diff --git a/.changeset/node-october-2026-security-images.md b/.changeset/node-october-2026-security-images.md deleted file mode 100644 index 3417190dc48..00000000000 --- a/.changeset/node-october-2026-security-images.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"trigger.dev": patch ---- - -Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Redeploy with this CLI version to pick up the patched runtime. diff --git a/.server-changes/supervisor-distrust-emudhra-roots.md b/.server-changes/supervisor-distrust-emudhra-roots.md deleted file mode 100644 index a5e15988b56..00000000000 --- a/.server-changes/supervisor-distrust-emudhra-roots.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: supervisor -type: fix ---- - -The supervisor no longer trusts certificates issued under the compromised emSign (eMudhra) certificate authorities. diff --git a/hosting/k8s/helm/Chart.yaml b/hosting/k8s/helm/Chart.yaml index 79ab33c3374..40d1a071bcb 100644 --- a/hosting/k8s/helm/Chart.yaml +++ b/hosting/k8s/helm/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 name: trigger description: The official Trigger.dev Helm chart type: application -version: 4.7.6 -appVersion: v4.7.6 +version: 4.7.7 +appVersion: v4.7.7 home: https://trigger.dev sources: - https://github.com/triggerdotdev/trigger.dev diff --git a/packages/build/CHANGELOG.md b/packages/build/CHANGELOG.md index 7e9cbbf1268..8efba6a8864 100644 --- a/packages/build/CHANGELOG.md +++ b/packages/build/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/build +## 4.7.7 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.7.7` + ## 4.7.6 ### Patch Changes diff --git a/packages/build/package.json b/packages/build/package.json index 4446d90b3c1..d0bce02f730 100644 --- a/packages/build/package.json +++ b/packages/build/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/build", - "version": "4.7.6", + "version": "4.7.7", "description": "trigger.dev build extensions", "license": "MIT", "publishConfig": { @@ -82,7 +82,7 @@ }, "dependencies": { "@prisma/config": "^6.10.0", - "@trigger.dev/core": "workspace:4.7.6", + "@trigger.dev/core": "workspace:4.7.7", "mlly": "^1.7.1", "pkg-types": "^1.1.3", "tinyglobby": "^0.2.2", diff --git a/packages/cli-v3/CHANGELOG.md b/packages/cli-v3/CHANGELOG.md index 4eca3436ed4..2fffcaf3ab7 100644 --- a/packages/cli-v3/CHANGELOG.md +++ b/packages/cli-v3/CHANGELOG.md @@ -1,5 +1,15 @@ # trigger.dev +## 4.7.7 + +### Patch Changes + +- Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Redeploy with this CLI version to pick up the patched runtime. ([`447ab134f`](https://github.com/triggerdotdev/trigger.dev/commit/447ab134f6be37f8c59cc838c7ae89f5eca557db)) +- Updated dependencies: + - `@trigger.dev/build@4.7.7` + - `@trigger.dev/core@4.7.7` + - `@trigger.dev/schema-to-json@4.7.7` + ## 4.7.6 ### Patch Changes diff --git a/packages/cli-v3/package.json b/packages/cli-v3/package.json index c919ccba5f4..5dfc3d6efe9 100644 --- a/packages/cli-v3/package.json +++ b/packages/cli-v3/package.json @@ -1,6 +1,6 @@ { "name": "trigger.dev", - "version": "4.7.6", + "version": "4.7.7", "description": "A Command-Line Interface for Trigger.dev projects", "type": "module", "license": "MIT", @@ -84,9 +84,9 @@ "@opentelemetry/api-logs": "0.219.0", "@opentelemetry/instrumentation": "0.219.0", "@s2-dev/streamstore": "^0.25.0", - "@trigger.dev/build": "workspace:4.7.6", - "@trigger.dev/core": "workspace:4.7.6", - "@trigger.dev/schema-to-json": "workspace:4.7.6", + "@trigger.dev/build": "workspace:4.7.7", + "@trigger.dev/core": "workspace:4.7.7", + "@trigger.dev/schema-to-json": "workspace:4.7.7", "ansi-escapes": "^7.0.0", "braces": "^3.0.3", "c12": "^1.11.1", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index cbe141f70e1..366dcf023e8 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,7 @@ # internal-platform +## 4.7.7 + ## 4.7.6 ### Patch Changes diff --git a/packages/core/package.json b/packages/core/package.json index a0c603d6d01..1cd9f2faa7b 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/core", - "version": "4.7.6", + "version": "4.7.7", "description": "Core