[github-actions]

Summary

1 new feature, 4 improvements, 2 bug fixes.

Highlights

• Added MCP tools for monitoring alerts: list_alert_capabilities, list_alerts, create_alert, and resolve_alert, so an MCP client can discover what a project can watch and manage alerts directly. Health capabilities expose customizable threshold params, discoverable via list_alert_capabilities and settable via create_alert. (99ea13007)

Improvements

• Deploy images no longer trust the emSign roots removed after the October 2026 eMudhra CA key compromise, or the Sectigo AAA root that cross-signs the compromised intermediates. Node and Bun tasks now refuse TLS connections through the compromised eMudhra intermediates, including their Sectigo AAA cross-signed copies. (dac3b033e)
• NODE_EXTRA_CA_CERTS set as an environment variable now reaches the task process at startup instead of being overwritten by the image's empty default. (fee21c38c)
• Python tasks and pip in deploy images now verify TLS against the image's trust store instead of a pinned certifi bundle, so they also refuse the compromised eMudhra intermediates. (fee21c38c)

Bug fixes

• Fix timestamp and other Date fields being logged as {} in structured log lines. (7a5a1f144)

Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

• Ask Trigger's message box is now a single panel holding your message, its context, New chat and Send, with a note that Ask Trigger is an AI assistant and can make mistakes. The chat header has a simpler layout menu and history list, and the Fullscreen layout is now called Full page.
• The webapp Docker image no longer trusts the root certificates that chain to the compromised eMudhra intermediate CAs, so connections to servers presenting certificates from those intermediates now fail.

Raw changeset output

Releases

@trigger.dev/build@4.7.6

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.6

trigger.dev@4.7.6

Patch Changes

• Deploy images no longer trust the emSign roots removed after the October 2026 eMudhra CA key compromise, or the Sectigo AAA root that cross-signs the compromised intermediates. Node and Bun tasks now refuse TLS connections through the compromised eMudhra intermediates, including their Sectigo AAA cross-signed copies. (dac3b033e)
• Added MCP tools for monitoring alerts: list_alert_capabilities, list_alerts, create_alert, and resolve_alert, so an MCP client can discover what a project can watch and manage alerts directly. Health capabilities expose customizable threshold params, discoverable via list_alert_capabilities and settable via create_alert. (99ea13007)
• NODE_EXTRA_CA_CERTS set as an environment variable now reaches the task process at startup instead of being overwritten by the image's empty default. (fee21c38c)
• Python tasks and pip in deploy images now verify TLS against the image's trust store instead of a pinned certifi bundle, so they also refuse the compromised eMudhra intermediates. (fee21c38c)
• Updated dependencies:
  • @trigger.dev/core@4.7.6
  • @trigger.dev/build@4.7.6
  • @trigger.dev/schema-to-json@4.7.6

@trigger.dev/core@4.7.6

Patch Changes

• Fix timestamp and other Date fields being logged as {} in structured log lines. (7a5a1f144)

@trigger.dev/python@4.7.6

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.6
  • @trigger.dev/build@4.7.6
  • @trigger.dev/sdk@4.7.6

@trigger.dev/react-hooks@4.7.6

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.6

@trigger.dev/redis-worker@4.7.6

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.6

@trigger.dev/rsc@4.7.6

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.6

@trigger.dev/schema-to-json@4.7.6

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.6

@trigger.dev/sdk@4.7.6

Patch Changes

• Updated dependencies:
  • @trigger.dev/core@4.7.6

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f47e8249-ac84-476f-a94e-afc617cfaf74

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

🧭 Helm Chart Prerelease Published

Version: 4.7.6-pr5042.233461a

Install:

helm upgrade --install trigger \
  oci://ghcr.io/triggerdotdev/charts/trigger \
  --version "4.7.6-pr5042.233461a"

⚠️ This is a prerelease for testing. Do not use in production.