diff --git a/.changeset/chat-agent-client-messages.md b/.changeset/chat-agent-client-messages.md deleted file mode 100644 index 3adbb9943e0..00000000000 --- a/.changeset/chat-agent-client-messages.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@trigger.dev/sdk": patch ---- - -`chat.agent` now accepts only two kinds of message from a chat client: user messages, and answers to tool calls the agent made. A tool approval or tool output is merged onto the stored call it answers and runs with the input from the agent's own history, so a client can't add tool calls or change a call's input. `chat.headStart` drops tool calls from the history the client sends, and `upsertIncomingMessage` only adds user messages. diff --git a/.changeset/checkpoint-client-delete-snapshots.md b/.changeset/checkpoint-client-delete-snapshots.md deleted file mode 100644 index 58368e60552..00000000000 --- a/.changeset/checkpoint-client-delete-snapshots.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@trigger.dev/core": patch ---- - -Self-hosted supervisors that run tasks in microVMs can now have a finished run's suspend snapshots deleted from shared storage, instead of leaving them behind. The server-only checkpoint client gains a `deleteSnapshots` call for this. diff --git a/.changeset/cli-login-idle-expiry.md b/.changeset/cli-login-idle-expiry.md deleted file mode 100644 index 6d8bd076989..00000000000 --- a/.changeset/cli-login-idle-expiry.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"trigger.dev": patch ---- - -Logins made with `trigger.dev login` or the MCP server now stop working after 7 days without use. When that happens, the CLI and the MCP server start a new login instead of failing with an auth error, and in CI the CLI says to log in again. Self-hosted instances can change the window with `CLI_LOGIN_IDLE_TIMEOUT_DAYS`, or set it to `0` to turn it off for new logins. Logins made before this change aren't affected. diff --git a/.changeset/convex-agent-skill.md b/.changeset/convex-agent-skill.md deleted file mode 100644 index 7ec8e33df2d..00000000000 --- a/.changeset/convex-agent-skill.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@trigger.dev/convex": patch ---- - -Add a bundled agent skill for integrating Trigger.dev with Convex, including transactional triggering, Realtime progress, recovery, and scoped-token safety. Install it manually from the package; it is not part of the CLI skills installer. diff --git a/.changeset/electric-client-1-3-0.md b/.changeset/electric-client-1-3-0.md deleted file mode 100644 index b2bf0a08155..00000000000 --- a/.changeset/electric-client-1-3-0.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@trigger.dev/core": patch ---- - -Browser realtime subscriptions now resume reliably after the tab is hidden and shown again. This comes from upgrading `@electric-sql/client` to 1.3.0, which also lets apps that depend on 1.3.0 share a single copy with the SDK. diff --git a/.changeset/infisical-oidc.md b/.changeset/infisical-oidc.md deleted file mode 100644 index ca049ae6c8c..00000000000 --- a/.changeset/infisical-oidc.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@trigger.dev/sdk": patch -"trigger.dev": patch ---- - -Add `infisicalAccessToken` at `@trigger.dev/sdk/oidc/infisical` to authenticate tasks with Infisical using OIDC instead of stored credentials. Supports US, EU, and self-hosted instances, custom audiences, and Infisical organization scoping. diff --git a/.changeset/oidc-aws-session-tags.md b/.changeset/oidc-aws-session-tags.md deleted file mode 100644 index c3647b61d97..00000000000 --- a/.changeset/oidc-aws-session-tags.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@trigger.dev/sdk": patch -"@trigger.dev/core": patch ---- - -Add opt-in AWS session tags with `awsCredentialProvider({ sessionTags: true })` for task-level IAM restrictions and attribute-based permissions. Tags come from the verified run identity. Update the role trust policy to allow `sts:TagSession` before enabling them; existing integrations remain untagged. diff --git a/.changeset/run-token-environment-operations.md b/.changeset/run-token-environment-operations.md deleted file mode 100644 index 87d1daef555..00000000000 --- a/.changeset/run-token-environment-operations.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@trigger.dev/core": patch -"@trigger.dev/sdk": patch ---- - -Use run credentials for run results, rescheduling, schedules, and environment-variable operations inside tasks. Run credentials remain limited to the current environment: shared schedules cannot be changed, and parent environment variables cannot be written. diff --git a/.changeset/run-token-scopeless-public-token.md b/.changeset/run-token-scopeless-public-token.md deleted file mode 100644 index 4b50ef6a805..00000000000 --- a/.changeset/run-token-scopeless-public-token.