Trigger.dev v4.8.2

2 breaking changes, 3 new features, 8 improvements, 2 bug fixes, and many server changes.

Breaking changes

• Query dashboard APIs now reject run tokens and public access tokens used without user delegation. Existing API key access, including restricted keys with the required query scopes, is unchanged. MCP dashboard access remains supported through delegated tokens for current organization members.
• The legacy clickhouse event store is retired. Task events now go to clickhouse_v2. If you self-host with EVENT_REPOSITORY_DEFAULT_STORE=clickhouse, switch it to clickhouse_v2 and follow the self-hosting guide to copy older events — they won't appear in the dashboard until you do.

Highlights

bun-1.4 runtime

runtime: "bun-1.4" deploys on Bun 1.4.4 in a Bun-only image with no Node.js binary. The run controller itself runs under Bun.

runtime: "bun" is unchanged (Bun 1.3 with Node.js alongside it). bun-legacy is an explicit alias for the same runtime. On Bun 1.4, the worker no longer crashes at startup on the --no-warnings=ExperimentalWarning flag.

Experimental Convex component

The new @trigger.dev/convex package lets you trigger tasks transactionally and read their status and results through reactive Convex queries, without configuring webhooks.

Sub-agent streaming with chat.forwardSubAgent

Stream a sub-agent's reply through a parent tool call without resending the whole message on every chunk. Each chunk is written to the parent chat once and the tool resolves with the sub-agent's final message:

Render the streamed reply with useSubAgentMessages() from @trigger.dev/sdk/chat/react, or createSubAgentMessages() outside React.

Improvements

• runs.subscribeToRun now ends after the run completes. The for await loop exits right after the final status update and the subscription closes its connection, so a script that subscribes to a run exits on its own. Pass stopOnCompletion: false to keep the subscription open after completion.
• Upgraded socket.io-client to 4.8.4, so projects using the SDK and CLI now install ws 8.21 instead of 8.17.1, which has published advisories (GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx).
• Asymmetric webhook sources can now verify ECDSA P-384 signatures (algorithm: "ecdsa-p384", SHA-384) and signatures made over a SHA-256 digest of the signing string (prehash: "sha256"). ECDSA signatures are accepted in DER or raw r||s form.
• Deployed tasks keep a valid short-lived run token for their whole run: the token is refreshed during long runs and before a run resumes from a checkpoint. Short-lived run tokens are now also used for supported SDK operations inside deployed tasks, with environment-key fallback for missing or expired tokens.
• The supervisor keeps its run notification subscriptions across reconnects to the webapp and reconnects when the webapp rejects its handshake, so cancellations and resolved waits reach running tasks after a webapp restart or deploy.
• Run metadata operations now reject JSON-path keys that use escaped dots to reach __proto__, constructor, or prototype.
• SupervisorHttpClient.releaseRun gives back a dequeued run the worker never started, so the platform requeues it immediately instead of waiting for the pending execution timeout.
• The bundled trigger-cost-savings skill now notes that a webhook delivery starts no run when no subscriber's filter matches, so it costs no compute. (#5051)

Bug fixes

• Fix chat.inject messages added from a tool mid-turn being saved before the assistant's response. They now stay after the tool result, preserving the prompt prefix for the next turn. Rolling @trigger.dev/sdk back to an earlier version will lose these mid-turn inject messages from context, though the UI chat history keeps them.
• Fix chat.agent turns failing after a head start that ended with two or more parallel tool calls. When those tools finished out of call order, their results were sent to the model twice and the provider rejected the request. Each handed-over tool result is now sent once.

Server changes

These changes are included in the v4.8.2 Docker image and are already live on Trigger.dev Cloud:

• "Ignored paths" in Git settings: pushes and pull request updates that only change files matching these patterns no longer create a deployment. Ignored paths don't apply while the Vercel integration is connected.
• The metrics query table now includes queue size (queue.size.*) and webhook limit metrics (webhook.waiters.*, webhook.processing.*, webhook.ingress.*), so you can chart and alert on queue capacity and webhook rate limits.
• New Limits alerts: watch the limits that can interrupt or degrade runtime flow, individually or combined into a single alert using "any" or "all" conditions, from the dashboard, the API, and the agent.
• Older runs now load their trace, span details, and run events faster.
• The run page loads large traces progressively and updates live runs incrementally, so large traces open faster and live run pages no longer reload the whole trace on each change. The run trace API can also page large traces.
• Query alerts now accept queries whose columns are computed from other aggregate columns, such as a percentage of two aggregates. When a query can't be watched, the Watch button stays visible but disabled with an explanation.
• Runs whose container or pod could not be created, or whose pod failed before the run started, can now be requeued straight away. Both are off by default: set RELEASE_UNSTARTED_RUNS_ENABLED=true on a supervisor for failed creates, and RELEASE_FAILED_POD_RUNS_ENABLED=true for failed pods.
• Session external ids can no longer contain a /channels path segment or end in :channels. Creating a session with one now returns a 422 validation error.
• Selecting a span that started a session now shows a link to that session in the span panel, so you can jump from an orchestrator's run to its sub-agents.
• Archiving unused queues from the Concurrency page is now available on self-hosted instances.
• Queries using WITH <expression> AS <name> now run instead of failing with a syntax error.
• Changing your email address now requires clicking a confirmation button after opening the emailed link.
• Fix: batch results API was returning an empty list for completed batches. It now returns every run's result in trigger order.
• Fix: batch results API was returning "Batch not found" for some batches that the batch retrieve API could see.
• Fix: run page was continuing to live-update forever for some cancelled runs. These runs now show as finished.
• Fix: fetching the trace of a child run through the API was sometimes very slow or failing.
• Fix: run metadata changes sent with a completion, such as increments and appends, were being applied twice when a completion was retried.
• Fix: intermittent read and subscription errors when multiple clients first open the same realtime stream.
• Fix: intermittent subscription failures and missed records when reading newly created realtime streams.
• Fix: dashboard task list and filters occasionally going stale when several trigger dev sessions register at the same time.
• Fix: dashboard agent's suggested threshold and window being dropped when it prefills a query alert.
• Fix: clock skew between run engine instances could leave a run executing after its task finished, or stop a wait from resuming. Run state changes are now always ordered in the order they happened.
• Fix: a run whose attempt start was interrupted no longer gets stuck executing without its task ever running, then failing as stalled.
• Fix: dropdowns sometimes picking an option by themselves when typing with on-screen keyboards or autofill.
• Fix: new runs a session starts are now always linked to their session, so their Agent tab no longer fails to load.
• Fix: runs no longer lose their worker's token when the cluster answers the worker's create with a 408.
• Fix: deleting an organization now uninstalls its Vercel integration and cancels its billing subscription.
• Promoting or rolling back a deployment now updates webhook endpoints to match the deployment that's now current.

How to upgrade

Update the trigger.dev/* packages to v4.8.2 using your package manager:

Self-hosted users: update your Docker image to ghcr.io/triggerdotdev/trigger.dev:v4.8.2.