Vouch please: how to become a contributor

[matt-aitken]

Want to contribute to Trigger.dev? Request a vouch by leaving a comment below before opening your first pull request. PRs from unvouched contributors are automatically closed.

Important: Because Trigger.dev is production infrastructure, every external change needs a security review and verification by our team. Your vouch request is extremely unlikely to be accepted unless you are already known to the Trigger.dev team in some way, either as a customer or self-hoster or some other reason we’d be familiar with your work.

We really appreciate bug reports or feature requests. A good reproduction always gets fixed faster than a PR would get merged. You can even suggest the architecture of the fix in the bug report under "Suggested fix".

Please include:

• What you’d like to work on, with a link to the issue if there is one.
• A little about your background, with links to relevant projects or previous contributions if available.

A maintainer will review your request and let you know once you’ve been added to the vouched contributors list. Please don’t open a separate issue or discussion to request a vouch.

Once approved, follow our contributing guidelines and open your PR as a draft first.

Being vouched lets you submit PRs; it does not guarantee that a particular change will be accepted.

[61465]

Hi — would like to request vouching so I can open a PR for an existing issue.

What I'd like to work on:
#4819 — batchTrigger returns stale failed runs as isCached: true instead of re-triggering when the idempotency key points to a dead run. The single-trigger path handles this correctly via shouldIdempotencyKeyBeCleared; the batch path at batchTriggerV3.server.ts:450 was missing the status check because PostgresRunStore.findRunsByIdempotencyKeys never selected the status column.

I already wrote the fix as a courtesy draft before realising the vouching workflow — PR #5014 (auto-closed by check-vouch). It's 4 files: adds status to the SQL + IdempotencyKeyRunMatch type, imports shouldIdempotencyKeyBeCleared into #prepareRunData, and adds a postgres regression test covering PENDING / CRASHED / COMPLETED_WITH_ERRORS / COMPLETED_SUCCESSFULLY. Full credit to the reporter @Jaimin2687 for the RCA. Happy to re-open as a draft once vouched, or to abandon it entirely if you'd prefer the fix to come from the team.

Background:

• Other recent OSS work: PostHog #5083 (merged), Supabase storage #1488 / #1499 / #1500, Supabase auth #2863.
• GitHub: @61465.

Thanks for considering.

[harshitsharmaaaa]

Hi Trigger.dev team,

I'm Harshit, a final-year Computer Science student who works primarily with TypeScript and Node.js. I'd appreciate being vouched so I can start contributing to Trigger.dev, particularly around task execution, worker lifecycle, and observability.

I've been investigating two issues:

[#3672 — Metrics lose run attribution after a waitpoint resume](#3672)

I found the previous [PR #3840](#3840), which attempted to restore task context after a waitpoint resume but was closed because its author wasn't vouched. I'd first reproduce the behavior against the current code and confirm with a maintainer whether the issue still needs a fix. If further work is needed, I'd trace the managed and development worker resume paths and add regression coverage for metric attribution after resumption, isolation between runs, and multiple waitpoints.

[#4313 — Trace IDs shared across concurrent cron runs in development](#4313)

I also found a previous attempt in [PR #4526](#4526), which received review feedback around fallback trace ID generation. I'd reproduce the behavior on the current code, investigate the remaining edge cases, and verify that separate runs receive the correct trace identity without breaking legitimate parent-context propagation. I'd confirm the intended approach with a maintainer before implementing a fix.