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@trigger.dev/sdk": patch ---- - -Create public tokens without scopes from inside tasks using run credentials, without requiring an environment secret key. diff --git a/.changeset/trusted-github-deploys.md b/.changeset/trusted-github-deploys.md deleted file mode 100644 index a669b0478b9..00000000000 --- a/.changeset/trusted-github-deploys.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"trigger.dev": patch -"@trigger.dev/core": patch ---- - -Deploy from GitHub Actions using Trusted publishing and GitHub OIDC without storing a Trigger.dev API key. These deployments run entirely on the build server and do not grant the CLI access to environment variables. diff --git a/.changeset/trusted-publishing-lifecycle.md b/.changeset/trusted-publishing-lifecycle.md deleted file mode 100644 index 161d6fd846e..00000000000 --- a/.changeset/trusted-publishing-lifecycle.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"trigger.dev": patch -"@trigger.dev/core": patch ---- - -Use GitHub Actions trusted publishing with `preview archive` and `promote`, without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. `preview archive` also supports Preview environment API keys through `TRIGGER_ACCESS_TOKEN`. - -Failed Preview archive operations now exit with an error for API-key and personal-token authentication too, including automatic cleanup during deploys. CI cleanup jobs that previously passed despite an archive failure will now fail. Concurrent cleanup jobs succeed when another job has already archived the same branch generation. diff --git a/.changeset/unflatten-numeric-keys.md b/.changeset/unflatten-numeric-keys.md deleted file mode 100644 index 402ee4448f4..00000000000 --- a/.changeset/unflatten-numeric-keys.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@trigger.dev/core": patch ---- - -Fix logs and spans with large numeric object keys failing to ingest and dropping the rest of their batch. diff --git a/.server-changes/alerts-delete-write-permission.md b/.server-changes/alerts-delete-write-permission.md deleted file mode 100644 index de728a402b4..00000000000 --- a/.server-changes/alerts-delete-write-permission.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: fix ---- - -Alerts: Admins and Developers can delete alerts; health metric charts use straight segments. diff --git a/.server-changes/alerts-no-chat-notifier.md b/.server-changes/alerts-no-chat-notifier.md deleted file mode 100644 index 20eac67f8c4..00000000000 --- a/.server-changes/alerts-no-chat-notifier.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: improvement ---- - -Alerts now require at least one channel (email, Slack or webhook). The option to notify the Dashboard Agent chat has been removed. diff --git a/.server-changes/alerts-query-period.md b/.server-changes/alerts-query-period.md deleted file mode 100644 index d7be8150d23..00000000000 --- a/.server-changes/alerts-query-period.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: fix ---- - -Alert charts and alert evaluation are no longer limited by the plan's query period. diff --git a/.server-changes/api-key-custom-access.md b/.server-changes/api-key-custom-access.md deleted file mode 100644 index f5edb6e72a3..00000000000 --- a/.server-changes/api-key-custom-access.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: feature ---- - -API keys can have custom access: combine access presets or set a level for each area, such as Runs or Deployments, optionally limited to selected tasks. Edit access changes what an existing key can do without rotating it, and the API keys page marks keys whose access differs from their preset today. diff --git a/.server-changes/api-key-custom-expiry-date.md b/.server-changes/api-key-custom-expiry-date.md deleted file mode 100644 index b43aed3921a..00000000000 --- a/.server-changes/api-key-custom-expiry-date.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: feature ---- - -New API keys can expire on a custom date. Pick **Custom date** in the Expires menu and choose a day from the calendar; the key stops working at the end of that day in your local time zone. diff --git a/.server-changes/api-key-expiry-picker.md b/.server-changes/api-key-expiry-picker.md deleted file mode 100644 index 2c0f3a5c11d..00000000000 --- a/.server-changes/api-key-expiry-picker.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: improvement ---- - -Choose an API key's expiry from presets or a calendar in one picker, with date previews and expiration at the end of the chosen day in UTC. diff --git a/.server-changes/api-key-ip-allowlist.md b/.server-changes/api-key-ip-allowlist.md deleted file mode 100644 index 15a01048f7c..00000000000 --- a/.server-changes/api-key-ip-allowlist.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: feature ---- - -Restrict an API key to a list of IP addresses so requests using it from anywhere else are rejected. Set the list when creating a key or edit it later from the API keys page, which now also shows the IP address each key was last used from. diff --git a/.server-changes/api-key-saved-presets.md b/.server-changes/api-key-saved-presets.md deleted file mode 100644 index 79dd155db4a..00000000000 --- a/.server-changes/api-key-saved-presets.