code used across the Trigger.dev SDK and platform", "license": "MIT", "publishConfig": { diff --git a/packages/python/CHANGELOG.md b/packages/python/CHANGELOG.md index 235997f8b6a..7ac79320c1f 100644 --- a/packages/python/CHANGELOG.md +++ b/packages/python/CHANGELOG.md @@ -1,5 +1,14 @@ # @trigger.dev/python +## 4.7.7 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/build@4.7.7` + - `@trigger.dev/core@4.7.7` + - `@trigger.dev/sdk@4.7.7` + ## 4.7.6 ### Patch Changes diff --git a/packages/python/package.json b/packages/python/package.json index a9db8087d23..61a2dd66fcc 100644 --- a/packages/python/package.json +++ b/packages/python/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/python", - "version": "4.7.6", + "version": "4.7.7", "description": "Python runtime and build extension for Trigger.dev", "license": "MIT", "publishConfig": { @@ -45,7 +45,7 @@ "check-exports": "attw --pack ." }, "dependencies": { - "@trigger.dev/core": "workspace:4.7.6", + "@trigger.dev/core": "workspace:4.7.7", "tinyexec": "^0.3.2" }, "devDependencies": { @@ -55,12 +55,12 @@ "typescript": "catalog:", "tsx": "4.17.0", "@arethetypeswrong/cli": "^0.18.5", - "@trigger.dev/build": "workspace:4.7.6", - "@trigger.dev/sdk": "workspace:4.7.6" + "@trigger.dev/build": "workspace:4.7.7", + "@trigger.dev/sdk": "workspace:4.7.7" }, "peerDependencies": { - "@trigger.dev/sdk": "workspace:^4.7.6", - "@trigger.dev/build": "workspace:^4.7.6" + "@trigger.dev/sdk": "workspace:^4.7.7", + "@trigger.dev/build": "workspace:^4.7.7" }, "engines": { "node": ">=18.20.0" diff --git a/packages/react-hooks/CHANGELOG.md b/packages/react-hooks/CHANGELOG.md index c4477243675..6288c67f3f0 100644 --- a/packages/react-hooks/CHANGELOG.md +++ b/packages/react-hooks/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/react-hooks +## 4.7.7 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.7.7` + ## 4.7.6 ### Patch Changes diff --git a/packages/react-hooks/package.json b/packages/react-hooks/package.json index 173fbff5335..53a5c614cc9 100644 --- a/packages/react-hooks/package.json +++ b/packages/react-hooks/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/react-hooks", - "version": "4.7.6", + "version": "4.7.7", "description": "trigger.dev react hooks", "license": "MIT", "publishConfig": { @@ -37,7 +37,7 @@ "check-exports": "attw --pack ." }, "dependencies": { - "@trigger.dev/core": "workspace:^4.7.6", + "@trigger.dev/core": "workspace:^4.7.7", "swr": "^2.2.5" }, "devDependencies": { diff --git a/packages/redis-worker/CHANGELOG.md b/packages/redis-worker/CHANGELOG.md index be2efdf182d..da26abb70f9 100644 --- a/packages/redis-worker/CHANGELOG.md +++ b/packages/redis-worker/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/redis-worker +## 4.7.7 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.7.7` + ## 4.7.6 ### Patch Changes diff --git a/packages/redis-worker/package.json b/packages/redis-worker/package.json index 92fb9f080f7..67fffce076a 100644 --- a/packages/redis-worker/package.json +++ b/packages/redis-worker/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/redis-worker", - "version": "4.7.6", + "version": "4.7.7", "description": "Redis worker for trigger.dev", "license": "MIT", "publishConfig": { @@ -23,7 +23,7 @@ "test": "vitest --sequence.concurrent=false --no-file-parallelism" }, "dependencies": { - "@trigger.dev/core": "workspace:4.7.6", + "@trigger.dev/core": "workspace:4.7.7", "nanoid": "^5.1.16", "p-limit": "^6.2.0", "seedrandom": "^3.0.5", diff --git a/packages/rsc/CHANGELOG.md b/packages/rsc/CHANGELOG.md index 5792f53eda1..209c0cb86ff 100644 --- a/packages/rsc/CHANGELOG.md +++ b/packages/rsc/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/rsc +## 4.7.7 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.7.7` + ## 4.7.6 ### Patch Changes diff --git a/packages/rsc/package.json b/packages/rsc/package.json index 588e9d493a2..b02b5be7357 100644 --- a/packages/rsc/package.json +++ b/packages/rsc/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/rsc", - "version": "4.7.6", + "version": "4.7.7", "description": "trigger.dev