# Trigger.dev v4.5.2 — trigger.dev v4.5.2

- Product: Trigger.dev (https://whatsnew.fyi/product/trigger-dev)
- Vendor: Trigger.dev
- Date: 2026-07-09
- Version: v4.5.2
- Original notes: https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
- Permalink: https://whatsnew.fyi/product/trigger-dev/releases/v4.5.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Harden account and access-control handling across auth, RBAC, org membership, and impersonation
- **security** — Harden URL handling for alert webhooks and platform notifications
- **security** — Harden the query and prompt-override APIs and rate-limit the query ai-title endpoint
- **security** — Improve redaction of secrets from debug logs
- **security** — Tighten environment scoping when replaying a run
- **security** — Scope run, batch, and trigger lookups to the caller's tenant
- **security** — Honor the MCP server's --dev-only flag
- **added** — Bulk actions allow runs to be re-run based on a filter or run IDs via API and in the official SDK, supporting create, list, retrieve, poll and abort operations with targeting to different compute regions
- **changed** — Large batch payloads now offload to object storage instead of riding inline in the trigger request, offloading any per-item payload over 128KB before sending
- **removed** — Removed internal helpers that were only used by the end-of-life v3 self-hosted compute providers
- **added** — Add an onEvent callback to TriggerChatTransport and useTriggerChatTransport that emits typed lifecycle events for sends, stream connects, first chunk, and turn completion
- **changed** — The environment and branch selector dropdown will automatically revalidate when opened so that new branches show up
- **changed** — Cleaner sign-in flow that requests a magic link right from the login page or continues with SSO
- **changed** — Serve PostHog analytics from a same-origin /ph path that reverse-proxies to PostHog Cloud EU
- **changed** — Refreshed the SSO & Directory Sync settings page layout and copy
- **changed** — Migrated the webapp to Tailwind CSS v4 with a CSS-first @theme and semantic color tokens as CSS variables overridable per theme
- **changed** — Replaced raw charcoal-* Tailwind classes with semantic theme tokens across the dashboard
- **fixed** — Fix chat turns that throw from an onTurnStart hook leaking their message listener
- **fixed** — Fix chat.agent and chat.createSession permanently dropping user messages when several arrived during a single turn
- **fixed** — Fix chat continuation runs replaying already-answered messages by advancing the session.in resume cursor
- **fixed** — Fix chat.createSession swallowing a message sent shortly after stopping a turn
- **fixed** — Fix AI generation cost to use the exact provider-reported cost from OpenRouter/Vercel AI Gateway when present instead of catalog pricing

#### trigger.dev v4.5.2

##### Upgrade

```sh
npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun
```

Self-hosted Docker image: [`ghcr.io/triggerdotdev/trigger.dev:v4.5.2`](https://github.com/triggerdotdev/trigger.dev/pkgs/container/trigger.dev/1015243510?tag=v4.5.2)

##### Release notes

Read the full release notes: https://trigger.dev/changelog/v4-5-2

##### What's changed

##### Security

- Harden account and access-control handling across auth, RBAC, org membership, and impersonation. ([#4199](https://github.com/triggerdotdev/trigger.dev/pull/4199))
- Harden URL handling for alert webhooks and platform notifications. ([#4199](https://github.com/triggerdotdev/trigger.dev/pull/4199))
- Harden the query and prompt-override APIs and rate-limit the query ai-title endpoint. ([#4199](https://github.com/triggerdotdev/trigger.dev/pull/4199))
- Improve redaction of secrets from debug logs. ([#4199](https://github.com/triggerdotdev/trigger.dev/pull/4199))
- Tighten environment scoping when replaying a run. ([#4199](https://github.com/triggerdotdev/trigger.dev/pull/4199))
- Scope run, batch, and trigger lookups to the caller's tenant. ([#4199](https://github.com/triggerdotdev/trigger.dev/pull/4199))
- Honor the MCP server's `--dev-only` flag. ([#4199](https://github.com/triggerdotdev/trigger.dev/pull/4199))

##### Features

- Bulk actions allow runs to be re-run based on a filter or run IDs. Now it's also available via API and in the official SDK. Create, list, retrieve, poll and abort bulk actions. Runs can be targeted to a different compute region, just like in the web UI. (#4105)

##### Improvements

- Large batch payloads now offload to object storage instead of riding inline in the trigger request. `batchTrigger` and `batchTriggerAndWait` (and the by-id and by-task variants) offload any per-item payload over 128KB before sending, the same way single `trigger` and `triggerAndWait` already do, so a big batch no longer blows past the API body limit. ([#4165](https://github.com/triggerdotdev/trigger.dev/pull/4165))
- Removed internal helpers that were only used by the end-of-life v3 self-hosted compute providers. ([#4194](https://github.com/triggerdotdev/trigger.dev/pull/4194))
- Add an `onEvent` callback to `TriggerChatTransport` / `useTriggerChatTransport` that emits typed lifecycle events for sends, stream connects, first chunk, and turn completion. Send-success metrics, time-to-first-token, and "sent but never answered" watchdogs become a few lines of client code. ([#4187](https://github.com/triggerdotdev/trigger.dev/pull/4187))

  ```ts
  onEvent: (event) => {
    if (event.type === "message-sent") metrics.timing("chat.send_ms", event.durationMs);
    if (event.type === "first-chunk") metrics.timing("chat.ttft_ms", event.sinceSendMs ?? 0);
  },
  ```

- The environment and branch selector dropdown will automatically revalidate when opened so that new branches show up. ([#4171](https://github.com/triggerdotdev/trigger.dev/pull/4171))
- A cleaner sign-in flow: request a magic link right from the login page, or continue with SSO. ([#4182](https://github.com/triggerdotdev/trigger.dev/pull/4182))
- Serve PostHog analytics from a same-origin `/ph` path that reverse-proxies to PostHog Cloud EU, following PostHog's first-party reverse-proxy guidance. ([#4183](https://github.com/triggerdotdev/trigger.dev/pull/4183))
- Refreshed the SSO & Directory Sync settings page layout and copy. ([#4196](https://github.com/triggerdotdev/trigger.dev/pull/4196))
- Migrated the webapp to Tailwind CSS v4 with a CSS-first `@theme`. Semantic color tokens are now CSS variables overridable per theme. Tailwind runs through `@tailwindcss/postcss`; plugins replaced or upgraded to v4-compatible versions. ([#4139](https://github.com/triggerdotdev/trigger.dev/pull/4139))
- Replaced raw charcoal-* Tailwind

_[Truncated at 4000 characters — full notes: https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2]_