[dependabot]

Bumps taskcluster from 97.0.1 to 112.0.0.

Release notes

Sourced from taskcluster's releases.

v112.0.0

ADMINS

▶ [patch] Web processes now bound how long a database call will wait for a free database connection to 10s instead of forever. When that wait trips, REST API endpoints now return a 503 ServiceUnavailable error instead of a 500.

USERS

▶ [MAJOR] Generic Worker now requires mounts paths (properties directory and file) to be relative paths that stay inside the task directory. Tasks with absolute mount paths, or relative paths that escape the task directory (e.g. ../foo), resolve as exception/malformed-payload.

▶ [patch] Generic Worker now writes mounted content through the task directory without following symbolic links out of it. A mount whose path passes through a link leaving the task directory (for example one left in a writable cache by an earlier task) now fails the task instead of writing elsewhere.

Automated Package Updates

• build(deps): bump the node-deps group across 1 directory with 17 updates (8c3b565981)
• build(deps): bump the ui-node-deps group across 1 directory with 2 updates (a50495cb12)
• build(deps-dev): bump ruff (24512ee3c0)
• build(deps): bump github.com/shirou/gopsutil/v4 (e4ff1d5699)
• build(deps): bump hmac-sha256 (629dddf61e)

v111.0.0

USERS

▶ [MAJOR] The purgeCache.purgeRequests method now correctly requires the scope purge-cache:purge-requests:<workerPoolId> instead of purge-cache:purge-requests::<workerPoolId>

▶ [MAJOR] bug 2070520 index.insertTask will now reject an expires that is in the past, a taskId that does not resolve to a task, and will silently cap the index expiry to the task's own expiry.

▶ [minor] bug 2070520 Index entries created from index.* routes are now capped at the expiry of the task they point at. Tasks whose task.extra.index.expires is not a valid date in the future are no longer indexed, and no longer leave an empty namespace behind them.

▶ [patch] bug 2059401 GitHub service now leaves a clear error comment when a task in .taskcluster.yml uses a taskGroupId that belongs to another build. Such tasks were already rejected before, just without a helpful error.

▶ [patch] #9180 Live-update subscriptions in the UI now obtain fresh credentials each time they connect, and stop retrying when the server rejects the credentials as expired. The web-server no longer reports expired subscription credentials as internal errors.

... (truncated)

Changelog

Sourced from taskcluster's changelog.

v112.0.0

ADMINS

▶ [patch] Web processes now bound how long a database call will wait for a free database connection to 10s instead of forever. When that wait trips, REST API endpoints now return a 503 ServiceUnavailable error instead of a 500.

USERS

▶ [MAJOR] Generic Worker now requires mounts paths (properties directory and file) to be relative paths that stay inside the task directory. Tasks with absolute mount paths, or relative paths that escape the task directory (e.g. ../foo), resolve as exception/malformed-payload.

▶ [patch] Generic Worker now writes mounted content through the task directory without following symbolic links out of it. A mount whose path passes through a link leaving the task directory (for example one left in a writable cache by an earlier task) now fails the task instead of writing elsewhere.

Automated Package Updates

• build(deps): bump the node-deps group across 1 directory with 17 updates (8c3b565981)
• build(deps): bump the ui-node-deps group across 1 directory with 2 updates (a50495cb12)
• build(deps-dev): bump ruff (24512ee3c0)
• build(deps): bump github.com/shirou/gopsutil/v4 (e4ff1d5699)
• build(deps): bump hmac-sha256 (629dddf61e)

v111.0.0

USERS

▶ [MAJOR] The purgeCache.purgeRequests method now correctly requires the scope purge-cache:purge-requests:<workerPoolId> instead of purge-cache:purge-requests::<workerPoolId>

▶ [MAJOR] bug 2070520 index.insertTask will now reject an expires that is in the past, a taskId that does not resolve to a task, and will silently cap the index expiry to the task's own expiry.

▶ [minor] bug 2070520 Index entries created from index.* routes are now capped at the expiry of the task they point at. Tasks whose task.extra.index.expires is not a valid date in the future are no longer indexed, and no longer leave an empty namespace behind them.

▶ [patch] bug 2059401 GitHub service now leaves a clear error comment when a task in .taskcluster.yml uses a taskGroupId that belongs to another build. Such tasks were already rejected before, just without a helpful error.

▶ [patch] #9180

... (truncated)

Commits

• ac2f5ab v112.0.0
• e1a5c1a Merge pull request #9189 from taskcluster/matt-boris/blockAbsoluteMountPaths
• c2c8bff Merge pull request #9252 from taskcluster/cloudbuild-serialize-deploys
• f44c602 fix(generic-worker): resolve task user mount writes inside the task directory
• 8dc2e91 fix(generic-worker)!: require mount paths inside the task directory
• 615e317 Merge pull request #9250 from taskcluster/dependabot/npm_and_yarn/node-deps-3...
• 8c3b565 build(deps): bump the node-deps group across 1 directory with 17 updates
• f1acc1b Merge pull request #9249 from taskcluster/dependabot/npm_and_yarn/ui/ui-node-...
• 0b1be16 Merge pull request #9251 from taskcluster/longer-timeout-client-tests
• f062ee1 add changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #203.