Trigger.dev v4.7.6

3 improvements, 1 bug fix, and 2 server changes.

Highlights

Deployed tasks reject the compromised eMudhra certificates

On October 17, 2026, Mozilla received a report that the private keys for eight intermediate certificate authorities run by eMudhra had been compromised. A certificate authority's key is what makes a TLS certificate trusted, so whoever holds these keys could issue a certificate for any domain that most software would accept as genuine.

Browsers blocked the affected certificates within days. Server runtimes ship their own lists of trusted certificate authorities, and those take longer to update: Go shipped a security release, while the Node fix (nodejs/node#66871) and Bun's fix (oven-sh/bun#46159) have merged but aren't in a release yet. emudhra.we-have-a-problem.com explains the compromise and tracks which software is patched.

The risk to your tasks is low, but we recommend upgrading. To misuse these keys, an attacker would also have to intercept your task's network traffic, for example by hijacking DNS or a network route. Tasks you deploy with 4.7.6 are protected without waiting for Node and Bun releases:

• Node and Bun tasks no longer trust the affected eMudhra roots or the Sectigo AAA Certificate Services root that cross-signs the same intermediates, and they reject the eight intermediates directly.
• Python tasks and pip verify TLS against the image's trust store instead of a pinned certifi bundle, so requests with an older certifi is covered too.

Connections to everything else work as before.

We recommend upgrading to 4.7.6 and redeploying. Each deployment keeps the runtime it was built with, so tasks you deployed before this release keep trusting these certificates until you redeploy.

To check an environment, request https://dv-g3b-emudhra.we-have-a-problem.com/ from it. That site serves a certificate from one of the compromised intermediates, so the request failing with a certificate error means the environment is protected.

Improvements

• NODE_EXTRA_CA_CERTS set as an environment variable now reaches your task process at startup instead of being overwritten by the image's empty default, so custom CA bundles work in deployed tasks.

Bug fixes

• Fixed timestamp and other Date fields being logged as {} in structured log lines.

Server changes

These changes are included in the v4.7.6 Docker image and are already live on Trigger.dev Cloud:

• The webapp no longer trusts the root certificates that chain to the compromised eMudhra intermediates, so its outbound connections to servers presenting those certificates fail.
• Ask Trigger's message box is now a single panel holding your message, its context, New chat and Send, with a note that Ask Trigger is an AI assistant and can make mistakes. The chat header has a simpler layout menu and history list, and Fullscreen is now called Full page.

How to upgrade

Update the trigger.dev/* packages to v4.7.6 using your package manager:

Self-hosted users: update your Docker image to ghcr.io/triggerdotdev/trigger.dev:v4.7.6.