chore: release v4.8.3 (#5085)

## Summary
8 improvements, 4 bug fixes.

## Improvements
- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))

## Bug fixes
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- The CLI and MCP login consent page now shows when and from which IP
address the login was started, and you get an email whenever a new CLI
or MCP login is authorized on your account.
- Searching, filtering to errors, and expanding or collapsing spans in
the run trace view are faster on large traces.
- Guide switching from shared root keys to individually managed API
keys, while keeping root key regeneration directly available.
- CLI and MCP login codes now work once, and every login mints its own
personal access token instead of reusing an existing CLI token.
- Fix run traces occasionally going missing when a span recorded an
exception with no message, type or stack trace.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## trigger.dev@4.8.3

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add `trigger webhooks set-secret` and `trigger webhooks
generate-secret`, which store a webhook endpoint's signing secret
without printing it. `set-secret` reads the secret from a pipe, an
environment variable or a `.env` file, and `generate-secret` saves the
new secret to an env file. When the endpoint already has a secret, both
ask how long the old one keeps working (or take `--previous-secret-ttl
24h` in scripts). The MCP server's `set_webhook_secret` and
`generate_webhook_secret` descriptions now point AI agents at these
commands, so the secret stays out of the agent's context.
([`daaaa41db`](daaaa41))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
  - `@trigger.dev/build@4.8.3`
  - `@trigger.dev/schema-to-json@4.8.3`
## @trigger.dev/convex@4.8.3

### Patch Changes

- Add `trigger.refresh(ctx, id)` to request an earlier status check for
a Convex-tracked run, so applications using Trigger Realtime can publish
results without waiting for the next scheduled poll. Requests are
coalesced and rate-limited, use the existing completion callback, and
retain polling as a recovery fallback.
([`ee5e5da40`](ee5e5da))
## @trigger.dev/core@4.8.3

### Patch Changes

- CLI and MCP logins are now bound to the machine that started them.
Approving a login in your browser sends you back to the CLI
automatically, or, when the browser is on another machine, shows a code
to paste into the terminal (or pass with `trigger.dev login --code`).
Older CLI versions will need to upgrade to log in.
([`1a36c23fb`](1a36c23))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Deprecates the legacy Bun runtime. `runtime: "bun"` (and its explicit
spelling `"bun-legacy"`), which deploys Bun 1.3.3 with Node.js 20
alongside it, now prints a deprecation warning, and deploys that use it
will be rejected from January 5, 2027. Switch to `runtime: "bun-1.4"`
(Bun 1.4.4 on an image with no Node.js binary) and redeploy.
([`5f8171cab`](5f8171c))
- Fix parent and root metadata updates being lost after one update could
not be applied. Only that update is now skipped, and the rest are
written. Metadata keys that name only the root, such as `$.` or `$..`,
are now ignored on a run's own metadata instead of throwing, and
rejected for parent and root metadata, which fails the whole request.
([`53441fd20`](53441fd))
## @trigger.dev/linear@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/python@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
  - `@trigger.dev/build@4.8.3`
## @trigger.dev/react-hooks@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/redis-worker@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/rsc@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/schema-to-json@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/slack@4.8.3

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.8.3`
  - `@trigger.dev/core@4.8.3`
## @trigger.dev/sdk@4.8.3

### Patch Changes

- Fix reloading a chat mid-turn after its access token was refreshed. A
token refresh during a streaming turn persisted a resume cursor from the
middle of the turn, so a reload resumed past chunks the page needed and
failed to rebuild the assistant message ("No tool invocation found for
tool call ID"). The persisted cursor now stays at the start of the turn
until it completes, so a reload replays the whole turn.
([`9fd1de656`](9fd1de6))
- Add private-beta OIDC authentication for deployed Cloud tasks, with an
AWS credential provider and environment-specific setup instructions.
Install `@aws-sdk/client-sts` to use `@trigger.dev/sdk/oidc/aws`,
upgrade your deployment CLI, and redeploy. Contact us to enable access
for your organization.
([`65352bc90`](65352bc))
- Updated dependencies:
  - `@trigger.dev/core@4.8.3`

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]