trigger.dev@4.5.4
Skip this version — install 4.8.0 instead.
5 known advisories (worst: high), fixed in 4.5.9.
Why this verdict
- 5 known advisories (worst: high), fixed in 4.5.9.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-23. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 5 known
- License
- MIT
- Install scripts
- None
- Build provenance
- Signed provenance
- Weekly downloads
- 2,531
- GHSA-4672-hwv6-gq62Trigger.dev: Cross-environment deployment cancel
- GHSA-59h8-w5q6-mfmpTrigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
- GHSA-9q4r-4842-93vwTrigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
- GHSA-fj2x-mqqp-3v2wTrigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
- GHSA-pqxw-g93w-hj9xTrigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
Check the official release notes below for behaviour changes before merging.
Release notes
Read the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.