fix(deps): update dependency @taskcluster/client to v107 - #1032
Merged
Eijebong merged 1 commit intoSep 1, 2026
Merged
Conversation
Eijebong
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
101.1.0→107.0.0Release Notes
taskcluster/taskcluster (@taskcluster/client)
v107.0.0Compare Source
GENERAL
▶ [patch]
Upgrades to go1.27.0 and golangci-lint v2.13.1.
Release notes here.
WORKER-DEPLOYERS
▶ [patch] bug 2062170
Pass taskcluster proxy credentials through environment variables instead of named parameters
USERS
▶ [MAJOR]
Removed all mentions of the unused queue actions feature.
The
actionsproperty is removed from the responses ofqueue.listProvisioners,queue.getProvisioner,queue.getWorkerType,queue.getWorker, andworkerManager.worker, from the corresponding GraphQLtypes, and from the web UI.
▶ [MAJOR] bug 2062161
Removed the deprecated
queue.declareProvisionerandqueue.declareWorkerTypemethods.▶ [patch]
Fixed unsafe handling of inherited JavaScript properties when rendering
.taskcluster.ymlfiles through v0 parameters and v1as_slugid()labels.▶ [patch] bug 2065461
Prevent the notify service from fetching files and remote URLs referenced in
the content of the emails it sends. This also stops the plain text part of
those emails from being mangled by the HTML processing.
▶ [patch] bug 2062161
queue.declareWorkernow returns a 400 instead of a 500 when passed an empty bodyDEVELOPERS
▶ [patch] #8981
UI Clients page switches from GraphQL to direct service calls
▶ [patch]
Upgrades to yarn 4.18.0
v106.0.0Compare Source
USERS
▶ [MAJOR] bug 2064901
Github hooks triggered from .taskcluster.yml now require the
github:trigger-hook:<name>scope instead ofhooks:trigger-hook:<name>.▶ [minor] #8378
The auth service can now hand out repository scoped tokens through
/api/auth/v1/github/<app>/<owner>/repo-token. See the route documentation for moreinformation.
▶ [patch] bug 2062167
Fixed a bug where multiple interactive sessions on a worker with capacity greater than 1 would override eachother's secrets.
DEVELOPERS
▶ [patch]
Upgrade json-e to 4.8.4.
v105.1.0Compare Source
GENERAL
▶ [patch]
Upgrades to Node.js v24.19.0.
▶ [patch]
Upgrades to go1.26.6.
Release notes here.
WORKER-DEPLOYERS
▶ [patch] #9008
Generic worker now purges a task's writable directory caches when the worker
kills the task's commands (cancellation, max runtime, OOM), instead of keeping
a potentially corrupt cache
USERS
▶ [minor] bug 2064373
Slack notifications no longer show link previews by default. You can re-enable
that through the
unfurlLinks/unfurlMediafields on theslackAPI endpointor with
task.extra.notify.slackUnfurlLinks/slackUnfurlMediafor routebased notifications.
▶ [patch]
Properly report errors from d2g when a docker image has an invalid name rather
than letting docker fail on it and reporting those errors.
▶ [patch]
The JS clients now throw an error if
authorizedScopesis passed as anythingbut an array (or
null) instead of outright ignoring it in that case.▶ [patch]
finishArtifactnow reports a 400 instead of a 500 when called on a non object artifactAutomated Package Updates
1 Dependabot updates
e824a8f)v105.0.0Compare Source
WORKER-DEPLOYERS
▶ [MAJOR] #8990
Generic worker has ipv6 enabled again for d2g tasks if it's enabled on the
default bridge. Due to how docker handles ipv6 on networks that are necessary
for capacity > 1, this raises the minimum docker version supported by generic
worker to 27.
USERS
▶ [patch]
Fix the UI crashing on a fresh OIDC signin
DEVELOPERS
▶ [patch] #8994
UI Cache Purges page switches from GraphQL to direct service calls
▶ [patch] #8927
UI Create Task page switches to use decorator for api call
Automated Package Updates
5 Dependabot updates
4efd5e3)e4b9874)0aaec70)91b5c72)316abe3)v104.0.0Compare Source
GENERAL
▶ [patch] #8947
Worker-manager refuses to re-register worker if it is no longer in Running state or has expired.
▶ [patch] #8662
Github: display artifact size in check results
USERS
▶ [MAJOR] #8867
Pulse-triggered hooks now validate matching pulse message payloads against the hook's
triggerSchemabefore creating a task.If a pulse message matches the hook's
bindingsbut failstriggerSchemavalidation, the message is discarded and no task is created.This is a breaking change: previously
triggerSchemawas only enforced on the API and webhook paths, and pulse messages fired the hook regardless of their payload.Validation is unconditional, including for hooks that did not set a
triggerSchema: the default schema only accepts an empty payload, so such a hook will no longer fire on pulse messages that carry a payload.Before upgrading, review all hooks with pulse
bindingsand make sure eachtriggerSchemaaccepts the pulse payloads that should still create tasks. Once deployed, "Debug Bindings" feature will be available in the UI.▶ [minor] bug 2056618
Fixes a possible SSRF in the github and web-server services, which download task artifacts. Both
now resolve artifacts through the queue's artifact API and refuse to fetch a
referenceartifact,whose URL is supplied by the task;
s3,link, andobjectartifacts, whose URLs the queuederives itself, are unaffected. The JS client exposes this as
downloadManagedArtifact.Two visible consequences:
customCheckRun.textArtifactNameorannotationsArtifactNamemust be a stored artifact. Areferencenow produces an explanatory comment on the commit instead of being fetched.live.log, which is areferenceto the livelog server by design. It falls back tolive_backing.log, so resolved tasks are unaffected.▶ [minor] #8867
The hook page now has a Debug bindings button that opens a Pulse-binding debugger drawer.
