CI jobs grow up: per-run budgets, live status and richer sandboxes

CI pipelines get a real execution model

Inngest's biggest change of the week landed in its CI SDK, which now gives each job its own run with a separate step budget, so long pipelines stop tripping the step limit mid-flight. The same rework lets a matrix's axes be an async function that resolves once per run with the repository and commit — combinations can come from the PR being tested rather than a hardcoded list — and handlers now take a single context object, with jobs returning typed output that downstream jobs read as from.output. The matrix API itself consolidated: ci.matrix() gave way to ci.job({ matrix }), which keeps the same axes, exclude, include, concurrency and failFast options.

Runners got more useful in parallel. Cached jobs can expire with cache.maxAge so stale snapshots rebuild, checkout() and files() can read another repository or ref, and duration options accept human strings like "1d" — though bare numeric strings now mean milliseconds, and misuse throws at app boot instead of mid-run. Pull request runs now check out GitHub's test merge of head into base, failing loudly when the PR conflicts, and statuses stream queued, running and result states with Cancel and Re-run buttons. On the flag side, functions with optimizeParallelism: false again complete when they return rather than waiting on unawaited steps, and sandboxes gained image selection via image.inngest() / image.custom().

A larger shake-up arrived on the SDK side: scores and warnings now write as per-name inngest.score.<name> and inngest.warning.<code> metadata kinds, which older servers reject — check your server version before upgrading. The same line adds toolDefinitions() for Anthropic's tools parameter, experimental inngest.globals(), and a sandbox $ shell that runs each command as a step.

Pause, replay and stabilize the server

Inngest Server's trio of releases tightened operations. Functions can be paused through the REST API, CLI and MCP, with includeOutput soft-deprecated for include=output on run-list endpoints; stuck-Running runs from transient step-discovery failures and dropped Connect cleanups were fixed alongside. Replay followed a day later with replays by time range and status added to the v2 API, closing the pause/resume loop, and skipped runs now appear in paging. Between them, gRPC limits rose so Connect can handle execution requests above 4 MiB, and duplicate Connect execution after an executor failure is fixed by resuming the original lease or buffered response.

Trigger.dev: security release and agent integrations

Trigger.dev's week was dominated by a security update: deployed tasks moved onto the October 2026 Node.js releases, fixing CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses — existing deployments keep the old runtime until you redeploy. That release also covers self-hosted webapp and supervisor fixes.

Feature work landed around it. v4.8.0 introduced hosted webhooks plus Slack and Linear agents for chat.agent, and the CLI gained a tasks trigger command, query.dashboards management and span redaction before telemetry export. Deployed tasks now reject certificates from the compromised eMudhra CAs, NODE_EXTRA_CA_CERTS reaches tasks, and Date fields log correctly again. Matching Helm chart bumps tracked the server releases.

n8n settles into fixes

n8n cut a double-digit run of patches with no single headline. The recurring items: Postgres nodes no longer overwrite global pgtypes, workers claim the next queue job and its lock atomically, and shutdown resume keys queue outcomes by job. The 2.45.0 minor brought Anthropic thinking turns replayed with their tool arguments and protected-instance editing fixes, while the earlier 2.44.x line reused log-streaming webhook connections and turned expression spans off by default.