Open Bug 2035678 Opened 3 months ago

[wpt-sync] Sync PR 59505 - Bump taskcluster from 99.1.0 to 99.2.0 in /tools

Categories

(Testing :: web-platform-tests, task, P4)

Product:
Testing
Component:
web-platform-tests
Type:
task

Tracking

(Not tracked)

People

(Reporter: wpt-sync, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 59505 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/59505
Details from upstream follow.

dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> wrote:

Bump taskcluster from 99.1.0 to 99.2.0 in /tools

Bumps taskcluster from 99.1.0 to 99.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taskcluster/taskcluster/releases">taskcluster's releases</a>.</em></p>
<blockquote>
<h2>v99.2.0</h2>
<h3>DEPLOYERS</h3>
<p>▶ [minor] <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8243">#8243</a>
Add optional <a href="https://gateway-api.sigs.k8s.io/">Kubernetes Gateway API</a> support (<code>Gateway</code>, <code>HTTPRoute</code>, <code>HealthCheckPolicy</code>) as an alternative to the existing <code>Ingress</code> resource. These new resources are only rendered when <code>ingressType: gateway</code> is set in Helm values, so existing Ingress-based deployments are unaffected and no new CRDs or <code>skipResourceTypes</code> entries are required.</p>
<p>To adopt Gateway API for traffic routing, set <code>ingressType: gateway</code> along with <code>gatewayClassName</code>, and for GKE regional external ALBs, <code>gatewayStaticIpName</code> and <code>gcpManagedCertName</code>. Both <code>Ingress</code> and Gateway API resources will be rendered side-by-side, letting you migrate at your own pace; add <code>ingress</code> to <code>skipResourceTypes</code> once the Gateway setup is validated to stop rendering the legacy Ingress.</p>
<p>See the <a href="https://github.com/taskcluster/taskcluster/blob/main/dev-docs/dev-deployment.md#gateway-api">Gateway API section of the dev deployment docs</a> for setup instructions.</p>
<p>▶ [patch] <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8526">#8526</a>
Fixed the Azure provider's <code>deprovisionResource</code> wasting a worker-scanner cycle per resource when the backing VM/NIC/IP/disk had already been removed out-of-band (e.g. ARM cascade-delete via <code>deleteOption: 'Delete'</code>, Spot preemption). Previously the pre-flight <code>GET</code> was skipped whenever the worker still had a stored <code>id</code>, so the scanner fired a no-op <code>beginDelete</code> first and only discovered the resource was gone on the following cycle. The helper now always performs the pre-flight <code>GET</code>, so a missing resource is marked deleted immediately and the reap chain continues in a single cycle, shortening the <code>STOPPING</code> tail for affected Azure pools.</p>
<p>▶ [patch]
The default <code>sendDeadline</code> for the pulse publisher has been raised from 12 seconds to 30 seconds. Under load, RabbitMQ blocking and client reconnects could consume most of the 12-second budget before a single publish-confirm round-trip completed, causing cascading <code>PulsePublisher.sendDeadline exceeded</code> errors. The new default gives more headroom while still remaining below typical HTTP proxy timeouts. Services can override this per-publisher via the <code>sendDeadline</code> option to <code>exchanges.publisher()</code>.</p>
<p>▶ [patch] <a href="http://bugzil.la/2028956">bug 2028956</a>
Worker Manager's Azure registration flow now restricts intermediate certificate downloads to trusted certificate distribution endpoints and records rejected certificate URLs in service logs.</p>
<h3>WORKER-DEPLOYERS</h3>
<p>▶ [patch] <a href="http://bugzil.la/2032277">bug 2032277</a>
worker-runner now tightens the permissions of its configuration file (typically <code>runner.yml</code> / <code>worker-runner.json</code>) to be readable only by its owner before reading it, and logs a warning if the file was previously group- or world-readable. This closes an exposure where a task running on a worker using the <code>static</code> provider could read the <code>staticSecret</code> out of a loosely-permissioned runner config and impersonate the worker via <code>registerWorker</code>. Worker deployers using the static provider should update their provisioning so the runner config is created with mode <code>0600</code> (or the equivalent owner-only ACL on Windows) from the start.</p>
<h3>USERS</h3>
<p>▶ [patch] <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8534">#8534</a>
Fix a 500 raised from hooks.triggerHook when a hook's task template evaluates
to nothing. The endpoint now correctly replies with an empty object in that
case.</p>
<p>▶ [patch] <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8529">#8529</a>
Fix a bug in <code>queue.createTask</code> where idempotent retries could insert multiple
rows into the <code>queue_task_deadlines</code> table for a single task. Once those
