v4.7.6

## Upgrade

```sh
npx trigger.dev@latest update  # npm
pnpm dlx trigger.dev@latest update  # pnpm
yarn dlx trigger.dev@latest update  # yarn
bunx trigger.dev@latest update  # bun
```

Self-hosted Docker image: [`ghcr.io/triggerdotdev/trigger.dev:v4.7.6`](https://github.com/triggerdotdev/trigger.dev/pkgs/container/trigger.dev/1417404574?tag=v4.7.6)

## Release notes

Read the full release notes: https://trigger.dev/changelog/v4-7-6

## What's changed

## Highlights

- Added MCP tools for monitoring alerts: `list_alert_capabilities`, `list_alerts`, `create_alert`, and `resolve_alert`, so an MCP client can discover what a project can watch and manage alerts directly. Health capabilities expose customizable threshold params, discoverable via `list_alert_capabilities` and settable via `create_alert`. ([`99ea13007`](https://github.com/triggerdotdev/trigger.dev/commit/99ea13007ebad7b637f1dbec68977b559cf7c183))

## Improvements
- Deploy images no longer trust the emSign roots removed after the October 2026 eMudhra CA key compromise, or the Sectigo AAA root that cross-signs the compromised intermediates. Node and Bun tasks now refuse TLS connections through the compromised eMudhra intermediates, including their Sectigo AAA cross-signed copies. ([`dac3b033e`](https://github.com/triggerdotdev/trigger.dev/commit/dac3b033ebf05719cb3a6a68cec27b570c952e12))
- `NODE_EXTRA_CA_CERTS` set as an environment variable now reaches the task process at startup instead of being overwritten by the image's empty default. ([`fee21c38c`](https://github.com/triggerdotdev/trigger.dev/commit/fee21c38ccb84d438852c5f592b9990c1dea2c77))
- Python tasks and `pip` in deploy images now verify TLS against the image's trust store instead of a pinned certifi bundle, so they also refuse the compromised eMudhra intermediates. ([`fee21c38c`](https://github.com/triggerdotdev/trigger.dev/commit/fee21c38ccb84d438852c5f592b9990c1dea2c77))

## Bug fixes
- Fix `timestamp` and other `Date` fields being logged as `{}` in structured log lines. ([`7a5a1f144`](https://github.com/triggerdotdev/trigger.dev/commit/7a5a1f144c98c808fb423bc0736bac7733ab3029))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- Ask Trigger's message box is now a single panel holding your message, its context, New chat and Send, with a note that Ask Trigger is an AI assistant and can make mistakes. The chat header has a simpler layout menu and history list, and the Fullscreen layout is now called Full page.
- The webapp Docker image no longer trusts the root certificates that chain to the compromised eMudhra intermediate CAs, so connections to servers presenting certificates from those intermediates now fail.

## All packages: v4.7.6

@trigger.dev/build, @trigger.dev/core, @trigger.dev/python, @trigger.dev/react-hooks, @trigger.dev/redis-worker, @trigger.dev/rsc, @trigger.dev/schema-to-json, @trigger.dev/sdk, trigger.dev

## Contributors

@nicktrn, Katia Bulatova, Eric Allam, Chris Arderne, github-actions[bot], Saadi Myftija, pullfrog[bot], @d-cs, James Ritchie

**Full changelog**: https://github.com/triggerdotdev/trigger.dev/compare/v4.7.5...v4.7.6