[dependabot]

Bumps taskcluster from 109.0.0 to 113.2.0.

Release notes

Sourced from taskcluster's releases.

v113.2.0

GENERAL

▶ [patch] Upgrades to Node.js v24.22.0.

▶ [patch] Upgrades to Node.js v24.22.1 [SECURITY].

▶ [patch] Upgrades to go1.27.3 and golangci-lint v2.15.0.

Release notes here.

▶ [patch] Upgrades to uv 0.13.4 [SECURITY].

DEPLOYERS

▶ [patch] #8259 Development tooling now supports Helm v3 and v4 for rendering k8s templates, and the chart now declares apiVersion: v2.

▶ [patch] bug 2071821 The auth service's updateRole now checks which scopes are being added against the roles currently in the database, not a possibly stale in-memory copy.

▶ [patch] bug 2084234 The notify service now ignores task routes outside its configured route prefix (notify. by default). Before, such routes could trigger notifications without the queue:route:notify.* scope check.

▶ [patch] #7677 Worker Manager's registerWorker now returns 503 instead of 400 when an Azure worker's intermediate certificate cannot be downloaded, so that workers retry registration instead of failing.

WORKER-DEPLOYERS

▶ [minor] #9202 Generic Worker (Linux, with D2G enabled) now prunes docker resources when the docker data-root (as reported by docker info) is low on disk space, rather than when tasksDir is. Previously, a docker data-root on a separate filesystem could fill up unchecked, and a low tasksDir pruned docker resources even though that freed no space in tasksDir. While docker info fails (e.g. before the docker daemon has started), free space is measured in tasksDir as before, and the lookup is retried every minute.

The new requiredDockerDiskSpaceMegabytes config setting sets the free space required in the docker data-root. It defaults to 0, which means requiredDiskSpaceMegabytes is used, so nothing changes when the docker data-root shares a filesystem with tasksDir. In that case, don't set it lower than requiredDiskSpaceMegabytes. If your docker data-root is on a separate filesystem smaller than requiredDiskSpaceMegabytes, set it to a value that filesystem can satisfy, otherwise docker resources will be pruned whenever the worker is idle.

▶ [patch] #9203 Generic Worker (Linux, with D2G enabled) no longer waits for docker rm before resolving a task. The task's container is stopped when the task finishes and removed in the background, since removing it can take minutes. Since this no longer delays the task, the container's anonymous volumes are removed with it again. Before pruning docker resources, the garbage collector waits for pending removals, since they may free enough space.

▶ [patch] Generic Worker now reports crashes to Sentry with the maintained github.com/getsentry/sentry-go SDK, replacing the archived raven-go [SECURITY]. raven-go verified TLS against a CA bundle vendored in 2021, which still trusts the compromised emSign ECC Root CA - G3. Crash reports now use the system root CA store.

USERS

▶ [patch] #7776 The GitHub service now accepts . in repository names, fixing 500 errors from github.builds() for repositories like foo.rs.

... (truncated)

Changelog

Sourced from taskcluster's changelog.

v113.2.0

GENERAL

▶ [patch] Upgrades to Node.js v24.22.0.

▶ [patch] Upgrades to Node.js v24.22.1 [SECURITY].

▶ [patch] Upgrades to go1.27.3 and golangci-lint v2.15.0.

Release notes here.

▶ [patch] Upgrades to uv 0.13.4 [SECURITY].

DEPLOYERS

▶ [patch] #8259 Development tooling now supports Helm v3 and v4 for rendering k8s templates, and the chart now declares apiVersion: v2.

▶ [patch] bug 2071821 The auth service's updateRole now checks which scopes are being added against the roles currently in the database, not a possibly stale in-memory copy.

▶ [patch] bug 2084234 The notify service now ignores task routes outside its configured route prefix (notify. by default). Before, such routes could trigger notifications without the queue:route:notify.* scope check.

▶ [patch] #7677 Worker Manager's registerWorker now returns 503 instead of 400 when an Azure worker's intermediate certificate cannot be downloaded, so that workers retry registration instead of failing.

WORKER-DEPLOYERS

▶ [minor] #9202 Generic Worker (Linux, with D2G enabled) now prunes docker resources when the docker data-root (as reported by docker info) is low on disk space, rather than when tasksDir is. Previously, a docker data-root on a separate filesystem could fill up unchecked, and a low tasksDir pruned docker resources even though that freed no space in tasksDir. While docker info fails (e.g. before the docker daemon has started), free space is measured in tasksDir as before, and the lookup is retried every minute.

The new requiredDockerDiskSpaceMegabytes config setting sets the free space required in the docker data-root. It defaults to 0, which means requiredDiskSpaceMegabytes is used, so nothing changes when the docker data-root shares a filesystem with tasksDir. In that case, don't set it lower than requiredDiskSpaceMegabytes. If your docker data-root is on a separate filesystem smaller than requiredDiskSpaceMegabytes, set it to a value that filesystem can satisfy, otherwise docker resources will be pruned whenever the worker is idle.

▶ [patch] #9203 Generic Worker (Linux, with D2G enabled) no longer waits for docker rm before resolving a task. The task's container is stopped when the task finishes and removed in the background, since removing it can take minutes. Since this no longer delays the task, the container's anonymous volumes are removed with it again. Before pruning docker resources, the garbage collector waits for pending removals, since they may free enough space.

▶ [patch] Generic Worker now reports crashes to Sentry with the maintained github.com/getsentry/sentry-go SDK, replacing the archived raven-go [SECURITY]. raven-go verified TLS against a CA bundle vendored in 2021, which still trusts the compromised emSign ECC Root CA - G3. Crash reports now use the system root CA store.

USERS

▶ [patch] #7776 The GitHub service now accepts . in repository names, fixing 500 errors from github.builds() for repositories like foo.rs.

... (truncated)

Commits

• efb71e9 v113.2.0
• ebee5d9 feat(notify): ignore routes outside the configured prefix (#9302)
• 67cda1a Merge pull request #9304 from taskcluster/matt-boris/moreSecUpgrades
• 207cd78 Merge pull request #9299 from taskcluster/matt-boris/gwDockerRmInBackground
• 31c2131 fix(generic-worker): remove D2G task containers in the background
• 320a87d fix(generic-worker): prune docker when its data-root is low on space
• 998a513 fix(generic-worker): replace raven-go with sentry-go
• c6c8d8d fix(client-rust): bump webpki-root-certs to 1.0.10
• 305eb7b build(deps): upgrade to node 24.22.1 [SECURITY]
• c6ccb9b Merge pull request #9303 from taskcluster/matt-boris/bumpUv
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)