# What changed in inngest

> 22 changes in inngest 4 from its official release notes, upgrade guides and advisories: 5 breaking, 1 security, 8 new APIs and options. Each one cited. Sources checked 2026-11-02. HTML: https://unstale.sh/npm/inngest/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## inngest 4

### Breaking changes

- Sandboxes are destroyed by ID when their scope ends, including when a run is cancelled or times out; errors after destruction are not retried because retries could not use the sandbox. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Destroys the sandbox by ID when its scope ends, including on cancellation or timeout; errors after destruction are not retried. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Scores are sent as one per-name metadata kind with a { value } payload, requiring a server that accepts per-name score kinds. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- SDK warnings are sent as one per-code metadata kind, requiring a server that accepts per-name warning kinds. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- No longer accepts stepId because experiment scores must be run-scoped, as the REST API already enforces. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)

### Security

- The notes recommend using secrets on create for tokens, injecting workspace secrets without exposing them. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)

### New APIs and options

- Adds experimental command shims that let a handler run before a program in the sandbox, perform privileged work, run or refuse the command, and return a result. (4.26.2) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.2)
- Adds a shim configuration helper for providing settings to sandbox commands. (4.26.2) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.2)
- Experimental sandbox handles provide a command interface; non-zero exits throw, exitCodes can allow other codes, and getCommandError reads command details from a failed command. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Accepts exitCodes to allow non-zero command exit codes. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Experimental static middleware hook returns functions that serve() and connect() add to the app unless it already serves one with the same ID; nothing is added without the middleware on the client. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Reads the command, exit code, and output tails from a failed command that reaches a handler as a StepError. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Experimental API returns typed step and group globals that can be imported anywhere instead of passed around, including sandbox, fetch, and middleware-added tools. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Converts sandbox tools to name, description, and JSON Schema definitions shaped for Anthropic's tools parameter, without requiring manual Zod conversion. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)

### Behavior and default changes

- Commands with tools or shims can now run longer than five minutes. (4.26.2) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.2)
- Timeouts over five minutes run the command as a process that the steps follow; output.originalBytes on the result is then optional. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Sandbox commands appear as one [$] row each in traces, and command output is displayed as readable text. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Environment values passed to sandbox calls no longer appear in run traces; only variable names are recorded, while the sandbox still receives the real values. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)

### Fixes and other changes

- Re-creating functions with the same ID now replaces the old definition in client.funcs, fixing memory growth. (4.26.1) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.1)
- Calling connect() without functions now warns and uses the latest definition instead of throwing Duplicate function ID. (4.26.1) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.1)
- Ignores and warns about a returned stepId when the parent was deferred with an experiment, so scores land on the run read by the experiment view. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)
- Sandboxes created with a plain step.sandbox.create() are left running for you to keep. (4.26.0) — [release notes](https://github.com/inngest/inngest-js/releases/tag/inngest%404.26.0)