[github-actions]

Summary

8 improvements, 4 bug fixes.

Improvements

• CLI and MCP logins are now bound to the machine that started them. Approving a login in your browser sends you back to the CLI automatically, or, when the browser is on another machine, shows a code to paste into the terminal (or pass with trigger.dev login --code). Older CLI versions will need to upgrade to log in. (1a36c23fb)
• Add trigger webhooks set-secret and trigger webhooks generate-secret, which store a webhook endpoint's signing secret without printing it. set-secret reads the secret from a pipe, an environment variable or a .env file, and generate-secret saves the new secret to an env file. When the endpoint already has a secret, both ask how long the old one keeps working (or take --previous-secret-ttl 24h in scripts). The MCP server's set_webhook_secret and generate_webhook_secret descriptions now point AI agents at these commands, so the secret stays out of the agent's context. (daaaa41db)
• Deprecates the legacy Bun runtime. runtime: "bun" (and its explicit spelling "bun-legacy"), which deploys Bun 1.3.3 with Node.js 20 alongside it, now prints a deprecation warning, and deploys that use it will be rejected from January 5, 2027. Switch to runtime: "bun-1.4" (Bun 1.4.4 on an image with no Node.js binary) and redeploy. (5f8171cab)
• Add trigger.refresh(ctx, id) to request an earlier status check for a Convex-tracked run, so applications using Trigger Realtime can publish results without waiting for the next scheduled poll. Requests are coalesced and rate-limited, use the existing completion callback, and retain polling as a recovery fallback. (ee5e5da40)
• Add private-beta OIDC authentication for deployed Cloud tasks, with an AWS credential provider and environment-specific setup instructions. Install @aws-sdk/client-sts to use @trigger.dev/sdk/oidc/aws, upgrade your deployment CLI, and redeploy. Contact us to enable access for your organization. (65352bc90)

Bug fixes

• Fix parent and root metadata updates being lost after one update could not be applied. Only that update is now skipped, and the rest are written. Metadata keys that name only the root, such as $. or $.., are now ignored on a run's own metadata instead of throwing, and rejected for parent and root metadata, which fails the whole request. (53441fd20)
• Fix reloading a chat mid-turn after its access token was refreshed. A token refresh during a streaming turn persisted a resume cursor from the middle of the turn, so a reload resumed past chunks the page needed and failed to rebuild the assistant message ("No tool invocation found for tool call ID"). The persisted cursor now stays at the start of the turn until it completes, so a reload replays the whole turn. (9fd1de656)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• The CLI and MCP login consent page now shows when and from which IP address the login was started, and you get an email whenever a new CLI or MCP login is authorized on your account.
• Searching, filtering to errors, and expanding or collapsing spans in the run trace view are faster on large traces.
• Guide switching from shared root keys to individually managed API keys, while keeping root key regeneration directly available.
• CLI and MCP login codes now work once, and every login mints its own personal access token instead of reusing an existing CLI token.
• Fix run traces occasionally going missing when a span recorded an exception with no message, type or stack trace.

Raw changeset output

Releases

@trigger.dev/build@4.8.3

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.3

trigger.dev@4.8.3

Patch Changes

• CLI and MCP logins are now bound to the machine that started them. Approving a login in your browser sends you back to the CLI automatically, or, when the browser is on another machine, shows a code to paste into the terminal (or pass with trigger.dev login --code). Older CLI versions will need to upgrade to log in. (1a36c23fb)
• Add trigger webhooks set-secret and trigger webhooks generate-secret, which store a webhook endpoint's signing secret without printing it. set-secret reads the secret from a pipe, an environment variable or a .env file, and generate-secret saves the new secret to an env file. When the endpoint already has a secret, both ask how long the old one keeps working (or take --previous-secret-ttl 24h in scripts). The MCP server's set_webhook_secret and generate_webhook_secret descriptions now point AI agents at these commands, so the secret stays out of the agent's context. (daaaa41db)
• Deprecates the legacy Bun runtime. runtime: "bun" (and its explicit spelling "bun-legacy"), which deploys Bun 1.3.3 with Node.js 20 alongside it, now prints a deprecation warning, and deploys that use it will be rejected from January 5, 2027. Switch to runtime: "bun-1.4" (Bun 1.4.4 on an image with no Node.js binary) and redeploy. (5f8171cab)
• Updated dependencies:
  • @trigger.dev/core@4.8.3
  • @trigger.dev/build@4.8.3
  • @trigger.dev/schema-to-json@4.8.3