rsc", "license": "MIT", "publishConfig": { @@ -37,7 +37,7 @@ "check-exports": "attw --pack ." }, "dependencies": { - "@trigger.dev/core": "workspace:^4.7.6", + "@trigger.dev/core": "workspace:^4.7.7", "mlly": "^1.7.1", "react": "19.0.0-rc.1", "react-dom": "19.0.0-rc.1" diff --git a/packages/schema-to-json/CHANGELOG.md b/packages/schema-to-json/CHANGELOG.md index c10dd8b4a55..7b3adc23d74 100644 --- a/packages/schema-to-json/CHANGELOG.md +++ b/packages/schema-to-json/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/schema-to-json +## 4.7.7 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.7.7` + ## 4.7.6 ### Patch Changes diff --git a/packages/schema-to-json/package.json b/packages/schema-to-json/package.json index 143ffdaa5d1..c2b9178b661 100644 --- a/packages/schema-to-json/package.json +++ b/packages/schema-to-json/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/schema-to-json", - "version": "4.7.6", + "version": "4.7.7", "description": "Convert various schema validation libraries to JSON Schema", "license": "MIT", "publishConfig": { diff --git a/packages/trigger-sdk/CHANGELOG.md b/packages/trigger-sdk/CHANGELOG.md index ef3b33f5af3..dbedfc0acbf 100644 --- a/packages/trigger-sdk/CHANGELOG.md +++ b/packages/trigger-sdk/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/sdk +## 4.7.7 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.7.7` + ## 4.7.6 ### Patch Changes diff --git a/packages/trigger-sdk/package.json b/packages/trigger-sdk/package.json index 2d8490bdaf9..aa5318d8fa5 100644 --- a/packages/trigger-sdk/package.json +++ b/packages/trigger-sdk/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/sdk", - "version": "4.7.6", + "version": "4.7.7", "description": "trigger.dev Node.JS SDK", "license": "MIT", "publishConfig": { @@ -80,7 +80,7 @@ "dependencies": { "@opentelemetry/api": "1.9.1", "@opentelemetry/semantic-conventions": "1.41.1", - "@trigger.dev/core": "workspace:4.7.6", + "@trigger.dev/core": "workspace:4.7.7", "uncrypto": "^0.1.3" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8ae36ed20e7..dc9ca9c33e9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1575,7 +1575,7 @@ importers: specifier: ^6.10.0 version: 6.19.0(magicast@0.3.5) '@trigger.dev/core': - specifier: workspace:4.7.6 + specifier: workspace:4.7.7 version: link:../core mlly: specifier: ^1.7.1 @@ -1642,13 +1642,13 @@ importers: specifier: ^0.25.0 version: 0.25.0(supports-color@10.0.0) '@trigger.dev/build': - specifier: workspace:4.7.6 + specifier: workspace:4.7.7 version: link:../build '@trigger.dev/core': - specifier: workspace:4.7.6 + specifier: workspace:4.7.7 version: link:../core '@trigger.dev/schema-to-json': - specifier: workspace:4.7.6 + specifier: workspace:4.7.7 version: link:../schema-to-json ansi-escapes: specifier: ^7.0.0 @@ -1981,7 +1981,7 @@ importers: packages/python: dependencies: '@trigger.dev/core': - specifier: workspace:4.7.6 + specifier: workspace:4.7.7 version: link:../core tinyexec: specifier: ^0.3.2 @@ -1991,10 +1991,10 @@ importers: specifier: ^0.18.5 version: 0.18.5 '@trigger.dev/build': - specifier: workspace:4.7.6 + specifier: workspace:4.7.7 version: link:../build '@trigger.dev/sdk': - specifier: workspace:4.7.6 + specifier: workspace:4.7.7 version: link:../trigger-sdk '@types/node': specifier: 24.13.3 @@ -2015,7 +2015,7 @@ importers: packages/react-hooks: dependencies: '@trigger.dev/core': - specifier: workspace:^4.7.6 + specifier: workspace:^4.7.7 version: link:../core react: specifier: 18.3.1 @@ -2049,7 +2049,7 @@ importers: packages/redis-worker: dependencies: '@trigger.dev/core': - specifier: workspace:4.7.6 + specifier: workspace:4.7.7 version: link:../core cron-parser: specifier: ^4.9.0 @@ -2095,7 +2095,7 @@ importers: packages/rsc: dependencies: '@trigger.dev/core': - specifier: workspace:^4.7.6 + specifier: workspace:^4.7.7 version: link:../core mlly: specifier: ^1.7.1 @@ -2184,7 +2184,7 @@ importers: specifier: 1.41.1 version: 1.41.1 '@trigger.dev/core': - specifier: workspace:4.7.6 + specifier: workspace:4.7.7 version: link:../core react: specifier: 18.3.1