[dependabot]

Bumps taskcluster from 97.0.1 to 111.0.0.

Release notes

Sourced from taskcluster's releases.

v111.0.0

USERS

▶ [MAJOR] The purgeCache.purgeRequests method now correctly requires the scope purge-cache:purge-requests:<workerPoolId> instead of purge-cache:purge-requests::<workerPoolId>

▶ [MAJOR] bug 2070520 index.insertTask will now reject an expires that is in the past, a taskId that does not resolve to a task, and will silently cap the index expiry to the task's own expiry.

▶ [minor] bug 2070520 Index entries created from index.* routes are now capped at the expiry of the task they point at. Tasks whose task.extra.index.expires is not a valid date in the future are no longer indexed, and no longer leave an empty namespace behind them.

▶ [patch] bug 2059401 GitHub service now leaves a clear error comment when a task in .taskcluster.yml uses a taskGroupId that belongs to another build. Such tasks were already rejected before, just without a helpful error.

▶ [patch] #9180 Live-update subscriptions in the UI now obtain fresh credentials each time they connect, and stop retrying when the server rejects the credentials as expired. The web-server no longer reports expired subscription credentials as internal errors.

▶ [patch] bug 2072159 UI artifact redirects, log views, and GitHub check-run artifact links now preserve names containing URL-special characters.

▶ [patch] Web-server session cookie is now set with SameSite=lax to mitigate CSRF against session-authenticated endpoints. The cookie is no longer sent on cross-site requests, while same-origin UI and OAuth login redirects are unaffected.

DEVELOPERS

▶ [patch] #8928 Fixes view task page UI to call switching from GraphQL to REST endpoints

▶ [patch] #3665 Service and library tests now allocate ephemeral ports via testing.getFreePort(), avoiding intermittent EADDRINUSE failures when multiple suites start HTTP servers.

▶ [patch] #9186 The UI now fetches user credentials and login status from the new web-server REST endpoints POST /login/credentials and GET /login/is-logged-in, which are authenticated by the session cookie. The getCredentials and isLoggedIn GraphQL queries have been removed.

▶ [patch] #9181 The task definition, task redirect (edit / interactive) and interactive connect UI views now fetch their data through the Taskcluster REST clients.

▶ [patch] #9194 The task log UI view now fetches the task name and run state through the

... (truncated)

Changelog

Sourced from taskcluster's changelog.

v111.0.0

USERS

▶ [MAJOR] The purgeCache.purgeRequests method now correctly requires the scope purge-cache:purge-requests:<workerPoolId> instead of purge-cache:purge-requests::<workerPoolId>

▶ [MAJOR] bug 2070520 index.insertTask will now reject an expires that is in the past, a taskId that does not resolve to a task, and will silently cap the index expiry to the task's own expiry.

▶ [minor] bug 2070520 Index entries created from index.* routes are now capped at the expiry of the task they point at. Tasks whose task.extra.index.expires is not a valid date in the future are no longer indexed, and no longer leave an empty namespace behind them.

▶ [patch] bug 2059401 GitHub service now leaves a clear error comment when a task in .taskcluster.yml uses a taskGroupId that belongs to another build. Such tasks were already rejected before, just without a helpful error.

▶ [patch] #9180 Live-update subscriptions in the UI now obtain fresh credentials each time they connect, and stop retrying when the server rejects the credentials as expired. The web-server no longer reports expired subscription credentials as internal errors.

▶ [patch] bug 2072159 UI artifact redirects, log views, and GitHub check-run artifact links now preserve names containing URL-special characters.

▶ [patch] Web-server session cookie is now set with SameSite=lax to mitigate CSRF against session-authenticated endpoints. The cookie is no longer sent on cross-site requests, while same-origin UI and OAuth login redirects are unaffected.

DEVELOPERS

▶ [patch] #8928 Fixes view task page UI to call switching from GraphQL to REST endpoints

▶ [patch] #3665 Service and library tests now allocate ephemeral ports via testing.getFreePort(), avoiding intermittent EADDRINUSE failures when multiple suites start HTTP servers.

▶ [patch] #9186 The UI now fetches user credentials and login status from the new web-server REST endpoints POST /login/credentials and GET /login/is-logged-in, which are authenticated by the session cookie. The getCredentials and isLoggedIn GraphQL queries have been removed.

▶ [patch] #9181 The task definition, task redirect (edit / interactive) and interactive connect UI views now fetch their data through the Taskcluster REST clients.

▶ [patch] #9194

... (truncated)

Commits

• 80a80d3 v111.0.0
• d497973 Merge pull request #9242 from Eijebong/csp-bump
• 93936cd Merge pull request #9240 from Eijebong/gyp
• 8c6fb16 Merge pull request #9239 from Eijebong/vite-bump
• 3b123f5 Merge pull request #9238 from Eijebong/i-rest-my-case-your-honor
• 6990c6d Merge pull request #9241 from Eijebong/biome-bump
• 6e78fb4 Update content-security-policy to 0.4.0
• 7a55213 Update biome to 2.5.15
• 0cc1ecd Force bump node-gyp in the UI lockfile
• b081d67 Merge pull request #9218 from taskcluster/dependabot/npm_and_yarn/clients/cli...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #197.