0 Releases 4,167 Tags

RSS Feed

• v.docker.4.5.6 325b906319

  Compare

  chore: release v4.5.6 (#4317)

  frostbyte_neo released this 2026-07-21 11:07:52 +00:00 | 292 commits to main since this release

  Summary

  5 improvements, 9 bug fixes.

  Breaking changes

  • Self-hosted deployments no longer ship shared default credentials;
    fresh installs generate their own. If yours still uses a previously
    published default, set a unique value before upgrading, or set
    ALLOW_INSECURE_DEFAULT_SECRETS=true to keep booting while you migrate.
    (#4316)

  Improvements

  • Require explicit browser approval for CLI and MCP login, with
    resilient polling while approval is pending.
    (#4316)
  • Deployed task telemetry now reports the deployment identifier (e.g.
    deployment_abc123) in the worker.id attribute, instead of an opaque
    internal value. Upgrade to get the readable identifier in your own
    OpenTelemetry exporters.
    (#4316)
  • Prevent prototype pollution when applying run metadata operations or
    reconstructing nested telemetry attributes, while preserving legitimate
    constructor and prototype fields.
    (#4316)
  • Add helpers to mint and verify the deployment-scoped token used to
    authenticate run controllers to the platform.
    (#4316)

  Server changes

  These changes affect the self-hosted Docker image and Trigger.dev Cloud:

  • Added optional request rate limiting for telemetry ingestion
    endpoints.
    (#4316)
  • Background-worker deployment lookups are now scoped to the
    authenticated environment.
    (#4316)
  • Updating a GitHub App installation from the callback flow is now
    scoped to your own organization, so an installation ID belonging to
    another organization can no longer be used to refresh that
    organization's installation record. The GitHub App installation session
    is also now single-use, so completing an installation callback
    invalidates its state and it can no longer be replayed.
    (#4316)
  • Scope schedule and environment-variable writes to the caller's project
    and environment
    (#4316)
  • Reject compute snapshot callbacks that do not match the snapshot
    request that created them.
    (#4316)
  • Require secret-key authentication to initialize the session out
    (agent→client) stream, matching the append route.
    (#4316)
  • Live run and trace subscriptions now validate their identifiers more
    strictly and only return data from your own organization.
    (#4316)
  • Window-function names in the query compiler are now validated against
    the allowlist, matching how other function calls are handled.
    (#4316)
  • Authenticate run controllers to the platform with a signed,
    deployment-scoped token.
    (#4316)
  • Verify that worker actions (starting, completing, and continuing a
    run, and reading its snapshots) target a run belonging to the caller's
    environment.
    (#4316)

  Raw changeset output

  Releases

  @trigger.dev/build@4.5.6

  Patch Changes

  • Updated dependencies:
    • @trigger.dev/core@4.5.6

  trigger.dev@4.5.6

  Patch Changes

  • Require explicit browser approval for CLI and MCP login, with
    resilient polling while approval is pending.
    (#4316)
  • Deployed task telemetry now reports the deployment identifier (e.g.
    deployment_abc123) in the worker.id attribute, instead of an opaque
    internal value. Upgrade to get the readable identifier in your own
    OpenTelemetry exporters.
    (#4316)
  • Updated dependencies:
    • @trigger.dev/core@4.5.6
    • @trigger.dev/build@4.5.6
    • @trigger.dev/schema-to-json@4.5.6

  @trigger.dev/core@4.5.6

  Patch Changes

  • Prevent prototype pollution when applying run metadata operations or
    reconstructing nested telemetry attributes, while preserving legitimate
    constructor and prototype fields.
    (#4316)
  • Require explicit browser approval for CLI and MCP login, with
    resilient polling while approval is pending.
    (#4316)
  • Add helpers to mint and verify the deployment-scoped token used to
    authenticate run controllers to the platform.
    (#4316)

  @trigger.dev/python@4.5.6

  Patch Changes

  • Updated dependencies:
    • @trigger.dev/core@4.5.6
    • @trigger.dev/build@4.5.6
    • @trigger.dev/sdk@4.5.6

  @trigger.dev/react-hooks@4.5.6

  Patch Changes

  • Updated dependencies:
    • @trigger.dev/core@4.5.6

  @trigger.dev/redis-worker@4.5.6

  Patch Changes

  • Updated dependencies:
    • @trigger.dev/core@4.5.6

  @trigger.dev/rsc@4.5.6

  Patch Changes

  • Updated dependencies:
    • @trigger.dev/core@4.5.6

  @trigger.dev/schema-to-json@4.5.6

  Patch Changes

  • Updated dependencies:
    • @trigger.dev/core@4.5.6

  @trigger.dev/sdk@4.5.6

  Patch Changes

  • Updated dependencies:
    • @trigger.dev/core@4.5.6

  Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)