DeferAdd and DeferCancel Opcodes (#4010)5c8f50e1 Thanks @scottnuma! - Accept Temporal.Duration, Temporal.Instant, and Temporal.ZonedDateTime (and their *Like variants) wherever a timeout or sleep duration is taken: step.sleep(), step.waitForEvent(), step.waitForSignal(), step.invoke(), and function-level cancelOn timeouts. Durations are treated as relative waits; instants and zoned date-times as absolute deadlines.60cda73f Thanks @mar-inngest! - Fix Connect shutdown getting stuck when a late lease-extension ACK recreates a stale in-flight lease entry after request completion or lease losssince parameter (#4085)alpha cmd as a home for experimental CLI commands (#4076)#1479 6b9769ca Thanks @scottnuma! - Fix step.sendSignal() return type to match runtime: Promise<InngestApi.SendSignalResponse> ({ runId: string | undefined }) instead of Promise<null>
#1483 d0a59629 Thanks @Linell! - Fix run IDs not URL encoded in Durable Endpoints
#1481 970ded9b Thanks @Linell! - Improves HMAC signature verification by using a constant-time comparison, which mitigates a potential timing-based signature-recovery attack against the request signature. Also improves handling of timestamps in signatures, including malformed or future-dated values.
#1472 9df36dee Thanks @Linell! - Fix empty body on Vercel serverless Node handlers
#1482 e34972d3 Thanks @Linell! - Hash the signing key used when exporting OTel traces
Contains changes that address CVE-2026-42047
#1470 1a5b63a8 Thanks @amh4r! - Fix checkpointing maxRuntime causing duplicate execution
cb20b4aa6250689cb3abe762a2aa18a483ce816e - Ensure runIds are properly URI encoded in Durable Endpoints
cb20b4aa6250689cb3abe762a2aa18a483ce816e - Improves HMAC signature verification by using a constant-time comparison, which mitigates a potential timing-based signature-recovery attack against the request signature. Also improves handling of timestamps in signatures, including malformed or future-dated values.
cb20b4aa6250689cb3abe762a2aa18a483ce816e - Hash the signing key used when exporting OTel traces
#1366 aca72f88 Thanks @Linell! - Fix extendProvider() for OTel SDK v2 where addSpanProcessor() was removed.
Move @opentelemetry/auto-instrumentations-node and related imports from static top-level to dynamic await import() inside createProvider(). This prevents module-level monkey-patching side effects that broke inngest.send() when combined with host app OTel setups (e.g. Sentry). See #1324.
#1457 d151b404 Thanks @amh4r! - Fix using CountQueuingStrategy when not available
#1455 15495e03 Thanks @amh4r! - Fix dependencyInjection not working statically at function level
#1420 38c6e27c Thanks @BrunoScheufler! - Connect: Refactor internal architecture
#1412 556a32eb Thanks @rhino1998! - Extended Traces: Include step attributes in userland spans
#1414 7e699a06 Thanks @rhino1998! - Step Metadata: Collapse step/step_attempt behavior
#1418 31300308 Thanks @BrunoScheufler! - Fix graceful shutdown cleanup in case of draining connection replacement
494364eb Thanks @jpwilliams! - Fix type exports not being available for composite: true projects