v4.6.2

# trigger.dev v4.6.2

> [!WARNING]
> A Zod import bug in versions 4.6.0 through 4.6.3 can cause warm starts to fail and delay runs by approximately five minutes when using npm with Zod 3 pinned in `package.json`. Cold starts are unaffected by this bug. No data has been lost.
>
> Redeploy with `npx trigger.dev@latest deploy`, or update your pinned CLI version to **4.6.4 or later** and redeploy. [Read about the fix](https://trigger.dev/changelog/v4-6-4).

## Upgrade

```sh
npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun
```

Self-hosted Docker image: [`ghcr.io/triggerdotdev/trigger.dev:v4.6.2`](https://github.com/triggerdotdev/trigger.dev/pkgs/container/trigger.dev/1256015039?tag=v4.6.2)

## Release notes

Read the full release notes: https://trigger.dev/changelog/v4-6-2

## What's changed

## Improvements
- Authorize stored realtime payload and output downloads against their owning run. Large packet hydration continues to work for run-, task-, tag-, and batch-scoped public tokens without permitting arbitrary packet reads. ([`76031b0a1`](https://github.com/triggerdotdev/trigger.dev/commit/76031b0a1e808edf8c0b42644d9184f8ace205b1))
- Show warm idle time and durable waits separately in chat agent traces. Durable waits now open the waitpoint inspector while waiting and after completion. Message span names are shorter, and repeated session IDs no longer crowd message-wait and default output-stream spans. ([`0754931cc`](https://github.com/triggerdotdev/trigger.dev/commit/0754931cca708fc7334470b81c0f446afed7ef0a))
- chat.agent: the between-turns compaction check now receives the last step's token usage (the context the model actually held) instead of the turn's sum over every tool-calling step, so a single tool-using turn no longer compacts a short conversation. The summed figure is still available as `turnUsage` on the event. A head-start handover whose pending tool call completes under the same message id now replaces its spliced partial in the model lane directly instead of falling back to a full reconversion. ([`04c837569`](https://github.com/triggerdotdev/trigger.dev/commit/04c8375696bacab65ad7bb2d9cf2b9df616b1343))
- Validate resource IDs when creating scoped public tokens. Explicitly empty IDs are now rejected instead of being interpreted as type-wide permissions. ([`22f8fb2b5`](https://github.com/triggerdotdev/trigger.dev/commit/22f8fb2b5b1d05ac1741facb87873454b7805eac))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- The banner that prompts you to set a billing limit now lets you choose to run without one, so you don't have to open your billing limit settings to dismiss it.
- Org member invites now match emails case-insensitively, so an invite whose email casing differs from the invitee's account email can be accepted. ([#3849](https://github.com/triggerdotdev/trigger.dev/pull/3849))
- Limit public access tokens created through the JWT endpoint to the API key's permissions and a maximum 24-hour lifetime. Rotated environment keys can no longer create tokens during their grace period.
- Realtime session writers now receive authorization limited to the requested session channel.
- Prevent public session access tokens from authorizing durable chat snapshot uploads

## All packages: v4.6.2

@trigger.dev/build, @trigger.dev/core, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, trigger.dev

## Contributors

Chris Arderne, github-actions[bot], @isshaddad, Eric Allam, claude[bot], @d-cs

**Full changelog**: https://github.com/triggerdotdev/trigger.dev/compare/v4.6.1...v4.6.2