trigger.dev v4.8.5

This is a security release. Update the CLI and redeploy to pick up the fixes.

Most tasks are not affected. The high severity issues only matter if your task code, or a package it uses, runs an HTTP/2 or HTTPS server inside the task. Regular outbound calls with fetch, node:http or node:https (calling APIs, databases or LLM providers) are not affected by them.

Upgrade

npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun

Self-hosted Docker image: ghcr.io/triggerdotdev/trigger.dev:v4.8.5

Release notes

Read the full release notes: https://trigger.dev/changelog/v4-8-5

What's changed

Improvements

• Deployed tasks on the node, node-22, node-24 and node-26 runtimes now run on Node.js 22.23.5, 24.22.3 and 26.13.1, the November 2026 security releases. They fix several high severity issues in HTTP/2 and TLS, including CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-123872 and CVE-2026-123874, plus CVE-2026-126051 on Node.js 24 and 26. Existing deployments keep the old runtime until you redeploy with this version. (b58c0f9e9)

Server changes

These changes affect the self-hosted Docker image:

• The webapp and supervisor images now run on Node.js 24.22.3, the November 2026 security release.

All packages: v4.8.5

@trigger.dev/build, @trigger.dev/convex, @trigger.dev/core, @trigger.dev/linear, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, @trigger.dev/slack, trigger.dev

Contributors

Eric Allam, github-actions[bot], Chris Arderne

Full changelog: v4.8.4...v4.8.5