Trigger.dev v4.8.5

1 improvement and 1 server change.

Most tasks are not affected. The high severity issues only matter if your task code, or a package it uses, runs an HTTP/2 or HTTPS server inside the task. Regular outbound calls with fetch, node:http or node:https (calling APIs, databases or LLM providers) are not affected by them. To get the fix, upgrade the CLI to 4.8.5 and redeploy.

Improvements

• Tasks on the node, node-22, node-24, and node-26 runtimes now run on Node.js 22.23.5, 24.22.3, and 26.13.1, the November 2026 security releases. These fix several high severity vulnerabilities in HTTP/2 and TLS: CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-123872, and CVE-2026-123874, plus CVE-2026-126051 on Node.js 24 and 26. Existing deployments keep the old runtime until you redeploy with this version.

Server changes

These changes are included in the v4.8.5 Docker image:

• The webapp and supervisor images now run on Node.js 24.22.3, the November 2026 security release.

How to upgrade

Update the trigger.dev/* packages to v4.8.5 using your package manager:

Self-hosted users: update your Docker image to ghcr.io/triggerdotdev/trigger.dev:v4.8.5.