Bump taskcluster from 100.2.0 to 104.0.0

[dependabot]

Bumps taskcluster from 100.2.0 to 104.0.0.

Release notes

Sourced from taskcluster's releases.

v104.0.0

GENERAL

▶ [patch] #8947 Worker-manager refuses to re-register worker if it is no longer in Running state or has expired.

▶ [patch] #8662 Github: display artifact size in check results

USERS

▶ [MAJOR] #8867 Pulse-triggered hooks now validate matching pulse message payloads against the hook's triggerSchema before creating a task. If a pulse message matches the hook's bindings but fails triggerSchema validation, the message is discarded and no task is created. This is a breaking change: previously triggerSchema was only enforced on the API and webhook paths, and pulse messages fired the hook regardless of their payload. Validation is unconditional, including for hooks that did not set a triggerSchema: the default schema only accepts an empty payload, so such a hook will no longer fire on pulse messages that carry a payload. Before upgrading, review all hooks with pulse bindings and make sure each triggerSchema accepts the pulse payloads that should still create tasks. Once deployed, "Debug Bindings" feature will be available in the UI.

▶ [minor] bug 2056618 Fixes a possible SSRF in the github and web-server services, which download task artifacts. Both now resolve artifacts through the queue's artifact API and refuse to fetch a reference artifact, whose URL is supplied by the task; s3, link, and object artifacts, whose URLs the queue derives itself, are unaffected. The JS client exposes this as downloadManagedArtifact.

Two visible consequences:

• An artifact named by customCheckRun.textArtifactName or annotationsArtifactName must be a stored artifact. A reference now produces an explanatory comment on the commit instead of being fetched.
• The task log profiler cannot read a running task's live.log, which is a reference to the livelog server by design. It falls back to live_backing.log, so resolved tasks are unaffected.

▶ [minor] #8867 The hook page now has a Debug bindings button that opens a Pulse-binding debugger drawer. It watches the Pulse messages arriving on the hook's saved bindings and shows, per message, whether the payload passes the hook's triggerSchema or is . This makes it easy to see why a Pulse-triggered hook is silently not firing after triggerSchema validation was introduced, without reading server logs.

▶ [patch] #8711 The /tasks and /tasks/groups pages now show up to 20 recently viewed tasks/task groups with task name, queue, age and status information instead of 5 bare identifiers.

DEVELOPERS

▶ [patch] #8978 UI Roles page switches from GraphQL to direct service calls

▶ [patch] #8901 UI Secrets page switches from GraphQL to direct service calls

Automated Package Updates

... (truncated)

Changelog

Sourced from taskcluster's changelog.

v104.0.0

GENERAL

▶ [patch] #8947 Worker-manager refuses to re-register worker if it is no longer in Running state or has expired.

▶ [patch] #8662 Github: display artifact size in check results

USERS

▶ [MAJOR] #8867 Pulse-triggered hooks now validate matching pulse message payloads against the hook's triggerSchema before creating a task. If a pulse message matches the hook's bindings but fails triggerSchema validation, the message is discarded and no task is created. This is a breaking change: previously triggerSchema was only enforced on the API and webhook paths, and pulse messages fired the hook regardless of their payload. Validation is unconditional, including for hooks that did not set a triggerSchema: the default schema only accepts an empty payload, so such a hook will no longer fire on pulse messages that carry a payload. Before upgrading, review all hooks with pulse bindings and make sure each triggerSchema accepts the pulse payloads that should still create tasks. Once deployed, "Debug Bindings" feature will be available in the UI.

▶ [minor] bug 2056618 Fixes a possible SSRF in the github and web-server services, which download task artifacts. Both now resolve artifacts through the queue's artifact API and refuse to fetch a reference artifact, whose URL is supplied by the task; s3, link, and object artifacts, whose URLs the queue derives itself, are unaffected. The JS client exposes this as downloadManagedArtifact.

Two visible consequences:

• An artifact named by customCheckRun.textArtifactName or annotationsArtifactName must be a stored artifact. A reference now produces an explanatory comment on the commit instead of being fetched.
• The task log profiler cannot read a running task's live.log, which is a reference to the livelog server by design. It falls back to live_backing.log, so resolved tasks are unaffected.

▶ [minor] #8867 The hook page now has a Debug bindings button that opens a Pulse-binding debugger drawer. It watches the Pulse messages arriving on the hook's saved bindings and shows, per message, whether the payload passes the hook's triggerSchema or is . This makes it easy to see why a Pulse-triggered hook is silently not firing after triggerSchema validation was introduced, without reading server logs.

▶ [patch] #8711 The /tasks and /tasks/groups pages now show up to 20 recently viewed tasks/task groups with task name, queue, age and status information instead of 5 bare identifiers.

DEVELOPERS

▶ [patch] #8978 UI Roles page switches from GraphQL to direct service calls

▶ [patch] #8901 UI Secrets page switches from GraphQL to direct service calls

Automated Package Updates

... (truncated)

Commits

• b87cf94 v104.0.0
• 7c31faf feat(ui): show metadata for recently viewed tasks and task groups (#8755)
• ae26217 fix: changes roles page to rest (#8979)
• fa8c621 Merge pull request #8985 from taskcluster/dependabot/npm_and_yarn/ui/fast-uri...
• b4d292e Merge pull request #8987 from taskcluster/dependabot/npm_and_yarn/fast-uri-3.1.5
• eb522e1 Merge pull request #8986 from taskcluster/dependabot/npm_and_yarn/undici-6.28.0
• 940c2d7 Merge pull request #8984 from taskcluster/dependabot/npm_and_yarn/clients/cli...
• 9ec1e2f build(deps): bump fast-uri from 3.1.4 to 3.1.5
• 1993dfa build(deps): bump undici from 6.27.0 to 6.28.0
• 6dc4f9e build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /ui
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)