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: feature ---- - -Organizations can save custom API key access as a preset and reuse it when creating keys in any project. Saved presets appear under Your presets in the access picker, and organization Owners and Admins can save and delete them. diff --git a/.server-changes/api-key-scope-usage.md b/.server-changes/api-key-scope-usage.md deleted file mode 100644 index facf6eba6a2..00000000000 --- a/.server-changes/api-key-scope-usage.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: feature ---- - -Click an API key to see its access, when it last used each area, and its details in a side panel. From there you can narrow a key to what it used in the last 30 days, without changing its secret. diff --git a/.server-changes/api-keys-page-polish.md b/.server-changes/api-keys-page-polish.md deleted file mode 100644 index 044d45f21f8..00000000000 --- a/.server-changes/api-keys-page-polish.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: improvement ---- - -The API keys page shows when each key expires and when it was revoked, and the "How to set env vars" dialog no longer displays your secret key. Custom access is now a table of levels for each area, and options a key can't use are shown disabled with the reason. diff --git a/.server-changes/cap-project-jwt-lifetime.md b/.server-changes/cap-project-jwt-lifetime.md deleted file mode 100644 index 369fd4c231b..00000000000 --- a/.server-changes/cap-project-jwt-lifetime.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: fix ---- - -Project JWT minting now rejects expiration times longer than 24 hours. diff --git a/.server-changes/enforce-session-deadline-every-request.md b/.server-changes/enforce-session-deadline-every-request.md deleted file mode 100644 index 934ff6e2d0b..00000000000 --- a/.server-changes/enforce-session-deadline-every-request.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: fix ---- - -Dashboard sessions past their deadline now end on their next request, including background data requests and form submissions, not only on page navigation. diff --git a/.server-changes/env-vars-environment-filter.md b/.server-changes/env-vars-environment-filter.md deleted file mode 100644 index 86f1271d37b..00000000000 --- a/.server-changes/env-vars-environment-filter.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: improvement ---- - -The Environment variables page now filters by environment, opening on the environment you're in, with a picker for preview branches. Deleting a variable asks for confirmation first. diff --git a/.server-changes/fix-duration-wait-details.md b/.server-changes/fix-duration-wait-details.md deleted file mode 100644 index 5d54524c765..00000000000 --- a/.server-changes/fix-duration-wait-details.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: fix ---- - -Restore duration wait details and the Skip waitpoint action in the dashboard. diff --git a/.server-changes/fix-logs-page-access.md b/.server-changes/fix-logs-page-access.md deleted file mode 100644 index 8b95caa6a10..00000000000 --- a/.server-changes/fix-logs-page-access.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: fix ---- - -Fix the Logs page redirecting to Tasks when Logs is visible in the sidebar. diff --git a/.server-changes/group-alerts-from-list.md b/.server-changes/group-alerts-from-list.md deleted file mode 100644 index 2cdd68896cb..00000000000 --- a/.server-changes/group-alerts-from-list.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: feature ---- - -Alerts can be grouped: select alerts in the list and create a group that raises when any or all of them fire, with its own channels and expiry. Members keep evaluating but notify only through the group. Groups can also be created through the API, with their members in one call. diff --git a/.server-changes/health-all-components.md b/.server-changes/health-all-components.md deleted file mode 100644 index 8f238a04f34..00000000000 --- a/.server-changes/health-all-components.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: feature ---- - -Health alerts can now watch a chosen subset of checks — flow, execution and liveness — instead of all three. diff --git a/.server-changes/org-scoped-oidc.md b/.server-changes/org-scoped-oidc.md deleted file mode 100644 index ade0890e899..00000000000 --- a/.server-changes/org-scoped-oidc.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: breaking ---- - -OIDC workload identity now uses an organization-specific issuer URL; update your external service's identity provider and trust policies to use the issuer shown on your environment's OpenID Connect (OIDC) page. diff --git a/.server-changes/parallel-first-deploys.md b/.server-changes/parallel-first-deploys.md deleted file mode 100644 index eb3b2af59a3..00000000000 --- a/.server-changes/parallel-first-deploys.