carderne · Nov 10, 2026 · Nov 10, 2026
diff --git a/.changeset/chat-agent-client-messages.md b/.changeset/chat-agent-client-messages.md
diff --git a/.changeset/checkpoint-client-delete-snapshots.md b/.changeset/checkpoint-client-delete-snapshots.md
diff --git a/.changeset/cli-login-idle-expiry.md b/.changeset/cli-login-idle-expiry.md
diff --git a/.changeset/convex-agent-skill.md b/.changeset/convex-agent-skill.md
diff --git a/.changeset/electric-client-1-3-0.md b/.changeset/electric-client-1-3-0.md
diff --git a/.changeset/infisical-oidc.md b/.changeset/infisical-oidc.md
diff --git a/.changeset/oidc-aws-session-tags.md b/.changeset/oidc-aws-session-tags.md
diff --git a/.changeset/run-token-environment-operations.md b/.changeset/run-token-environment-operations.md
diff --git a/.changeset/run-token-scopeless-public-token.md b/.changeset/run-token-scopeless-public-token.md
diff --git a/.changeset/trusted-github-deploys.md b/.changeset/trusted-github-deploys.md
diff --git a/.changeset/trusted-publishing-lifecycle.md b/.changeset/trusted-publishing-lifecycle.md
diff --git a/.changeset/unflatten-numeric-keys.md b/.changeset/unflatten-numeric-keys.md
diff --git a/.server-changes/alerts-delete-write-permission.md b/.server-changes/alerts-delete-write-permission.md
diff --git a/.server-changes/alerts-no-chat-notifier.md b/.server-changes/alerts-no-chat-notifier.md
diff --git a/.server-changes/alerts-query-period.md b/.server-changes/alerts-query-period.md
diff --git a/.server-changes/api-key-custom-access.md b/.server-changes/api-key-custom-access.md
diff --git a/.server-changes/api-key-custom-expiry-date.md b/.server-changes/api-key-custom-expiry-date.md
diff --git a/.server-changes/api-key-expiry-picker.md b/.server-changes/api-key-expiry-picker.md
diff --git a/.server-changes/api-key-ip-allowlist.md b/.server-changes/api-key-ip-allowlist.md
diff --git a/.server-changes/api-key-saved-presets.md b/.server-changes/api-key-saved-presets.md
diff --git a/.server-changes/api-key-scope-usage.md b/.server-changes/api-key-scope-usage.md
diff --git a/.server-changes/api-keys-page-polish.md b/.server-changes/api-keys-page-polish.md
diff --git a/.server-changes/cap-project-jwt-lifetime.md b/.server-changes/cap-project-jwt-lifetime.md
diff --git a/.server-changes/enforce-session-deadline-every-request.md b/.server-changes/enforce-session-deadline-every-request.md
diff --git a/.server-changes/env-vars-environment-filter.md b/.server-changes/env-vars-environment-filter.md
diff --git a/.server-changes/fix-duration-wait-details.md b/.server-changes/fix-duration-wait-details.md
diff --git a/.server-changes/fix-logs-page-access.md b/.server-changes/fix-logs-page-access.md
diff --git a/.server-changes/group-alerts-from-list.md b/.server-changes/group-alerts-from-list.md
diff --git a/.server-changes/health-all-components.md b/.server-changes/health-all-components.md
diff --git a/.server-changes/org-scoped-oidc.md b/.server-changes/org-scoped-oidc.md
diff --git a/.server-changes/parallel-first-deploys.md b/.server-changes/parallel-first-deploys.md
diff --git a/.server-changes/personal-access-token-expiry-emails.md b/.server-changes/personal-access-token-expiry-emails.md
diff --git a/.server-changes/personal-access-token-expiry.md b/.server-changes/personal-access-token-expiry.md
diff --git a/.server-changes/scoped-credentials-offloaded-trigger-payloads.md b/.server-changes/scoped-credentials-offloaded-trigger-payloads.md
diff --git a/.server-changes/sidemenu-security-section.md b/.server-changes/sidemenu-security-section.md
diff --git a/.server-changes/supervisor-cold-start-heartbeat.md b/.server-changes/supervisor-cold-start-heartbeat.md
diff --git a/.server-changes/trusted-publishing-long-repo-names.md b/.server-changes/trusted-publishing-long-repo-names.md
diff --git a/hosting/k8s/helm/Chart.yaml b/hosting/k8s/helm/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: trigger
 description: The official Trigger.dev Helm chart
 type: application
-version: 4.8.3
-appVersion: v4.8.3
+version: 4.8.4
+appVersion: v4.8.4
 home: https://trigger.dev
 sources:
   - https://github.com/triggerdotdev/trigger.dev

diff --git a/packages/build/CHANGELOG.md b/packages/build/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @trigger.dev/build
 
