Repository navigation
fix(deps): update dependency @taskcluster/client to v114 - #1092
Open
renovate-bot wants to merge 1 commit into
Open
renovate-bot wants to merge 1 commit into
renovate-bot wants to merge 1 commit into
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
110.1.0→114.0.0Release Notes
taskcluster/taskcluster (@taskcluster/client)
v114.0.0Compare Source
GENERAL
▶ [minor] bug 2081655
Worker-manager
worker-pool-errorpulse messages now include an optionalerrorCodewith the provider-specific error code, such as Google GCE operation codes (e.g.ZONE_RESOURCE_POOL_EXHAUSTED) or Azure error codes.Operation errors reported by the Google provider now also include
workerIdandworkerGroupin these messages.▶ [minor] bug 2081655
Worker-manager
worker-stoppedpulse messages now include an optionalreason, such asinstance TERMINATEDorinstance not found, when the provider can tell why the worker is considered stopped.The Google and AWS providers set it, and the
worker-stoppedlog entry carries the samereasonfield.worker-requestedandworker-runningmessages are unchanged.▶ [patch]
Upgrades to uv 0.13.6 [SECURITY].
DEPLOYERS
▶ [minor] #9279
The auth service now sets a rate limit on the temporary Sentry DSNs it creates via
auth.sentryDSN, defaulting to 30 events per 60 seconds. Deployers can override this with the newSENTRY_RATE_LIMIT_COUNTandSENTRY_RATE_LIMIT_WINDOW(seconds) configuration values (auth.sentry_rate_limit_countandauth.sentry_rate_limit_windowin the Helm values). Keys created before this change are not rate-limited, but they expire and are replaced within 48 hours.▶ [patch] #7667
Removed the expired (2026-08-25) cross-signed Azure intermediate certificates from worker-manager.
WORKER-DEPLOYERS
▶ [patch] bug 2013686
Generic Worker (Linux, with D2G enabled) now stops an aborted task's container before copying artifacts out of it, rather than afterwards. Aborting a task kills the
docker runclient, but not the container, which kept running and competing for resources while the worker copied artifacts and resolved the task. This matters most on spot instances, where the worker has only a short notice to resolve the task asexception/worker-shutdownbefore the instance is terminated.▶ [patch] #9280
Generic Worker on Windows multiuser makes fewer system calls per file when granting a task user control of a writable directory cache, which speeds up mounting caches with many small files.
▶ [patch]
Generic Worker's websocket-to-TCP port exposure no longer leaks a goroutine for every connection. The handler now returns once both directions of the bridge have closed. Previously it waited on a
sync.WaitGroupthat was never decremented. Nothing in Generic Worker currently exposes TCP ports this way (livelog and interactive use HTTP exposure), so this has no effect in practice today.▶ [patch] bug 2076152
The worker will no longer follow links when cleaning up
live_backing.logwhich would've allowed a task to remove any other task's log.USERS
▶ [MAJOR] bug 2084218
The queue now rejects artifact names with
.or..path segments, likepublic/./xorpublic/../x. Names that just contain dots, likepublic/final..doc, are still fine. Such names produced download URLs pointing at the wrong place in storage.Download URLs for
s3artifacts now escape special characters in the name, so they point at the right object.▶ [minor]
New
auth.listGithubAppsendpoint to list the github apps usable withgithubRepoToken.▶ [patch] bug 2072172
The Shell button on the Interactive Connect page now opens the shell with
noopener, so the opened page can no longer navigate the original UI tab.Previously, a task could point its shell artifact at its own page and use it to redirect the UI tab.
▶ [patch]
The
replyTofield ofnotify.emailrequests is now honoured. Previously it was accepted but never set on the outgoing email.▶ [patch] #9284
The
taskclusterHomebrew cask no longer triggers deprecation warnings for theverifiedURL parameter and thepostflightstanza. It is now built with goreleaser v2.19.0, which removesverifiedand writes the macOS quarantine-removal hook aspostflight_steps.▶ [patch]
The github service no longer holds one of its 10 shared API request slots while waiting to retry a failed request
▶ [patch] #9235
The notify service's
slackendpoint now returns a 400InputErrorwhen Slack rejects the channel (channel_not_found,not_in_channeloris_archived), instead of a 500InternalServerError.▶ [patch]
When
githubRepoTokenfails because the github app isn't installed on the requested owner, the error now includes the github app's slug. Rate limit errors also include it when it's already known.▶ [patch] #9316
web-server's pulse subscriptions now recover automatically when RabbitMQ cancels the consumer, and client disconnects are no longer reported as errors.