Recent open-source contributions

Recent open PRs:

• [TraceRoot #2648](fix(ui): preserve precision in AI assistant alert thresholds traceroot-ai/traceroot#2648) — preserved precision when formatting AI-assistant alert thresholds.
• [TraceRoot #2642](Fix/docker exec cancellation traceroot-ai/traceroot#2642) — addressed cancellation of Docker executor commands.
• [OpenCode #56539](fix(cli): start local service with read-only config anomalyco/opencode#56539) — fixed local service startup with read-only configuration.
• [mcp-use #2861](feat(server): add supported OAuth auth hook mcp-use/mcp-use#2861) — added a supported OAuth authentication hook.
• [OpenCode #55834](fix(cli): deliver resumed ACP parent turn updates anomalyco/opencode#55834) — fixed resumed ACP parent-turn updates.
• [OpenCode #56000](test(ai): cover multibyte UTF-8 across stream chunk boundaries anomalyco/opencode#56000) — added regression coverage for multibyte UTF-8 across stream chunk boundaries.
• [commaai/connect #911](fix: clarify file download segment scope (#638) commaai/connect#911) — clarified file-download action scope and added regression coverage.

Merged contributions:

• [TraceRoot #2533](ci: pin GitHub Actions to commit SHAs traceroot-ai/traceroot#2533) — pinned GitHub Actions to immutable commit SHAs.
• [TraceRoot #2607](fix(billing): count only completed detector runs toward scan quota traceroot-ai/traceroot#2607) — ensured only completed detector runs count toward scan quota.
• [Draco #8](fix: retrieval correctness AmartyaRanjan/Draco#8) — fixed retrieval correctness issues.
• [Self-Healing Hybrid RAG #1](Feature/fix setup and robustness AmartyaRanjan/self-healing-hybrid-RAG#1) — addressed setup and robustness issues.

Additional work prepared for maintainer review:

• [Hono #5565](createHandlers x9 overload return type uses wrong generic parameters honojs/hono#5565 (comment)) — prepared a fix for incorrect generic response types in the createHandlers x9 overload. The fix received positive feedback in the issue discussion; maintainer pickup is pending.
• [Mastra #27346]([BUG] Classifier throws when a decision model refuses a question (refusal answer) mastra-ai/mastra#27346) — prepared a fix for classifier handling of provider refusal answers, with the targeted classifier and scorer regression suites passing. Upstream PR creation is restricted to collaborators.

My contributions involve debugging existing behavior, tracing root causes, writing regression tests, and validating changes against project checks. I aim to keep patches focused and follow each project's contribution guidelines.

GitHub: https://github.com/harshitsharmaaaa

I'd appreciate being vouched so I can contribute through the project's normal review process. I'm happy to confirm the best issue to tackle with a maintainer before opening a PR.

Thanks,
Harshit

[Sadikdeveloper]

Hi Trigger.dev team,

I'd like to request a vouch so I can open a PR for #5017.

What I'd like to work on

eventFilterMatches returns false for a nested $exists: false filter when a parent key is missing or null. It early-returns false on a nullish payload before $exists is ever evaluated, so a retry.fetch bodyFilter like { error: { retryAfter: [{ $exists: false }] } } can't match a body with no error object. The fix is to evaluate the filter against an empty object when the payload is nullish, which makes nested behave like top-level.

I'd already prepared the fix before I saw the vouch requirement: PR #5022, which check-vouch auto-closed. It changes eventFilterMatches.ts, adds regression tests in core and in the SDK's retry.test.ts, and includes a @trigger.dev/core changeset. I can re-open it as a draft once vouched, or drop it and post the RCA and suggested fix on the issue instead, whichever you prefer.

About me

I'm Abubakar, a TypeScript developer (NestJS, Prisma, PostgreSQL, Redis, React, React Native) building Rown, a non-custodial crypto wallet. I'm planning to self-host Trigger.dev for businesses around me but haven't started yet. I came across this bug while looking at retry.fetch and bodyFilter.

GitHub: @Sadikdeveloper

Thanks for considering.

[techize]

Hi, I'd like to pick up #4951 (IRSA credentials fail because fast-xml-parser 5.7 rejects the entities xml-builder 3.930 registers).