+## 4.8.4
+
+### Patch Changes
+
+- Updated dependencies:
+  - `@trigger.dev/core@4.8.4`
+
 ## 4.8.3
 
 ### Patch Changes

diff --git a/packages/build/package.json b/packages/build/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@trigger.dev/build",
-  "version": "4.8.3",
+  "version": "4.8.4",
   "description": "trigger.dev build extensions",
   "license": "MIT",
   "publishConfig": {
@@ -82,7 +82,7 @@
   },
   "dependencies": {
     "@prisma/config": "^6.10.0",
-    "@trigger.dev/core": "workspace:4.8.3",
+    "@trigger.dev/core": "workspace:4.8.4",
     "mlly": "^1.7.1",
     "pkg-types": "^1.1.3",
     "tinyglobby": "^0.2.2",

diff --git a/packages/cli-v3/CHANGELOG.md b/packages/cli-v3/CHANGELOG.md
@@ -1,5 +1,21 @@
 # trigger.dev
 
+## 4.8.4
+
+### Patch Changes
+
+- Logins made with `trigger.dev login` or the MCP server now stop working after 7 days without use. When that happens, the CLI and the MCP server start a new login instead of failing with an auth error, and in CI the CLI says to log in again. Self-hosted instances can change the window with `CLI_LOGIN_IDLE_TIMEOUT_DAYS`, or set it to `0` to turn it off for new logins. Logins made before this change aren't affected. ([`c8ee9e309`](https://github.com/triggerdotdev/trigger.dev/commit/c8ee9e309fe1f09025f6c5dc1fbab8107933dec3))
+- Add `infisicalAccessToken` at `@trigger.dev/sdk/oidc/infisical` to authenticate tasks with Infisical using OIDC instead of stored credentials. Supports US, EU, and self-hosted instances, custom audiences, and Infisical organization scoping. ([`63b58f329`](https://github.com/triggerdotdev/trigger.dev/commit/63b58f329012475941cef93b3440cca09514fee0))
+- Deploy from GitHub Actions using Trusted publishing and GitHub OIDC without storing a Trigger.dev API key. These deployments run entirely on the build server and do not grant the CLI access to environment variables. ([`9aafe6989`](https://github.com/triggerdotdev/trigger.dev/commit/9aafe6989af028bc7c9dc96f9d2f1c027ec3323c))
+- Use GitHub Actions trusted publishing with `preview archive` and `promote`, without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. `preview archive` also supports Preview environment API keys through `TRIGGER_ACCESS_TOKEN`. ([`d9172638a`](https://github.com/triggerdotdev/trigger.dev/commit/d9172638a9679c1f698a1b04b35d2cc7abae5fa3))
+
+  Failed Preview archive operations now exit with an error for API-key and personal-token authentication too, including automatic cleanup during deploys. CI cleanup jobs that previously passed despite an archive failure will now fail. Concurrent cleanup jobs succeed when another job has already archived the same branch generation.
+
+- Updated dependencies:
+  - `@trigger.dev/core@4.8.4`
+  - `@trigger.dev/build@4.8.4`
+  - `@trigger.dev/schema-to-json@4.8.4`
+
 ## 4.8.3
 
 ### Patch Changes

diff --git a/packages/cli-v3/package.json b/packages/cli-v3/package.json
@@ -1,6 +1,6 @@
 {
   "name": "trigger.dev",
-  "version": "4.8.3",
+  "version": "4.8.4",
   "description": "A Command-Line Interface for Trigger.dev projects",
   "type": "module",
   "license": "MIT",
@@ -84,9 +84,9 @@
     "@opentelemetry/api-logs": "0.219.0",
     "@opentelemetry/instrumentation": "0.219.0",
     "@s2-dev/streamstore": "^0.25.0",
-    "@trigger.dev/build": "workspace:4.8.3",
-    "@trigger.dev/core": "workspace:4.8.3",
-    "@trigger.dev/schema-to-json": "workspace:4.8.3",
+    "@trigger.dev/build": "workspace:4.8.4",
+    "@trigger.dev/core": "workspace:4.8.4",
+    "@trigger.dev/schema-to-json": "workspace:4.8.4",
     "ansi-escapes": "^7.0.0",
     "braces": "^3.0.3",
     "c12": "^1.11.1",

diff --git a/packages/convex/CHANGELOG.md b/packages/convex/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @trigger.dev/convex
 