DEVELOPERS
▶ [patch] #8933
Refreshed the Azure attested-data test fixture, which expires 2027-01-29, and bundled its
Microsoft TLS G2 RSA CA OCSP 16intermediate.Automated Package Updates
15 Dependabot updates
ceeb791)24c1620)7b9cab9)5fc703a)c1f9915)488aefd)6503b4e)b23ff30)1402a8f)ae56e66)acf02a4)728a2e1)f5c7339)dd6bb6a)0508706)v113.2.0Compare Source
GENERAL
▶ [patch]
Upgrades to Node.js v24.22.0.
▶ [patch]
Upgrades to Node.js v24.22.1 [SECURITY].
▶ [patch]
Upgrades to go1.27.3 and golangci-lint v2.15.0.
Release notes here.
▶ [patch]
Upgrades to uv 0.13.4 [SECURITY].
DEPLOYERS
▶ [patch] #8259
Development tooling now supports Helm v3 and v4 for rendering k8s
templates, and the chart now declares
apiVersion: v2.▶ [patch] bug 2071821
The auth service's
updateRolenow checks which scopes are being added against the roles currently in the database, not a possibly stale in-memory copy.▶ [patch] bug 2084234
The notify service now ignores task routes outside its configured route prefix (
notify.by default). Before, such routes could trigger notifications without thequeue:route:notify.*scope check.▶ [patch] #7677
Worker Manager's
registerWorkernow returns503instead of400when an Azure worker's intermediate certificate cannot be downloaded, so that workers retry registration instead of failing.WORKER-DEPLOYERS
▶ [minor] #9202
Generic Worker (Linux, with D2G enabled) now prunes docker resources when the docker data-root (as reported by
docker info) is low on disk space, rather than whentasksDiris. Previously, a docker data-root on a separate filesystem could fill up unchecked, and a lowtasksDirpruned docker resources even though that freed no space intasksDir. Whiledocker infofails (e.g. before the docker daemon has started), free space is measured intasksDiras before, and the lookup is retried every minute.The new
requiredDockerDiskSpaceMegabytesconfig setting sets the free space required in the docker data-root. It defaults to0, which meansrequiredDiskSpaceMegabytesis used, so nothing changes when the docker data-root shares a filesystem withtasksDir. In that case, don't set it lower thanrequiredDiskSpaceMegabytes. If your docker data-root is on a separate filesystem smaller thanrequiredDiskSpaceMegabytes, set it to a value that filesystem can satisfy, otherwise docker resources will be pruned whenever the worker is idle.▶ [patch] #9203
Generic Worker (Linux, with D2G enabled) no longer waits for
docker rmbefore resolving a task. The task's container is stopped when the task finishes and removed in the background, since removing it can take minutes. Since this no longer delays the task, the container's anonymous volumes are removed with it again. Before pruning docker resources, the garbage collector waits for pending removals, since they may free enough space.▶ [patch]
Generic Worker now reports crashes to Sentry with the maintained
github.com/getsentry/sentry-goSDK, replacing the archivedraven-go[SECURITY].raven-goverified TLS against a CA bundle vendored in 2021, which still trusts the compromised emSign ECC Root CA - G3. Crash reports now use the system root CA store.USERS
▶ [patch] #7776
The GitHub service now accepts
.in repository names, fixing 500 errors fromgithub.builds()for repositories likefoo.rs.▶ [patch]
The Rust client's lockfile now uses
webpki-root-certs1.0.10, which removes the compromised emSign ECC Root CA - G3 root [SECURITY]. Applications that depend on thetaskclustercrate should also runcargo update -p webpki-root-certsto pick up the fix in their own lockfiles.DEVELOPERS
▶ [patch]
The release tooling no longer uploads missing assets to a GitHub release that is already published. If a published release's assets don't match the build artifacts, it stops with an error that lists every asset that differs. This prepares for turning on GitHub immutable releases for
taskcluster/taskcluster.taskcluster/staging-releasesmust keep immutable releases disabled, because staging deletes and recreates releases that use the same tag.Automated Package Updates
9 Dependabot updates
00ae714)6ca3435)d0c73f3)d36a4f5)540963a)ec829b6)dba4862)003aee8)ec2d2e9)v113.1.3Compare Source
USERS
▶ [patch]
The provisioners and worker types pages now show pending and claimed task counts.