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: fix ---- - -Fix a new project's first deploys failing with "Failed to get deployment image ref" when two of them start at the same time. diff --git a/.server-changes/personal-access-token-expiry-emails.md b/.server-changes/personal-access-token-expiry-emails.md deleted file mode 100644 index 08c510dad1a..00000000000 --- a/.server-changes/personal-access-token-expiry-emails.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: feature ---- - -Email the owner of a dashboard-created personal access token 7 days before it expires, and again when it has, so a CI deploy using it doesn't break by surprise. Set `PERSONAL_ACCESS_TOKEN_EXPIRY_EMAILS_ENABLED=false` to turn them off. diff --git a/.server-changes/personal-access-token-expiry.md b/.server-changes/personal-access-token-expiry.md deleted file mode 100644 index d1c5162ccdc..00000000000 --- a/.server-changes/personal-access-token-expiry.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: feature ---- - -Personal access tokens created on the dashboard now expire after the lifetime you choose (30, 90 or 365 days by default). Requests made with an expired token get an error that says when it expired and where to create a new one. Existing tokens keep working as before. diff --git a/.server-changes/scoped-credentials-offloaded-trigger-payloads.md b/.server-changes/scoped-credentials-offloaded-trigger-payloads.md deleted file mode 100644 index da888a23b36..00000000000 --- a/.server-changes/scoped-credentials-offloaded-trigger-payloads.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: fix ---- - -Triggering a task with a payload over the offload threshold from inside a running task works again. Run-scoped tokens and restricted API keys upload offloaded payloads into their own namespace and may only trigger with payloads they uploaded, while pointers at other runs' stored payloads or outputs are still rejected. diff --git a/.server-changes/sidemenu-security-section.md b/.server-changes/sidemenu-security-section.md deleted file mode 100644 index edb39dac07b..00000000000 --- a/.server-changes/sidemenu-security-section.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: improvement ---- - -The side menu has a new Security section, just above Manage, that groups API keys, Environment variables, Trusted publishing and OIDC. diff --git a/.server-changes/supervisor-cold-start-heartbeat.md b/.server-changes/supervisor-cold-start-heartbeat.md deleted file mode 100644 index cbd39b0ae79..00000000000 --- a/.server-changes/supervisor-cold-start-heartbeat.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: supervisor -type: fix ---- - -Stop runs that wait a long time for capacity from being requeued and started a second time while their first start is still pending. diff --git a/.server-changes/trusted-publishing-long-repo-names.md b/.server-changes/trusted-publishing-long-repo-names.md deleted file mode 100644 index 9660c14ba33..00000000000 --- a/.server-changes/trusted-publishing-long-repo-names.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -area: webapp -type: fix ---- - -Long GitHub organization and repository names on the Trusted publishing page now stay on one line and truncate, with the full name shown on hover. diff --git a/hosting/k8s/helm/Chart.yaml b/hosting/k8s/helm/Chart.yaml index 3b19256910b..b7c9b3882d9 100644 --- a/hosting/k8s/helm/Chart.yaml +++ b/hosting/k8s/helm/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 name: trigger description: The official Trigger.dev Helm chart type: application -version: 4.8.3 -appVersion: v4.8.3 +version: 4.8.4 +appVersion: v4.8.4 home: https://trigger.dev sources: - https://github.com/triggerdotdev/trigger.dev diff --git a/packages/build/CHANGELOG.md b/packages/build/CHANGELOG.md index c6bcd439bcd..cdea11ad009 100644 --- a/packages/build/CHANGELOG.md +++ b/packages/build/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/build +## 4.8.4 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/build/package.json b/packages/build/package.json index 52e4c2c690e..6f5a1750c7c 100644 --- a/packages/build/package.json +++ b/packages/build/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/build", - "version": "4.8.3", + "version": "4.8.4", "description": "trigger.dev build extensions", "license": "MIT", "publishConfig": { @@ -82,7 +82,7 @@ }, "dependencies": { "@prisma/config": "^6.10.0", - "@trigger.dev/core": "workspace:4.8.3", + "@trigger.dev/core": "workspace:4.8.4", "mlly": "^1.7.1", "pkg-types": "^1.1.3", "tinyglobby": "^0.2.2", diff --git a/packages/cli-v3/CHANGELOG.md b/packages/cli-v3/CHANGELOG.md index b27f1abbee9..c297dab4449 100644 --- a/packages/cli-v3/CHANGELOG.md +++ b/packages/cli-v3/CHANGELOG.md @@ -1,5 +1,21 @@ # trigger.dev +## 4.8.4 + +### Patch Changes + +- Logins made with `trigger.dev login` or the MCP server now stop working after 7 days without use. When that