+## 4.8.4
+
+### Patch Changes
+
+- Add a bundled agent skill for integrating Trigger.dev with Convex, including transactional triggering, Realtime progress, recovery, and scoped-token safety. Install it manually from the package; it is not part of the CLI skills installer. ([`9422dc65d`](https://github.com/triggerdotdev/trigger.dev/commit/9422dc65d26e745a8d3670a7977d04b938553d9d))
+
 ## 4.8.3
 
 ### Patch Changes

diff --git a/packages/convex/package.json b/packages/convex/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@trigger.dev/convex",
-  "version": "4.8.3",
+  "version": "4.8.4",
   "description": "Run Trigger.dev tasks from Convex mutations and query their results reactively",
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,20 @@
 # internal-platform
 
+## 4.8.4
+
+### Patch Changes
+
+- Self-hosted supervisors that run tasks in microVMs can now have a finished run's suspend snapshots deleted from shared storage, instead of leaving them behind. The server-only checkpoint client gains a `deleteSnapshots` call for this. ([`95f4cbbad`](https://github.com/triggerdotdev/trigger.dev/commit/95f4cbbad711ea245778d05a2e9951331a325f82))
+- Browser realtime subscriptions now resume reliably after the tab is hidden and shown again. This comes from upgrading `@electric-sql/client` to 1.3.0, which also lets apps that depend on 1.3.0 share a single copy with the SDK. ([`3900d8906`](https://github.com/triggerdotdev/trigger.dev/commit/3900d8906e3a307acf4879a70ab0cbac5d1f8cb8))
+- Add opt-in AWS session tags with `awsCredentialProvider({ sessionTags: true })` for task-level IAM restrictions and attribute-based permissions. Tags come from the verified run identity. Update the role trust policy to allow `sts:TagSession` before enabling them; existing integrations remain untagged. ([`c8ae1ffb5`](https://github.com/triggerdotdev/trigger.dev/commit/c8ae1ffb588895a0ffb8c0dbdcaa1d6e19671edc))
+- Use run credentials for run results, rescheduling, schedules, and environment-variable operations inside tasks. Run credentials remain limited to the current environment: shared schedules cannot be changed, and parent environment variables cannot be written. ([`cd58c750b`](https://github.com/triggerdotdev/trigger.dev/commit/cd58c750b878d39e16acde163b751de2e7491ac0))
+- Deploy from GitHub Actions using Trusted publishing and GitHub OIDC without storing a Trigger.dev API key. These deployments run entirely on the build server and do not grant the CLI access to environment variables. ([`9aafe6989`](https://github.com/triggerdotdev/trigger.dev/commit/9aafe6989af028bc7c9dc96f9d2f1c027ec3323c))
+- Use GitHub Actions trusted publishing with `preview archive` and `promote`, without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. `preview archive` also supports Preview environment API keys through `TRIGGER_ACCESS_TOKEN`. ([`d9172638a`](https://github.com/triggerdotdev/trigger.dev/commit/d9172638a9679c1f698a1b04b35d2cc7abae5fa3))
+
+  Failed Preview archive operations now exit with an error for API-key and personal-token authentication too, including automatic cleanup during deploys. CI cleanup jobs that previously passed despite an archive failure will now fail. Concurrent cleanup jobs succeed when another job has already archived the same branch generation.
+
+- Fix logs and spans with large numeric object keys failing to ingest and dropping the rest of their batch. ([`99a626aa3`](https://github.com/triggerdotdev/trigger.dev/commit/99a626aa3b215b55f5fbfa1dddcfe34ae231e932))
+
 ## 4.8.3
 
 ### Patch Changes

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@trigger.dev/core",
-  "version": "4.8.3",
+  "version": "4.8.4",
   "description": "Core code used across the Trigger.dev SDK and platform",
   "license": "MIT",
   "publishConfig": {