It watches the Pulse messages arriving on the hook's saved bindings and shows, per message, whether the payload passes the hook's
triggerSchemaor is .This makes it easy to see why a Pulse-triggered hook is silently not firing after
triggerSchemavalidation was introduced, without reading server logs.▶ [patch] #8711
The /tasks and /tasks/groups pages now show up to 20 recently viewed tasks/task groups
with task name, queue, age and status information instead of 5 bare identifiers.
DEVELOPERS
▶ [patch] #8978
UI Roles page switches from GraphQL to direct service calls
▶ [patch] #8901
UI Secrets page switches from GraphQL to direct service calls
Automated Package Updates
22 Dependabot updates
9ec1e2f)1993dfa)6dc4f9e)86b3c85)2b83dff)e8439a8)5d6d4e7)a13e2be)b2a476a)bb3268e)fed0483)06d8ed7)7944eb2)7437682)26bde2f)4356626)4ca6e54)95c00a1)2fa0298)e5af776)ae34f5f)5241503)v103.0.1Compare Source
WORKER-DEPLOYERS
▶ [patch]
Generic worker now continues trying to garbage collect caches even if one
removal fails for any reason
USERS
▶ [patch] #8942
Fix workers panicking if a task that's not resolved yet would exhaust enough
disk space for the worker to not meet their minimum disk space required to
claim new tasks.
▶ [patch]
Generic worker will try evicting writable cache directories again when garbage
collecting. This was regressed in v100.0.0
▶ [patch]
Workers will now reliably clean task directories / users again. The cleanup
behavior was regressed in v100.0.0
v103.0.0Compare Source
DEPLOYERS
▶ [minor]
The Helm chart now supports annotations on Taskcluster workload pods. Use the global
podAnnotationsmap for every Deployment and CronJob pod. A service process'spodAnnotationsmap is merged with the global map for that workload, with process values taking precedence for matching keys.▶ [patch]
Fixed a potential panic in websocktunnel when a worker sent a malformed ACK
▶ [patch]
Websocktunnel will now close sessions when a client sends an invalid packet instead of silently ignoring it
ADMINS
▶ [patch] bug 2057491
Fixed a bug in the auth service's scope resolver where the scopes
:*,::*,:a*,:as*,:ass*,:assu*,:assum*and:assume*were expanded as ifthey were
*USERS
▶ [MAJOR] #8869
The client-rust
AsyncWriterFactorynow needs to beSendand theget_writermethod now takes an optionalcontent_lengthparameter that indicates what size the writer should expect. Theget_writermethod is also now only called when the initial request succeeded and the response stream is about to be pulled.▶ [patch] #7590
Add UI to view audit history for client, roles, hooks, secrets
▶ [patch]
Fix a potential panic in the interactive feature when a window resize was sent with fewer bytes than expected
▶ [patch] bug 2056592
Fixed a bug in the auth service where a concurrent modification conflict while
creating, updating, or deleting a role was silently reported as success
▶ [patch]
Fixed a bug in the auth service where purging an expired client recorded the
deletion in the audit history as
createdinstead ofexpired▶ [patch] bug 2056597
Fixed a worker panic when declaring a directory artifact as an absolute path
▶ [patch]
The github YAML debug route now properly reports templating issues as a 400 instead of a 500
DEVELOPERS
▶ [patch] #8533
Refreshed the Azure IMDS attested-data test fixture (
services/worker-manager/test/fixtures/azure_signature_good.json), whose leaf certificate expired on 2026-07-28.The new document is signed under the post-2025
Microsoft TLS RSA Root G2hierarchy, so theMicrosoft TLS G2 RSA CA OCSP 02and04intermediates are now bundled in the worker-manager Azure CA store.▶ [patch] #8912
UI adds withTaskclusterClient decorator to create rest client removing the need to using props
for rest client creation
OTHER
▶ Additional change not described here: bug 2055774.
Automated Package Updates
16 Dependabot updates
975ca85)36dafa3)c1a7b69)1476273)084be1a)e95af5b)de19cf5)6c873b9)18fe383)127462b)1017887)ca2fccd)3634079)9c1e1ac)aa46d23)809bd59)v102.0.1Compare Source
WORKER-DEPLOYERS
▶ [patch] #8890
Generic Worker FreeBSD build has been fixed.
Automated Package Updates
4 Dependabot updates
1134030)b15dd41)1d5a64c)9953989)Configuration
📅 Schedule: (in timezone UTC)
* * 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.