We self-host trigger.dev on EKS for platform team jobs and ran into this moving the object store from MinIO to S3. I've got a branch that bumps the AWS SDK packages in the webapp, supervisor and emails to 3.1140.0, which only resolves the fixed xml-builder, and we've been running the equivalent patch on our UAT install. I'm an SRE, mostly Kubernetes, Terraform and Helm.

[61465]

Nudging on this since it's been 4 days and I noticed 3 other folks (@harshitsharmaaaa, @Sadikdeveloper, @techize) are also waiting — the backlog looks real. Not a complaint, just offering to help where I can:

Status of my original request

The PR for #4819 (batchTrigger returning stale CRASHED runs as isCached:true) is still ready — fix in #prepareRunData, 4 files, +95/-4, with a postgres regression test. Happy to re-draft once vouched, or close out if the team would rather fix it internally.

Quick note on fit, in case it's useful

Context on where I'm coming from, since the vouch gate was built partly for signal:

• Elsewhere in the last ~45 days: 10 OSS orgs with public standing, 2 merged (supabase/storage#1500 by @ferhatelmas, PostHog/posthog-js#5083 by @marandaneto), 7 in review (Sentry Relay, SvelteKit, Drizzle ORM, Inngest, Supabase storage ×3, Supabase auth, PostHog), 3 maintainer-blessed design proposals (Prisma ORM v7, Node.js core v22/v24, Nitro v3). Full list on my profile.
• Stack overlap: TypeScript + Node + Postgres + idempotency + queueing is my daily driver. Also did the Documenso GHSA-2rp7-mrh6-v9m2 (CVSS 7.6, rejected-recipient forgery across 3 tRPC routes) in the same cycle.

Offer

If helpful: I'd happily help triage the other three waiting vouch requests on this thread. Any team member who sees this is welcome to point me at a shortlist, I can summarise each requester's prior work + proposed scope + risk, and you can approve/deny from a short writeup instead of three separate deep reads. Zero commitment on your side — just a time-saver.

And on the operational side: I saw the Backend Engineer (Security) and Senior Backend Engineer (Europe) roles on your careers page. I'd love to chat about the first one when you have bandwidth — abdarahman10555@gmail.com or wherever's easiest. In the meantime the vouch unlock stays the useful thing regardless of whether that conversation ever happens.

Thanks @crofty / @carderne / @ericallam — appreciate the time.

[ferhatelmas]

@61465 a correction, PR mentioned/merged on supabase/storage is supabase/storage#1500

[61465]

Oh! You are right - thanks @ferhatelmas. The bare #1500 auto-linked to a trigger.dev issue instead of yours. Just edited the comment to use the full supabase/storage#1500 reference. Appreciate the eye.

[mmadhavvvv]

Hi Trigger.dev team,

I'd like to request a vouch so I can start contributing to Trigger.dev.

What I'd like to work on

I'm interested in contributing to backend reliability, task execution, integrations, and developer tooling. I'm currently exploring the codebase and would like to identify a well-scoped issue where I can provide a reproducible bug report, investigate the root cause, and propose a tested fix.

I'm happy to discuss the approach with a maintainer before making any changes.

About me

I'm Madhav, a Computer Science Engineering graduate from Amity University, India. I've worked as a DevOps Engineer Intern, where my work involved AWS infrastructure, Terraform, CI/CD pipelines, infrastructure security, and monitoring.

I'm also building my application development experience with FastAPI, React, and PostgreSQL.

My GitHub: https://github.com/mmadhavvvv

One of my projects: https://github.com/mmadhavvvv/Maharaj-website

I'm looking forward to learning from the team and making useful, well-tested contributions to Trigger.dev.

Thank you for considering my request!

[MauryaQbit]

Hi Trigger.dev team,

I'd like to request a vouch so I can open a PR for #5025 — an opt-in MFA_REQUIRED env var that makes a self-hosted instance require a second factor for every dashboard user.

