# Trigger.dev v4.5.6 — trigger.dev v4.5.6

- Product: Trigger.dev (https://whatsnew.fyi/product/trigger-dev)
- Vendor: Trigger.dev
- Date: 2026-07-21
- Version: v4.5.6
- Original notes: https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6
- Permalink: https://whatsnew.fyi/product/trigger-dev/releases/v4.5.6

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Self-hosted deployments no longer ship shared default credentials; fresh installs generate their own
- **security** — Require explicit browser approval for CLI and MCP login, with resilient polling while approval is pending
- **changed** — Deployed task telemetry now reports the deployment identifier in the worker.id attribute instead of an opaque internal value
- **security** — Prevent prototype pollution when applying run metadata operations or reconstructing nested telemetry attributes
- **added** — Add helpers to mint and verify the deployment-scoped token used to authenticate run controllers to the platform
- **added** — Add optional request rate limiting for telemetry ingestion endpoints
- **security** — Background-worker deployment lookups are now scoped to the authenticated environment
- **security** — Updating a GitHub App installation from the callback flow is now scoped to your own organization
- **security** — GitHub App installation session is now single-use, invalidated after completing an installation callback
- **security** — Scope schedule and environment-variable writes to the caller's project and environment
- **security** — Reject compute snapshot callbacks that do not match the snapshot request that created them
- **security** — Require secret-key authentication to initialize the session out stream, matching the append route
- **security** — Live run and trace subscriptions now validate their identifiers more strictly and only return data from your own organization
- **security** — Window-function names in the query compiler are now validated against the allowlist
- **security** — Authenticate run controllers to the platform with a signed, deployment-scoped token
- **security** — Verify that worker actions target a run belonging to the caller's environment

#### trigger.dev v4.5.6

##### Upgrade

```sh
npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun
```

Self-hosted Docker image: [`ghcr.io/triggerdotdev/trigger.dev:v4.5.6`](https://github.com/triggerdotdev/trigger.dev/pkgs/container/trigger.dev)

##### Release notes

Read the full release notes: https://trigger.dev/changelog/v4-5-6

##### What's changed

##### Breaking changes
- Self-hosted deployments no longer ship shared default credentials; fresh installs generate their own. If yours still uses a previously published default, set a unique value before upgrading, or set `ALLOW_INSECURE_DEFAULT_SECRETS=true` to keep booting while you migrate. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))

##### Security patches
- Require explicit browser approval for CLI and MCP login, with resilient polling while approval is pending. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Deployed task telemetry now reports the deployment identifier (e.g. `deployment_abc123`) in the `worker.id` attribute, instead of an opaque internal value. Upgrade to get the readable identifier in your own OpenTelemetry exporters. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Prevent prototype pollution when applying run metadata operations or reconstructing nested telemetry attributes, while preserving legitimate `constructor` and `prototype` fields. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Add helpers to mint and verify the deployment-scoped token used to authenticate run controllers to the platform. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Added optional request rate limiting for telemetry ingestion endpoints. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Background-worker deployment lookups are now scoped to the authenticated environment. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Updating a GitHub App installation from the callback flow is now scoped to your own organization, so an installation ID belonging to another organization can no longer be used to refresh that organization's installation record. The GitHub App installation session is also now single-use, so completing an installation callback invalidates its state and it can no longer be replayed. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Scope schedule and environment-variable writes to the caller's project and environment ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Reject compute snapshot callbacks that do not match the snapshot request that created them. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Require secret-key authentication to initialize the session out (agent→client) stream, matching the append route. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Live run and trace subscriptions now validate their identifiers more strictly and only return data from your own organization. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Window-function names in the query compiler are now validated against the allowlist, matching how other function calls are handled. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Authenticate run controllers to the platform with a signed, deployment-scoped token. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Verify that worker actions (starting, completing, and continuing a run, and reading its snapshots) target a run belonging to the caller's environment. ([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))

##### All packages: v4.5.6

@trigger.dev/build, @trigger.dev/core, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigg

_[Truncated at 4000 characters — full notes: https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6]_