Skip to content

trigger.dev v4.7.7

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 08:39
v4.7.7
ffc950e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is a security release. Update the CLI and redeploy to pick up the fixes.

Security fixes

  • Deployed tasks on the node, node-22, node-24 and node-26 runtimes now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Existing deployments keep the old runtime until you redeploy with this version.
  • Self-hosted: the webapp and supervisor images now run on Node.js 24.22.1. The supervisor no longer trusts certificates issued under the compromised emSign (eMudhra) certificate authorities, and the webapp image builds its database migration tool with Go 1.26.10, which rejects the compromised eMudhra intermediates.

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Then redeploy your tasks with npx trigger.dev@latest deploy.

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.7.7

All packages are at v4.7.7: @trigger.dev/build, @trigger.dev/core, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, trigger.dev

Full changelog: v4.7.6...v4.7.7

Assets 2
Loading