$
npx @buildinternet/releases get inngestRecently Shipped9 releases · updated Oct 13, 2026
Shipped @inngest/ci, the first Inngest Labs project, plus selectable sandbox secrets across the JS SDK and server.
CI pipelines are now an Inngest thing. @inngest/ci 0.1.0 defines CI pipelines in TypeScript and runs them on Inngest Sandboxes. 0.2.0 made runs repeatable: a run ends with the same steps whether it passed or failed, Promise.allSettled jobs no longer fail the pipeline, and job failures surface as one short line — including clear wording when a Sandbox won't start.
Sandbox secrets get picked by name. Creation options accept secrets: ["OPENAI_API_KEY"], saving each under the environment variable name the app expects. Names resolve to workspace secret identities at creation (surviving retries), duplicate names and collisions with literal env vars are rejected, and values are inherited by commands, managed processes, and snapshots.
Local workflows can reach Cloud sandboxes. inngest login connects local development to experimental Cloud sandboxes without deploying an app or configuring an SDK sandbox token. CLI OAuth credentials are stored in the OS credential store and refresh automatically; Inngest Cloud MCP clients can also authenticate via OAuth, with account, permission, and environment scope chosen in the dashboard.
Metadata writes changed semantics — update() is deprecated. The experimental metadata builders gained set(), which replaces all values for a metadata kind. Repeated update() calls to the same kind within a single step still merge, but calls to the same kind from different steps, or sent via the API, now replace each other instead of merging.
Release Notes
MCP, CLI, API keys get scoped read/write permissions
This release3 featuresNew capabilitiesAI-tallied from the release notesMCP and CLI access now signs in via OAuth with approval of account, environment, permissions, and session duration, where read allows inspection and write allows changes; OAuth sessions cannot read event keys or signing keys. API keys for CI and unattended jobs are created by org admins with the same permissions and can be limited to one environment, with calls lacking the required permission returning 403 or insufficient_scope.
Sandboxes: isolated microVMs from any function
This release1 featureNew capabilitiesAI-tallied from the release notesInngest Changelog · v4.21.1
Sandboxes are in public beta for Pro and higher accounts on the TypeScript SDK, with step.sandbox starting an isolated microVM from inside a function in under a second to run commands. Create, commands, and destroy are durable steps on the run trace, enabled via sandboxMiddleware() from inngest/experimental at inngest 4.21.1 or newer.
Bursty concurrency runs spikes up to 3x your limit
This release1 featureNew capabilitiesAI-tallied from the release notesPro and above accounts can now burst to 3x their account concurrency limit for spikes, with a 60-minute monthly budget that refills at an account-specific time and resets each month. Bursts are free, function-level concurrency overrides a burst, and admins get email notifications at 25%, 50%, 75%, and 100% of the budget.