Trigger.dev v4.8.3

1 new feature, 3 improvements, 2 bug fixes, and 5 server changes.

Highlights

Webhook secret commands

trigger webhooks set-secret and trigger webhooks generate-secret store a webhook endpoint's signing secret without ever printing it. set-secret reads a secret your provider issued from a pipe, an environment variable, or your .env files. generate-secret creates a new secret and saves it to an env file.

When the endpoint already has a secret, both ask how long the old one keeps working, or take --previous-secret-ttl 24h in scripts. The MCP server now points AI agents at these commands, so secrets stay out of the agent's context. (daaaa41)

Improvements

• The legacy Bun runtime is deprecated. runtime: "bun" (alias "bun-legacy") now warns on deploy and will be rejected from January 5, 2027. Switch to runtime: "bun-1.4" and redeploy. (5f8171c)
• trigger.refresh(ctx, id) requests an earlier status check for a Convex-tracked run, so apps using Realtime can publish results without waiting for the next poll. Requests are coalesced and rate-limited, and polling remains as a fallback. (ee5e5da)
• CLI and MCP logins are now bound to the machine that started them. Approving in your browser returns you to the CLI. If the browser is on another machine, you get a code to paste into the terminal (or pass with trigger.dev login --code). Older CLI versions must upgrade to log in. (1a36c23)

Bug fixes

• Fix parent and root metadata updates being lost after one update fails to apply. Only the failing update is skipped. Root-only keys such as $. or $.. are now ignored on a run's own metadata instead of throwing, and rejected for parent and root metadata. (53441fd)
• Fix reloading a chat mid-turn after a token refresh failing with "No tool invocation found for tool call ID". The resume cursor now stays at the start of the turn until it completes, so a reload replays the full turn. (9fd1de6)

Server changes

These changes are included in the v4.8.3 Docker image and are already live on Trigger.dev Cloud:

• The CLI and MCP login consent page shows when and from which IP the login started, and you get an email whenever a new login is authorized on your account.
• Searching, filtering to errors, and expanding or collapsing spans in the run trace view are faster on large traces.
• The dashboard now guides you from a shared root key to individual API keys. Root key regeneration stays available.
• CLI and MCP login codes are single use, and each login mints its own personal access token.
• Fix: run traces occasionally went missing when a span recorded an exception with no message, type, or stack trace.

How to upgrade

Update the trigger.dev/* packages to v4.8.3 using your package manager:

Self-hosted users: update your Docker image to ghcr.io/triggerdotdev/trigger.dev:v4.8.3.