@trigger.dev/convex@4.8.3

Patch Changes

• Add trigger.refresh(ctx, id) to request an earlier status check for a Convex-tracked run, so applications using Trigger Realtime can publish results without waiting for the next scheduled poll. Requests are coalesced and rate-limited, use the existing completion callback, and retain polling as a recovery fallback. (ee5e5da40)

@trigger.dev/core@4.8.3

Patch Changes

• CLI and MCP logins are now bound to the machine that started them. Approving a login in your browser sends you back to the CLI automatically, or, when the browser is on another machine, shows a code to paste into the terminal (or pass with trigger.dev login --code). Older CLI versions will need to upgrade to log in. (1a36c23fb)
• Add private-beta OIDC authentication for deployed Cloud tasks, with an AWS credential provider and environment-specific setup instructions. Install @aws-sdk/client-sts to use @trigger.dev/sdk/oidc/aws, upgrade your deployment CLI, and redeploy. Contact us to enable access for your organization. (65352bc90)
• Deprecates the legacy Bun runtime. runtime: "bun" (and its explicit spelling "bun-legacy"), which deploys Bun 1.3.3 with Node.js 20 alongside it, now prints a deprecation warning, and deploys that use it will be rejected from January 5, 2027. Switch to runtime: "bun-1.4" (Bun 1.4.4 on an image with no Node.js binary) and redeploy. (5f8171cab)
• Fix parent and root metadata updates being lost after one update could not be applied. Only that update is now skipped, and the rest are written. Metadata keys that name only the root, such as $. or $.., are now ignored on a run's own metadata instead of throwing, and rejected for parent and root metadata, which fails the whole request. (53441fd20)

@trigger.dev/linear@4.8.3

Patch Changes

• Updated dependencies:
  • @trigger.dev/sdk@4.8.3
  • @trigger.dev/core@4.8.3

@trigger.dev/python@4.8.3

Patch Changes

• Updated dependencies:
  • @trigger.dev/sdk@4.8.3
  • @trigger.dev/core@4.8.3
  • @trigger.dev/build@4.8.3

@trigger.dev/react-hooks@4.8.3

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.3

@trigger.dev/redis-worker@4.8.3

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.3

@trigger.dev/rsc@4.8.3

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.3

@trigger.dev/schema-to-json@4.8.3

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.8.3

@trigger.dev/slack@4.8.3

Patch Changes

• Updated dependencies:
  • @trigger.dev/sdk@4.8.3
  • @trigger.dev/core@4.8.3

@trigger.dev/sdk@4.8.3

Patch Changes

• Fix reloading a chat mid-turn after its access token was refreshed. A token refresh during a streaming turn persisted a resume cursor from the middle of the turn, so a reload resumed past chunks the page needed and failed to rebuild the assistant message ("No tool invocation found for tool call ID"). The persisted cursor now stays at the start of the turn until it completes, so a reload replays the whole turn. (9fd1de656)
• Add private-beta OIDC authentication for deployed Cloud tasks, with an AWS credential provider and environment-specific setup instructions. Install @aws-sdk/client-sts to use @trigger.dev/sdk/oidc/aws, upgrade your deployment CLI, and redeploy. Contact us to enable access for your organization. (65352bc90)
• Updated dependencies:
  • @trigger.dev/core@4.8.3

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3244c917-baec-466f-b17f-fa0618089165

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

🧭 Helm Chart Prerelease Published

Version: 4.8.3-pr5085.4da15b9

Install:

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.8.3-pr5085.4da15b9"

⚠️ This is a prerelease for testing. Do not use in production.