[waleedlatif1]

Summary

• Run Trigger.dev tasks on runtime: 'bun-1.4' (Bun 1.4.4), matching the app, realtime, and db images, which already run on Bun 1.4.4
• Bump @trigger.dev/sdk, core, build and the CI trigger.dev CLI from 4.7.6 to 4.8.2, the first release with bun-1.4
• Add a nodeBinary() build extension: the bun-1.4 image ships no node, but the isolated-vm sandbox and the Oracle worker run as node child processes. It copies Node 24.22.1 from a digest-pinned node:24.22.1-bookworm-slim, the same version as docker/app.Dockerfile. Because the layer adds image instructions, Trigger.dev builds the install stage from this base too, so isolated-vm's install script runs against that Node. Deploy only; trigger dev uses the local node
• distrustCompromisedRoots() stays in init. Under Bun 1.4.4 the roots are already absent, so it does nothing; docs updated

Hold the merge until 2026-11-05 ~13:36 UTC. @trigger.dev/*@4.8.2 was published 2026-10-29, and bunfig.toml's 7-day minimumReleaseAge cool-down has not elapsed. CI still installs because the frozen-lockfile install does not re-check release age, so the hold is policy, not a CI failure. The gate is left as is.

Type of Change

• Chore

Testing

• Rendered the Containerfile with the pinned trigger.dev@4.8.2 generateContainerfile (bun-1.4 + this layer): base COPYs Node and checks its version; the install stage builds FROM base
• Built that same stage layout locally for linux/amd64 from triggerdotdev/bun:1.4-bookworm (the CLI's pinned digest), using bun install with the real externals (isolated-vm 6.2.0, sharp, @napi-rs/canvas, pdfjs-dist):
  • Bun 1.4.4 → spawn('node', ['--no-node-snapshot', …]) → Node v24.22.1, and isolated-vm evaluates 1+1 = 2
  • sharp renders a PNG, and @napi-rs/canvas and pdfjs-dist load under Bun
  • With the Node layer removed, the spawn fails, so the layer is required
• biome check on changed files; type-check, audits, and tests run in CI
• Post-merge: watch the first staging deploy and a function-block run on Trigger.dev staging

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 30, 2026 8:57pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] No additional changes are required by this review; keep the author's stated merge delay.

Summary

Moves Trigger.dev tasks to bun-1.4 while keeping Node for the sandbox and Oracle workers.

• Deployed Trigger.dev tasks run on Bun while Node handles child workers.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A["Trigger.dev task: Bun"] --> B["Sandbox worker: Node 24.22.1"]
  A --> C["Oracle worker: Node 24.22.1"]
  D["nodeBinary() image layer"] --> B
  D --> C

Loading

_{Reviews (1) · Last reviewed commit: "chore(trigger): run tasks on the bun-1.4..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 7 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>