Trigger.dev v4.7.7

2 security fixes. Update the CLI and redeploy your tasks to pick them up:

Security fixes

• Deployed tasks on the node, node-22, node-24 and node-26 runtimes now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 Node.js security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Each deployment keeps the runtime it was built with, so existing deployments stay on the old Node.js version until you redeploy. (447ab134f)
• For self-hosting, the v4.7.7 Docker image runs the webapp and supervisor on Node.js 24.22.1. The supervisor no longer trusts certificates issued under the compromised emSign (eMudhra) certificate authorities, and the webapp builds its database migration tool with Go 1.26.10, which rejects the compromised eMudhra intermediates. (005262283, 69b18db6a, 1f4ef696c)

4.7.7 also includes the fix from 4.7.6 for the compromised eMudhra certificate authorities: deployed tasks no longer trust certificates issued with the stolen keys. If you're upgrading from an earlier version, one redeploy picks up both releases. The new Node.js versions also reject the compromised eMudhra intermediates on their own, on top of the 4.7.6 protection.

How to upgrade

Update the trigger.dev/* packages to v4.7.7 using your package manager:

Self-hosted users: update your Docker image to ghcr.io/triggerdotdev/trigger.dev:v4.7.7.