▶ [patch] #9271
UI: the worker pool Launch Configs page now shows worker counts and capacity as soon as the stats load, instead of only after the table is re-sorted. The Requested, Running, Stopping and Stopped columns can be sorted too, and the column the table is sorted by is marked.
OTHER
▶ Additional change not described here: #7022.
v113.1.2Compare Source
USERS
▶ [patch] bug 2081758
Fixed users being logged out when multiple tabs renewed Taskcluster credentials at the same time. Session IDs are no longer rotated on every credentials refresh.
v113.1.1Compare Source
GENERAL
▶ [patch]
Upgrades to Node.js v24.21.0.
▶ [patch]
Upgrades to go1.27.2 and golangci-lint v2.14.0.
Release notes here.
USERS
▶ [patch] #6724
The UI no longer adds a
bewitto artifact links when theanonymousrole can read the artifact. This also fixes opening public artifacts for users with many roles, whose signed URLs were too long (#4333).▶ [patch]
The web UI now renews expired Taskcluster credentials before REST API requests. Temporary renewal failures no longer clear the local session.
▶ [patch] #9265
taskcluster-proxy no longer stalls for minutes when its upstream connection silently stops working. It now pings HTTP/2 connections that receive nothing for 30 seconds and closes them if the ping isn't answered within 15 seconds, so pending requests are retried on a new connection. Upstream requests are also cancelled when the client disconnects, and credential updates no longer wait for (or block) pending requests.
v113.1.0Compare Source
WORKER-DEPLOYERS
▶ [minor] bug 2070518
Reregister worker refuses to renew credentials for workers whose launch config has been archived.
This can happen when the worker pool definition changes or the worker pool is deleted.
Such workers fail to renew their credentials, so tasks they are still running may be aborted rather than drained.
USERS
▶ [minor] bug 2072155
auth.updateClientnow fails withRequestConflictif the client was modified between being read and written, instead of silently overwriting concurrent changes.▶ [minor]
Generic Worker now downloads the content of a task's file and read-only directory mounts in parallel (up to 8 at a time) before mounting them, rather than one after another. Mounts are still mounted sequentially in the order they are listed in the payload. Content of preloaded writable directory caches is still only downloaded if no existing cache can be reused.
▶ [patch] bug 2076126
Generic worker now confirms with the queue that a task may download an artifact before mounting a copy from its download cache. Each cached artifact mount makes one extra queue request.
v113.0.0Compare Source
DEPLOYERS
▶ [MAJOR] #8874
The UI subscription endpoint setting has been renamed: use
SUBSCRIPTION_ENDPOINTinstead ofGRAPHQL_SUBSCRIPTION_ENDPOINT, andui.subscription_endpointinstead ofui.graphql_subscription_endpoint. Update deployment configuration before upgrading.▶ [patch]
The public deployment scope list in the anonymous role docs now includes
queue:list-task-queues, which the dashboard needs to show counts for task queues that worker-manager does not own.The worker pools page now only blames missing scopes when task queue counts fail with
InsufficientScopes, and shows the actual error otherwise.▶ [patch] #9206
Worker Manager now computes a worker pool's worker counts and capacities only when it actually returns them, in the
workerPoolandcreateWorkerPoolendpoints. Previously every worker pool lookup computed them, including eachregisterWorkercall, the worker scanner, and provider error reporting. That query reads every worker row in the pool, so a large pool scaling up quickly could drive database CPU to 100% as each newly booted worker registered.WORKER-DEPLOYERS
▶ [patch] bug 2071833
Generic Worker on Windows multiuser now replaces (instead of merging) DACLs when granting a task user control of task and writable-directory-cache trees, and protects those DACLs from inheritance so leftover
BUILTIN\Users/ Everyone ACEs cannot follow the cache.cachesDiranddownloadsDirare given a protected worker-only DACL at startup so they no longer inherit those ACEs from a drive root.▶ [patch]
On Windows, generic-worker now checks free space on the configured task volume. Previously, it checked the process working directory even when
tasksDirwas on a different volume, which could cause incorrect cache cleanup decisions.DEVELOPERS
▶ [MAJOR] #9190
The web-server service no longer serves a GraphQL API. The
/graphqlendpoint and the/playgroundpage have been removed.Automated Package Updates
3 Dependabot updates
9981e7e)04c5604)2f8e37d)v112.0.0Compare Source
ADMINS
▶ [patch]
Web processes now bound how long a database call will wait for a free database connection to 10s instead of forever. When that wait trips, REST API endpoints now return a 503
ServiceUnavailableerror instead of a 500.USERS
▶ [MAJOR]
Generic Worker now requires
mountspaths (propertiesdirectoryandfile) to be relative paths that stay inside the task directory. Tasks with absolute mount paths, or relative paths that escape the task directory (e.g.../foo), resolve asexception/malformed-payload.▶ [patch]
Generic Worker now writes mounted content through the task directory without following symbolic links out of it. A mount whose path passes through a link leaving the task directory (for example one left in a writable cache by an earlier task) now fails the task instead of writing elsewhere.