happens, the CLI and the MCP server start a new login instead of failing with an auth error, and in CI the CLI says to log in again. Self-hosted instances can change the window with `CLI_LOGIN_IDLE_TIMEOUT_DAYS`, or set it to `0` to turn it off for new logins. Logins made before this change aren't affected. ([`c8ee9e309`](https://github.com/triggerdotdev/trigger.dev/commit/c8ee9e309fe1f09025f6c5dc1fbab8107933dec3)) +- Add `infisicalAccessToken` at `@trigger.dev/sdk/oidc/infisical` to authenticate tasks with Infisical using OIDC instead of stored credentials. Supports US, EU, and self-hosted instances, custom audiences, and Infisical organization scoping. ([`63b58f329`](https://github.com/triggerdotdev/trigger.dev/commit/63b58f329012475941cef93b3440cca09514fee0)) +- Deploy from GitHub Actions using Trusted publishing and GitHub OIDC without storing a Trigger.dev API key. These deployments run entirely on the build server and do not grant the CLI access to environment variables. ([`9aafe6989`](https://github.com/triggerdotdev/trigger.dev/commit/9aafe6989af028bc7c9dc96f9d2f1c027ec3323c)) +- Use GitHub Actions trusted publishing with `preview archive` and `promote`, without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. `preview archive` also supports Preview environment API keys through `TRIGGER_ACCESS_TOKEN`. ([`d9172638a`](https://github.com/triggerdotdev/trigger.dev/commit/d9172638a9679c1f698a1b04b35d2cc7abae5fa3)) + + Failed Preview archive operations now exit with an error for API-key and personal-token authentication too, including automatic cleanup during deploys. CI cleanup jobs that previously passed despite an archive failure will now fail. Concurrent cleanup jobs succeed when another job has already archived the same branch generation. + +- Updated dependencies: + - `@trigger.dev/core@4.8.4` + - `@trigger.dev/build@4.8.4` + - `@trigger.dev/schema-to-json@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/cli-v3/package.json b/packages/cli-v3/package.json index b81cde5ebba..bd83dcfb650 100644 --- a/packages/cli-v3/package.json +++ b/packages/cli-v3/package.json @@ -1,6 +1,6 @@ { "name": "trigger.dev", - "version": "4.8.3", + "version": "4.8.4", "description": "A Command-Line Interface for Trigger.dev projects", "type": "module", "license": "MIT", @@ -84,9 +84,9 @@ "@opentelemetry/api-logs": "0.219.0", "@opentelemetry/instrumentation": "0.219.0", "@s2-dev/streamstore": "^0.25.0", - "@trigger.dev/build": "workspace:4.8.3", - "@trigger.dev/core": "workspace:4.8.3", - "@trigger.dev/schema-to-json": "workspace:4.8.3", + "@trigger.dev/build": "workspace:4.8.4", + "@trigger.dev/core": "workspace:4.8.4", + "@trigger.dev/schema-to-json": "workspace:4.8.4", "ansi-escapes": "^7.0.0", "braces": "^3.0.3", "c12": "^1.11.1", diff --git a/packages/convex/CHANGELOG.md b/packages/convex/CHANGELOG.md index 91708022318..8e9219c8605 100644 --- a/packages/convex/CHANGELOG.md +++ b/packages/convex/CHANGELOG.md @@ -1,5 +1,11 @@ # @trigger.dev/convex +## 4.8.4 + +### Patch Changes + +- Add a bundled agent skill for integrating Trigger.dev with Convex, including transactional triggering, Realtime progress, recovery, and scoped-token safety. Install it manually from the package; it is not part of the CLI skills installer. ([`9422dc65d`](https://github.com/triggerdotdev/trigger.dev/commit/9422dc65d26e745a8d3670a7977d04b938553d9d)) + ## 4.8.3 ### Patch Changes diff --git a/packages/convex/package.json b/packages/convex/package.json index b5f1cd9ba75..af12062f57a 100644 --- a/packages/convex/package.json +++ b/packages/convex/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/convex", - "version": "4.8.3", + "version": "4.8.4", "description": "Run Trigger.dev tasks from Convex mutations and query their results reactively", "license": "Apache-2.0", "type": "module", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index c44166d6651..380e1fdb262 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,20 @@ # internal-platform +## 4.8.4 + +### Patch Changes + +- Self-hosted supervisors that run tasks in microVMs can now have a finished run's suspend snapshots deleted from shared storage, instead of leaving them behind. The server-only checkpoint client gains a `deleteSnapshots` call for this. ([`95f4cbbad`](https://github.com/triggerdotdev/trigger.dev/commit/95f4cbbad711ea245778d05a2e9951331a325f82)) +- Browser realtime subscriptions now resume reliably after the tab is hidden and shown again. This comes from upgrading `@electric-sql/client` to 1.3.0, which also lets apps that depend on 1.3.0 share a single copy with the SDK. ([`3900d8906`](https://github.com/triggerdotdev/trigger.dev/commit/3900d8906e3a307acf4879a70ab0cbac5d1f8cb8)) +- Add opt-in AWS session tags with `awsCredentialProvider({ sessionTags: true })` for task-level IAM restrictions and attribute-based permissions. Tags come from the verified run identity. Update the role trust policy to allow `sts:TagSession` before enabling