inngest-v3-v4-migration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited inngest-v3-v4-migration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user asks to upgrade Inngest, fix v3/v4 errors, migrate realtime, or clean up a codebase that has mixed SDK patterns.
Primary reference: https://www.inngest.com/docs/reference/typescript/v4/migrations/v3-to-v4
This skill is agent-first: detect actual usage first, make mechanical API changes in a controlled order, then typecheck and run focused tests.
Use this skill for requests like:
step.invoke with a string function ID stopped working"@inngest/realtime broke after installing inngest@4"If the user asks for a broad codebase reliability audit first, use inngest-brownfield-audit to choose scope, then return here for the v4 changes.
Start by locating all Inngest surfaces:
rg -n '"inngest"|"@inngest/realtime"|"@inngest/agent-kit"' package.json **/package.json
rg -n 'new Inngest|EventSchemas|eventType|staticSchema|createFunction\\(|serve\\(|connect\\(|step\\.invoke|referenceFunction|@inngest/realtime|realtimeMiddleware|useInngestSubscription|serveHost|rewriteGatewayEndpoint|logLevel|streaming:|signingKey|signingKeyFallback|baseUrl|INNGEST_DEV|INNGEST_SIGNING_KEY' .Then classify the repo:
inngest-setup, not this migration skill.serverless maxRuntime, realtime package imports, and string step.invoke.
Before editing, record:
Inngest migration scan:
- Current package versions:
- Client files:
- Serve/connect entrypoints:
- Functions using old trigger syntax:
- EventSchemas usage:
- Realtime v3 package usage:
- step.invoke string IDs:
- Serverless runtime constraints:
- Tests/checks available:createFunction options.EventSchemas with eventType() / staticSchema().step.invoke() string IDs.@inngest/realtime to v4 native APIs.Install the latest v4 SDK:
npm install inngest@latest
# or pnpm add inngest@latest
# or yarn add inngest@latestIf the repo uses v3 realtime, remove @inngest/realtime; v4 realtime lives in the inngest package and subpaths such as inngest/realtime, inngest/react, and native step.realtime / inngest.realtime.
v4 defaults to Cloud mode. For local development, use an env var:
INNGEST_DEV=1 npm run devDo not hardcode isDev: true in source unless the repo's existing environment pattern clearly scopes it to local-only code. Production should use INNGEST_SIGNING_KEY.
In v4, options such as signingKey, signingKeyFallback, and baseUrl belong on new Inngest(...), not on serve(...).
// Old v3
app.use(
"/api/inngest",
serve({
client: inngest,
functions,
signingKey: process.env.INNGEST_SIGNING_KEY,
baseUrl: process.env.INNGEST_BASE_URL,
})
);
// New v4
export const inngest = new Inngest({
id: "my-app",
signingKey: process.env.INNGEST_SIGNING_KEY,
baseUrl: process.env.INNGEST_BASE_URL,
});
app.use("/api/inngest", serve({ client: inngest, functions }));If the repo already relies on supported environment variables and does not pass serve options explicitly, no code change may be required for those keys.
Other renames:
serveHost -> serveOriginstreaming: "force" -> streaming: truestreaming: "allow" -> streaming: truestreaming: false stays falselogLevel is removed; pass a logger such as new ConsoleLogger({ level })Triggers move into the first argument's options object.
// Old v3
inngest.createFunction(
{ id: "send-welcome" },
{ event: "user/created" },
async ({ event, step }) => {}
);
// New v4
inngest.createFunction(
{ id: "send-welcome", triggers: [{ event: "user/created" }] },
async ({ event, step }) => {}
);Cron triggers move the same way:
inngest.createFunction(
{ id: "nightly-sync", triggers: [{ cron: "0 2 * * *" }] },
async ({ step }) => {}
);If a function is invoked only via step.invoke, it may be triggerless.
Replace centralized EventSchemas with event-specific definitions.
import { Inngest, eventType, staticSchema } from "inngest";
import { z } from "zod";
export const userCreated = eventType("user/created", {
schema: z.object({
userId: z.string(),
email: z.string().email(),
}),
});
type InvoicePaid = {
invoiceId: string;
customerId: string;
};
export const invoicePaid = eventType("billing/invoice.paid", {
schema: staticSchema<InvoicePaid>(),
});Use event types consistently:
await inngest.send(userCreated.create({ userId, email }));
inngest.createFunction(
{ id: "on-user-created", triggers: [userCreated] },
async ({ event }) => {}
);
await step.waitForEvent("wait-for-invoice", {
event: invoicePaid,
timeout: "7d",
});Important: staticSchema expects a type, not an interface. Convert interfaces to type aliases when needed.
v4 no longer accepts raw string function IDs. Use an imported function reference or referenceFunction().
import { referenceFunction } from "inngest";
await step.invoke("run-report", {
function: referenceFunction({
appId: "analytics-app",
functionId: "generate-report",
}),
data: { reportId },
});If the target function is in the same codebase, prefer passing the imported function itself:
await step.invoke("run-report", {
function: generateReport,
data: { reportId },
});v3 realtime used @inngest/realtime and middleware-injected publish. v4 realtime is native.
Replace:
@inngest/realtime packagerealtimeMiddleware(){ publish }useInngestSubscription()With:
inngest/realtimestep.realtime.publish between stepsinngest.realtime.publish inside an existing step.runUse inngest-realtime for detailed patterns. Do not call step.realtime.publish from inside step.run; use inngest.realtime.publish there to avoid step-in-step behavior.
v4 enables optimized parallelism and checkpointing by default.
Watch for Promise.race over steps. With optimized parallelism, Promise.race waits for all step promises to settle. If the repo relies on first-winner behavior, use group.parallel().
For serverless platforms, configure checkpointing maxRuntime slightly below the platform limit:
export const inngest = new Inngest({
id: "my-app",
checkpointing: {
maxRuntime: "50s",
},
});On Vercel or similar frameworks, also set the route handler's max duration where the platform supports it.
If the repo uses Connect:
rewriteGatewayEndpoint is replaced by gatewayUrl.isolateExecution: false or INNGEST_CONNECT_ISOLATE_EXECUTION=false.
Run checks in increasing confidence:
INNGEST_DEV=1.npx inngest-cli@latest dev and confirm function discovery.If local dev-server verification is not possible, state exactly which static checks passed and what runtime verification remains.
INNGEST_DEV=1 forlocal development or configure INNGEST_SIGNING_KEY for production.
@inngest/realtime middleware in a v4 app. Remove the package and migrate to native realtime.
imported function references or referenceFunction().
EventSchemas with eventType() andstaticSchema().
group.parallel() for first-winnerstep races or disable optimized parallelism only when necessary.
inngest@4.signingKey, baseUrl, or signingKeyFallback to serve().EventSchemas with untyped string events everywhere.isDev: true in production-bound source.step.invoke.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.