Automated Package Updates
5 Dependabot updates
8c3b565)a50495c)24512ee)e4ff1d5)629dddf)v111.0.0Compare Source
USERS
▶ [MAJOR]
The
purgeCache.purgeRequestsmethod now correctly requires the scopepurge-cache:purge-requests:<workerPoolId>instead ofpurge-cache:purge-requests::<workerPoolId>▶ [MAJOR] bug 2070520
index.insertTaskwill now reject anexpiresthat is in the past, ataskIdthat does not resolve to a task, and will silently cap the indexexpiry to the task's own expiry.
▶ [minor] bug 2070520
Index entries created from
index.*routes are now capped at the expiry of thetask they point at. Tasks whose
task.extra.index.expiresis not a valid datein the future are no longer indexed, and no longer leave an empty namespace
behind them.
▶ [patch] bug 2059401
GitHub service now leaves a clear error comment when a task in
.taskcluster.ymluses ataskGroupIdthat belongs to another build. Such tasks were already rejected before, just without a helpful error.▶ [patch] #9180
Live-update subscriptions in the UI now obtain fresh credentials each time they connect, and stop retrying when the server rejects the credentials as expired. The web-server no longer reports expired subscription credentials as internal errors.
▶ [patch] bug 2072159
UI artifact redirects, log views, and GitHub check-run artifact links now preserve names containing URL-special characters.
▶ [patch]
Web-server session cookie is now set with
SameSite=laxto mitigate CSRF against session-authenticated endpoints.The cookie is no longer sent on cross-site requests, while same-origin UI and OAuth login redirects are unaffected.
DEVELOPERS
▶ [patch] #8928
Fixes view task page UI to call switching from GraphQL to REST endpoints
▶ [patch] #3665
Service and library tests now allocate ephemeral ports via
testing.getFreePort(), avoiding intermittentEADDRINUSEfailures when multiple suites start HTTP servers.▶ [patch] #9186
The UI now fetches user credentials and login status from the new web-server
REST endpoints
POST /login/credentialsandGET /login/is-logged-in, whichare authenticated by the session cookie. The
getCredentialsandisLoggedInGraphQL queries have been removed.
▶ [patch] #9181
The task definition, task redirect (edit / interactive) and interactive connect
UI views now fetch their data through the Taskcluster REST clients.
▶ [patch] #9194
The task log UI view now fetches the task name and run state through the
Taskcluster REST clients. This was the last UI view using GraphQL, so the
Apollo client, its GraphQL/subscription links, and the
@apollo/client,graphql,subscriptions-transport-ws,@graphql-tools/*and@rollup/plugin-graphqldependencies have been removed from the UI.OTHER
▶ Additional change not described here: #9142.
Automated Package Updates
21 Dependabot updates
3e181a3)f889642)8852eb1)c4da206)0273f0b)999b792)b493089)bc9badb)2fef9af)c117955)011eaf6)82c3535)75cf610)df386e2)b885f99)06ed81b)4b1dffc)7c69d76)8cfc392)a182501)808a405)Configuration
📅 Schedule: (in timezone UTC)
* * 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.