them; existing integrations remain untagged. ([`c8ae1ffb5`](https://github.com/triggerdotdev/trigger.dev/commit/c8ae1ffb588895a0ffb8c0dbdcaa1d6e19671edc)) +- Use run credentials for run results, rescheduling, schedules, and environment-variable operations inside tasks. Run credentials remain limited to the current environment: shared schedules cannot be changed, and parent environment variables cannot be written. ([`cd58c750b`](https://github.com/triggerdotdev/trigger.dev/commit/cd58c750b878d39e16acde163b751de2e7491ac0)) +- Deploy from GitHub Actions using Trusted publishing and GitHub OIDC without storing a Trigger.dev API key. These deployments run entirely on the build server and do not grant the CLI access to environment variables. ([`9aafe6989`](https://github.com/triggerdotdev/trigger.dev/commit/9aafe6989af028bc7c9dc96f9d2f1c027ec3323c)) +- Use GitHub Actions trusted publishing with `preview archive` and `promote`, without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. `preview archive` also supports Preview environment API keys through `TRIGGER_ACCESS_TOKEN`. ([`d9172638a`](https://github.com/triggerdotdev/trigger.dev/commit/d9172638a9679c1f698a1b04b35d2cc7abae5fa3)) + + Failed Preview archive operations now exit with an error for API-key and personal-token authentication too, including automatic cleanup during deploys. CI cleanup jobs that previously passed despite an archive failure will now fail. Concurrent cleanup jobs succeed when another job has already archived the same branch generation. + +- Fix logs and spans with large numeric object keys failing to ingest and dropping the rest of their batch. ([`99a626aa3`](https://github.com/triggerdotdev/trigger.dev/commit/99a626aa3b215b55f5fbfa1dddcfe34ae231e932)) + ## 4.8.3 ### Patch Changes diff --git a/packages/core/package.json b/packages/core/package.json index cf536ce3235..645ca42a93a 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/core", - "version": "4.8.3", + "version": "4.8.4", "description": "Core code used across the Trigger.dev SDK and platform", "license": "MIT", "publishConfig": { diff --git a/packages/linear/CHANGELOG.md b/packages/linear/CHANGELOG.md index 45b6397856b..eff3774b8f6 100644 --- a/packages/linear/CHANGELOG.md +++ b/packages/linear/CHANGELOG.md @@ -1,5 +1,13 @@ # @trigger.dev/linear +## 4.8.4 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/sdk@4.8.4` + - `@trigger.dev/core@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/linear/package.json b/packages/linear/package.json index aeffae3eb52..0e07447543d 100644 --- a/packages/linear/package.json +++ b/packages/linear/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/linear", - "version": "4.8.3", + "version": "4.8.4", "description": "Linear agent sessions as a chat frontend (channel) for trigger.dev agents", "license": "MIT", "publishConfig": { @@ -41,15 +41,15 @@ "check-exports": "attw --pack ." }, "dependencies": { - "@trigger.dev/core": "workspace:4.8.3" + "@trigger.dev/core": "workspace:4.8.4" }, "peerDependencies": { - "@trigger.dev/sdk": "workspace:^4.8.3", + "@trigger.dev/sdk": "workspace:^4.8.4", "ai": "^5.0.0 || ^6.0.0 || >=7.0.0-canary <8" }, "devDependencies": { "@arethetypeswrong/cli": "^0.18.5", - "@trigger.dev/sdk": "workspace:4.8.3", + "@trigger.dev/sdk": "workspace:4.8.4", "@types/node": "^24.13.3", "rimraf": "6.0.1", "tshy": "^3.0.2", diff --git a/packages/python/CHANGELOG.md b/packages/python/CHANGELOG.md index 0c672270d7c..1c59958cc1c 100644 --- a/packages/python/CHANGELOG.md +++ b/packages/python/CHANGELOG.md @@ -1,5 +1,14 @@ # @trigger.dev/python +## 4.8.4 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/sdk@4.8.4` + - `@trigger.dev/core@4.8.4` + - `@trigger.dev/build@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/python/package.json b/packages/python/package.json index b9d69f2d58d..c70941bc993 100644 --- a/packages/python/package.json +++ b/packages/python/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/python", - "version": "4.8.3", + "version": "4.8.4", "description": "Python runtime and build extension for Trigger.dev", "license": "MIT", "publishConfig": { @@ -45,7 +45,7 @@ "check-exports": "attw --pack ." }, "dependencies": { - "@trigger.dev/core": "workspace:4.8.3", + "@trigger.dev/core": "workspace:4.8.4", "tinyexec": "^0.3.2" }, "devDependencies": { @@ -55,12 +55,12 @@ "typescript": "catalog:", "tsx": "4.17.0", "@arethetypeswrong/cli": "^0.18.5", - "@trigger.dev/build": "workspace:4.8.3", - "@trigger.dev/sdk": "workspace:4.8.3" + "@trigger.dev/build": "workspace:4.8.4", + "@trigger.dev/sdk": "workspace:4.8.4" }, "peerDependencies": { - "@trigger.dev/sdk": "workspace:^4.8.3", - "@trigger.dev/build": "workspace:^4.8.3" + "@trigger.dev/sdk": "workspace:^4.8.4", + "@trigger.dev/build": "workspace:^4.8.4" }, "engines": { "node": ">=18.20.0" diff --git a/packages/react-hooks/CHANGELOG.md b/packages/react-hooks/CHANGELOG.md index 4fd51c1a16d..e51292d79fd 100644 --- a/packages/react-hooks/CHANGELOG.md +++ b/packages/react-hooks/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/react-hooks +## 4.8.4 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/react-hooks/package.json b/packages/react-hooks/package.json index 657acbe17ad..c52f693cd89 100644 --- a/packages/react-hooks/package.json +++ b/packages/react-hooks/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/react-hooks", - "version": "4.8.3", + "version": "4.8.4", "description": "trigger.dev react hooks", "license": "MIT", "publishConfig": { @@ -37,7 +37,7 @@ "check-exports": "attw --pack ." }, "dependencies": { - "@trigger.dev/core": "workspace:^4.8.3", + "@trigger.dev/core": "workspace:^4.8.4", "swr": "^2.2.5" }, "devDependencies": { diff --git a/packages/redis-worker/CHANGELOG.md b/packages/redis-worker/CHANGELOG.md index 0b8e6ebefec..a3fb2131957 100644 --- a/packages/redis-worker/CHANGELOG.md +++ b/packages/redis-worker/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/redis-worker +## 4.8.4 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/redis-worker/package.json b/packages/redis-worker/package.json index 90eec6b7be3..93a49da7dbd 100644 --- a/packages/redis-worker/package.json +++ b/packages/redis-worker/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/redis-worker", - "version": "4.8.3", + "version": "4.8.4", "description": "Redis worker for trigger.dev", "license": "MIT", "publishConfig": { @@ -23,7 +23,7 @@ "test": "vitest --sequence.concurrent=false --no-file-parallelism" }, "dependencies": { - "@trigger.dev/core": "workspace:4.8.3", + "@trigger.dev/core": "workspace:4.8.4", "nanoid": "^5.1.16", "p-limit": "^6.2.0", "seedrandom": "^3.0.5", diff --git a/packages/rsc/CHANGELOG.md b/packages/rsc/CHANGELOG.md index 06b91062d86..ebf60a549cf 100644 --- a/packages/rsc/CHANGELOG.md +++ b/packages/rsc/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/rsc +## 4.8.4 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/rsc/package.json b/packages/rsc/package.json index 87c5db04ce7..d1249d892b1 100644 --- a/packages/rsc/package.json +++ b/packages/rsc/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/rsc", - "version": "4.8.3", + "version": "4.8.4", "description": "trigger.dev rsc", "license": "MIT", "publishConfig": { @@ -37,7 +37,7 @@ "check-exports": "attw --pack ." }, "dependencies": { - "@trigger.dev/core": "workspace:^4.8.3", + "@trigger.dev/core": "workspace:^4.8.4", "mlly": "^1.7.1", "react": "19.0.0-rc.1", "react-dom": "19.0.0-rc.1" diff --git a/packages/schema-to-json/CHANGELOG.md b/packages/schema-to-json/CHANGELOG.md index 6b9a2b7e90c..e72bc08bbbb 100644 --- a/packages/schema-to-json/CHANGELOG.md +++ b/packages/schema-to-json/CHANGELOG.md @@ -1,5 +1,12 @@ # @trigger.dev/schema-to-json +## 4.8.4 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/core@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/schema-to-json/package.json b/packages/schema-to-json/package.json index 97a3a16bdba..09bb715ccc4 100644 --- a/packages/schema-to-json/package.json +++ b/packages/schema-to-json/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/schema-to-json", - "version": "4.8.3", + "version": "4.8.4", "description": "Convert various schema validation libraries to JSON Schema", "license": "MIT", "publishConfig": { diff --git a/packages/slack/CHANGELOG.md b/packages/slack/CHANGELOG.md index c6b1977fd04..080be6672ae 100644 --- a/packages/slack/CHANGELOG.md +++ b/packages/slack/CHANGELOG.md @@ -1,5 +1,13 @@ # @trigger.dev/slack +## 4.8.4 + +### Patch Changes + +- Updated dependencies: + - `@trigger.dev/sdk@4.8.4` + - `@trigger.dev/core@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/slack/package.json b/packages/slack/package.json index 17ef2e17411..520fea2cf5e 100644 --- a/packages/slack/package.json +++ b/packages/slack/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/slack", - "version": "4.8.3", + "version": "4.8.4", "description": "Slack chat frontend (channel) for trigger.dev agents", "license": "MIT", "publishConfig": { @@ -41,14 +41,14 @@ "check-exports": "attw --pack ." }, "dependencies": { - "@trigger.dev/core": "workspace:4.8.3" + "@trigger.dev/core": "workspace:4.8.4" }, "peerDependencies": { - "@trigger.dev/sdk": "workspace:^4.8.3" + "@trigger.dev/sdk": "workspace:^4.8.4" }, "devDependencies": { "@arethetypeswrong/cli": "^0.18.5", - "@trigger.dev/sdk": "workspace:4.8.3", + "@trigger.dev/sdk": "workspace:4.8.4", "@types/node": "^24.13.3", "rimraf": "6.0.1", "tshy": "^3.0.2", diff --git a/packages/trigger-sdk/CHANGELOG.md b/packages/trigger-sdk/CHANGELOG.md index 59877132957..18ce2d00669 100644 --- a/packages/trigger-sdk/CHANGELOG.md +++ b/packages/trigger-sdk/CHANGELOG.md @@ -1,5 +1,17 @@ # @trigger.dev/sdk +## 4.8.4 + +### Patch Changes + +- `chat.agent` now accepts only two kinds of message from a chat client: user messages, and answers to tool calls the agent made. A tool approval or tool output is merged onto the stored call it answers and runs with the input