep the old one
valid for a while, so you can rotate without failing deliveries that are
still signed with it. The rotate and regenerate dialogs let you choose
how long the old secret stays valid (up to 7 days, 24 hours by default).
The `rotate-secret` and `secret` endpoints accept an optional
`previousSecretTtlSeconds` and return `previousSecretExpiresAt`. With no
value, the old secret stops working immediately, as before.
- Runs now get a `TRIGGER_DASHBOARD_URL` environment variable with the
dashboard's address, so a task can link to its run
(`${TRIGGER_DASHBOARD_URL}/runs/${ctx.run.id}`) on any Trigger.dev
instance. A `TRIGGER_DASHBOARD_URL` you set on the project still wins.
- Alerts sent to Slack channels connected through a removed Slack
installation deliver again.
- The supervisor no longer trusts certificates issued under the
compromised emSign (eMudhra) certificate authorities.
([#5047](https://github.com/triggerdotdev/trigger.dev/pull/5047))

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## trigger.dev@4.7.7

### Patch Changes

- Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and
the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and
26.12.1, the October 2026 security releases. They fix CVE-2026-111497
(an out-of-bounds write in the Brotli decoder) and several TLS hostname
verification bypasses. Redeploy with this CLI version to pick up the
patched runtime.
([`447ab134f`](https://github.com/triggerdotdev/trigger.dev/commit/447ab134f6be37f8c59cc838c7ae89f5eca557db))
- Updated dependencies:
  - `@trigger.dev/build@4.7.7`
  - `@trigger.dev/core@4.7.7`
  - `@trigger.dev/schema-to-json@4.7.7`
## @trigger.dev/python@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/build@4.7.7`
  - `@trigger.dev/core@4.7.7`
  - `@trigger.dev/sdk@4.7.7`
## @trigger.dev/react-hooks@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/redis-worker@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/rsc@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/schema-to-json@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/sdk@4.7.7

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.7`
## @trigger.dev/core@4.7.7

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Assets 2
Loading