Sandbox control arrives in the JS SDK while n8n hardens under the hood

Full sandbox lifecycle control in Inngest

The big story this week is Inngest's JavaScript SDK maturing its step sandboxes from a simple execution primitive into a manageable resource. Inngest's new sandbox snapshot APIs — available on both the direct client and step.sandbox — let you create, list, get, wait for, delete, and clone sandbox snapshots. That last one is particularly interesting: cloning means you can establish a known-good state, let a step mutate it, then reset to baseline for the next run — a natural fit for parallelizing stateful jobs or testing deterministic behavior without rebuilding from scratch each time.

The accompanying Inngest 4.19.0 tightened the developer experience around this feature. Newly created sandboxes now wait for a RUNNING state by default before proceeding, with runningTimeout: false available as an explicit opt-out. That removes a whole class of flaky "sandbox not ready" races that would otherwise surface as intermittent failures in CI or production. A smaller housekeeping update to @inngest/ai — moving @types/node and typescript to dev dependencies — trims runtime weight for AI features that depend on the SDK.

n8n's steady reliability march

n8n spent the week shipping a chain of patch releases across four maintenance branches, and while no single release dominates, a clear reliability theme runs through them. Two fixes stand out for anyone deep in workflow execution. n8n 2.37.9 restored mutating array methods on $json data in expressions — a behavior change that could silently break existing workflows that relied on in-place array operations. And 2.38.3 ensures running jobs are cleaned up when a workflow run rejects, closing a potential resource leak.

Security got attention too, with n8n 1.123.76 bumping browserslist to clear CVE-2026-73088/73089. Elsewhere, proxy environment variables are now applied consistently across packages and processes in 2.36.9 — a fix that matters for anyone running n8n behind a corporate proxy — and 2.38.1 added parameter binding for MongoDB sort and projection operations, plus an AI Builder fix for agent artifacts in the preview tab. Earlier in the week, 2.37.6 threaded execution IDs through dynamic-credential storage, addressing a correctness issue for workflows that fetch credentials at runtime, and 2.37.7 and 2.38.2 shipped further stability patches.

Trigger.dev patch cadence

Trigger.dev kept its release train moving with v4.5.16 and v4.5.15, both carrying improvements to the platform's task execution. Self-hosters also saw three Helm Chart updates — 4.5.15, 4.5.14, and 4.5.13 — keeping the Kubernetes deployment path aligned with the core release. Nothing here is headline-grabbing, but the steady cadence reflects a project comfortable shipping incremental quality.

Taken together, the week reads as one of consolidation: the most novel capability landed in Inngest's sandbox lifecycle, while n8n and Trigger.dev focused on hardening — fixing correctness bugs, closing security gaps, and smoothing out execution edges across the board.