from the agent's own history, so a client can't add tool calls or change a call's input. `chat.headStart` drops tool calls from the history the client sends, and `upsertIncomingMessage` only adds user messages. ([`44feaaff6`](https://github.com/triggerdotdev/trigger.dev/commit/44feaaff6ea10019af1a24b009609ff25c813c15)) +- Add `infisicalAccessToken` at `@trigger.dev/sdk/oidc/infisical` to authenticate tasks with Infisical using OIDC instead of stored credentials. Supports US, EU, and self-hosted instances, custom audiences, and Infisical organization scoping. ([`63b58f329`](https://github.com/triggerdotdev/trigger.dev/commit/63b58f329012475941cef93b3440cca09514fee0)) +- Add opt-in AWS session tags with `awsCredentialProvider({ sessionTags: true })` for task-level IAM restrictions and attribute-based permissions. Tags come from the verified run identity. Update the role trust policy to allow `sts:TagSession` before enabling them; existing integrations remain untagged. ([`c8ae1ffb5`](https://github.com/triggerdotdev/trigger.dev/commit/c8ae1ffb588895a0ffb8c0dbdcaa1d6e19671edc)) +- Use run credentials for run results, rescheduling, schedules, and environment-variable operations inside tasks. Run credentials remain limited to the current environment: shared schedules cannot be changed, and parent environment variables cannot be written. ([`cd58c750b`](https://github.com/triggerdotdev/trigger.dev/commit/cd58c750b878d39e16acde163b751de2e7491ac0)) +- Create public tokens without scopes from inside tasks using run credentials, without requiring an environment secret key. ([`306d960ca`](https://github.com/triggerdotdev/trigger.dev/commit/306d960caadf4cbe123a205cb4934d071611b360)) +- Updated dependencies: + - `@trigger.dev/core@4.8.4` + ## 4.8.3 ### Patch Changes diff --git a/packages/trigger-sdk/package.json b/packages/trigger-sdk/package.json index 9da5fd59060..fc3be9c2803 100644 --- a/packages/trigger-sdk/package.json +++ b/packages/trigger-sdk/package.json @@ -1,6 +1,6 @@ { "name": "@trigger.dev/sdk", - "version": "4.8.3", + "version": "4.8.4", "description": "trigger.dev Node.JS SDK", "license": "MIT", "publishConfig": { @@ -88,7 +88,7 @@ "dependencies": { "@opentelemetry/api": "1.9.1", "@opentelemetry/semantic-conventions": "1.41.1", - "@trigger.dev/core": "workspace:4.8.3", + "@trigger.dev/core": "workspace:4.8.4", "uncrypto": "^0.1.3" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7c0b74523f4..d200d703b71 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1590,7 +1590,7 @@ importers: specifier: ^6.10.0 version: 6.19.0(magicast@0.3.5) '@trigger.dev/core': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../core mlly: specifier: ^1.7.1 @@ -1657,13 +1657,13 @@ importers: specifier: ^0.25.0 version: 0.25.0(supports-color@10.0.0) '@trigger.dev/build': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../build '@trigger.dev/core': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../core '@trigger.dev/schema-to-json': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../schema-to-json ansi-escapes: specifier: ^7.0.0 @@ -1992,14 +1992,14 @@ importers: packages/linear: dependencies: '@trigger.dev/core': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../core devDependencies: '@arethetypeswrong/cli': specifier: ^0.18.5 version: 0.18.5 '@trigger.dev/sdk': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../trigger-sdk '@types/node': specifier: 24.13.3 @@ -2042,7 +2042,7 @@ importers: packages/python: dependencies: '@trigger.dev/core': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../core tinyexec: specifier: ^0.3.2 @@ -2052,10 +2052,10 @@ importers: specifier: ^0.18.5 version: 0.18.5 '@trigger.dev/build': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../build '@trigger.dev/sdk': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../trigger-sdk '@types/node': specifier: 24.13.3 @@ -2076,7 +2076,7 @@ importers: packages/react-hooks: dependencies: '@trigger.dev/core': - specifier: workspace:^4.8.3 + specifier: workspace:^4.8.4 version: link:../core react: specifier: 18.3.1 @@ -2110,7 +2110,7 @@ importers: packages/redis-worker: dependencies: '@trigger.dev/core': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../core cron-parser: specifier: ^4.9.0 @@ -2156,7 +2156,7 @@ importers: packages/rsc: dependencies: '@trigger.dev/core': - specifier: workspace:^4.8.3 + specifier: workspace:^4.8.4 version: link:../core mlly: specifier: ^1.7.1 @@ -2236,14 +2236,14 @@ importers: packages/slack: dependencies: '@trigger.dev/core': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../core devDependencies: '@arethetypeswrong/cli': specifier: ^0.18.5 version: 0.18.5 '@trigger.dev/sdk': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../trigger-sdk '@types/node': specifier: 24.13.3 @@ -2270,7 +2270,7 @@ importers: specifier: 1.41.1 version: 1.41.1 '@trigger.dev/core': - specifier: workspace:4.8.3 + specifier: workspace:4.8.4 version: link:../core react: specifier: 18.3.1