What I'd like to work on

Self-hosted operators under FedRAMP/SOC 2/HIPAA can't require MFA today: TOTP is opt-in per user, magic-link login is always available, and users can turn MFA off themselves.

I've already written the implementation. My PR #5034 was auto-closed by the vouch gate, so I'm requesting a vouch rather than reopening it. Branch: feat/mfa-required-webapp (7b3b8672b), rebased on current main, 14 files, +646/−16.

Approach, in case it's useful for comparison:

• MFA_REQUIRED: BoolEnv.default(false); every check short-circuits when unset, so behaviour on existing instances is unchanged.
• Enforcement is layered because there is no single guard for all authenticated routes: the requireUser gate plus the root.tsx loader, both delegating to one helper. I confirmed the root loader does not run for action-only resource routes, which is why the resource-route actions need their own check.
• /login*, /magic, /auth/*, /logout and the enrollment endpoint are exempt so the flow can't deadlock.
• Disabling is blocked at three layers: MultiFactorAuthenticationService.disableTotp throws (so every caller inherits the rule), the resource-route action refuses disable-mfa, and the UI hides the toggle and dialog.
• Incidental fix: enableTotp now clears a previously pending secret first. Without that, refreshing the forced-setup page orphaned a SecretReference and its stored secret on every retry.
• 14 unit tests (exemption list, including that prefixes of exempt paths are not exempt; redirectTo propagation; sanitization of non-navigable targets). typecheck --filter webapp 20/20, oxfmt --check, oxlint, knip all clean. Docker-backed suites unverified locally — no container runtime in my environment.

About me

I'm Dhananjay Maurya, a TypeScript/Node developer based in Mumbai. 17 of my PRs are merged across OSS projects:

• corsairdev/corsair — 11 merged, mostly integration plugins (Bubble, Clientary, AbuseIPDB, API.Bible, API Labz) plus webhook-signature test coverage
• DavidHDev/react-bits — 4 merged (ChromaGrid, ScrollVelocity, DecryptedText Tailwind-variant fixes)
• fosrl/pangolin feat(redis-worker): batched pop in MollifierDrainer for fast single-env drains #3797 — merged (gateway returned a 302 to API clients instead of a JSON auth error on inference resources)
• twentyhq/twenty #25738 — merged (republish twenty-ui under MIT to clear stale AGPL artifacts)

I've also filed root-caused security reports on Pangolin: a buildHostRule bug that dropped the wildcard so wildcard-subdomain resources never matched, an unvalidated appendPathMatch allowing cross-tenant router hijack, CSV/formula injection in generateCSV log exports, an unauthenticated ReDoS in isPathAllowed, and per-site cleanup being skipped in deleteOrgById (server/lib/deleteOrg.ts:59).

Happy to adjust the MFA approach to whatever the team prefers, and to re-open it as a draft first if the direction looks right. Thanks for considering.

[developerfred]

Hi Trigger.dev team,

I'd like to request a vouch so I can open a PR for #5028 (extraCACerts has no effect on deploy).

What I'd like to work on

deploy never passes extraCACerts to buildImage(), so the generated Containerfile sets NODE_EXTRA_CA_CERTS to an empty string, and the CA file isn't copied into the image either. I already have a small fix on a branch: copy the CA file into the build output and pass its in-image path as the build arg, plus unit tests and a changeset (https://github.com/developerfred/trigger.dev/tree/fix/extra-ca-certs-deploy). I opened it as #5037 before being vouched, which was my mistake, so it was auto-closed. If you're open to the fix from an external contributor, I'll reopen it as a draft and follow the PR workflow in CONTRIBUTING. It doesn't cover --local-bundle / --from-bundle yet.

Background

I'm an open source contributor and maintainer of other projects (https://github.com/developerfred). I'm not a Trigger.dev customer or self-hoster yet. I'm looking for my next project to dig into, and Trigger.dev looks like a great candidate, so I'd like to start with this well-scoped bug and take it from there.

Thanks for considering it!