duplicates became visible, several deadline-resolver instances could pick up
the same task concurrently, the first cancelled it, and the others crashed
because they assumed they were the only one working on the cancellation of said
task. A new unique constraint on <code>task_id</code> now prevents duplicate deadline
rows, and the migration deduplicates any existing stale rows.</p>
<h3>OTHER</h3>
<p>▶ Additional changes not described here: <a href="https://redirect.github.com/taskcluster/taskcluster/issues/3684">#3684</a>, <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8540">#8540</a>.</p>
<h3>Automated Package Updates</h3>
<!-- raw HTML omitted -->
<ul>
<li>build(deps): bump postcss from 8.5.6 to 8.5.10 (97fbba720e)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taskcluster/taskcluster/blob/main/CHANGELOG.md">taskcluster's changelog</a>.</em></p>
<blockquote>
<h2>v99.2.0</h2>
<h3>DEPLOYERS</h3>
<p>▶ [minor] <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8243">#8243</a>
Add optional <a href="https://gateway-api.sigs.k8s.io/">Kubernetes Gateway API</a> support (<code>Gateway</code>, <code>HTTPRoute</code>, <code>HealthCheckPolicy</code>) as an alternative to the existing <code>Ingress</code> resource. These new resources are only rendered when <code>ingressType: gateway</code> is set in Helm values, so existing Ingress-based deployments are unaffected and no new CRDs or <code>skipResourceTypes</code> entries are required.</p>
<p>To adopt Gateway API for traffic routing, set <code>ingressType: gateway</code> along with <code>gatewayClassName</code>, and for GKE regional external ALBs, <code>gatewayStaticIpName</code> and <code>gcpManagedCertName</code>. Both <code>Ingress</code> and Gateway API resources will be rendered side-by-side, letting you migrate at your own pace; add <code>ingress</code> to <code>skipResourceTypes</code> once the Gateway setup is validated to stop rendering the legacy Ingress.</p>
<p>See the <a href="https://github.com/taskcluster/taskcluster/blob/main/dev-docs/dev-deployment.md#gateway-api">Gateway API section of the dev deployment docs</a> for setup instructions.</p>
<p>▶ [patch] <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8526">#8526</a>
Fixed the Azure provider's <code>deprovisionResource</code> wasting a worker-scanner cycle per resource when the backing VM/NIC/IP/disk had already been removed out-of-band (e.g. ARM cascade-delete via <code>deleteOption: 'Delete'</code>, Spot preemption). Previously the pre-flight <code>GET</code> was skipped whenever the worker still had a stored <code>id</code>, so the scanner fired a no-op <code>beginDelete</code> first and only discovered the resource was gone on the following cycle. The helper now always performs the pre-flight <code>GET</code>, so a missing resource is marked deleted immediately and the reap chain continues in a single cycle, shortening the <code>STOPPING</code> tail for affected Azure pools.</p>
<p>▶ [patch]
The default <code>sendDeadline</code> for the pulse publisher has been raised from 12 seconds to 30 seconds. Under load, RabbitMQ blocking and client reconnects could consume most of the 12-second budget before a single publish-confirm round-trip completed, causing cascading <code>PulsePublisher.sendDeadline exceeded</code> errors. The new default gives more headroom while still remaining below typical HTTP proxy timeouts. Services can override this per-publisher via the <code>sendDeadline</code> option to <code>exchanges.publisher()</code>.</p>
<p>▶ [patch] <a href="http://bugzil.la/2028956">bug 2028956</a>
Worker Manager's Azure registration flow now restricts intermediate certificate downloads to trusted certificate distribution endpoints and records rejected certificate URLs in service logs.</p>
<h3>WORKER-DEPLOYERS</h3>
<p>▶ [patch] <a href="http://bugzil.la/2032277">bug 2032277</a>
worker-runner now tightens the permissions of its configuration file (typically <code>runner.yml</code> / <code>worker-runner.json</code>) to be readable only by its owner before reading it, and logs a warning if the file was previously group- or world-readable. This closes an exposure where a task running on a worker using the <code>static</code> provider could read the <code>staticSecret</code> out of a loosely-permissioned runner config and impersonate the worker via <code>registerWorker</code>. Worker deployers using the static provider should update their provisioning so the runner config is created with mode <code>0600</code> (or the equivalent owner-only ACL on Windows) from the start.</p>
<h3>USERS</h3>
<p>▶ [patch] <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8534">#8534</a>
Fix a 500 raised from hooks.triggerHook when a hook's task template evaluates
to nothing. The endpoint now correctly replies with an empty object in that
case.</p>
<p>▶ [patch] <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8529">#8529</a>
Fix a bug in <code>queue.createTask</code> where idempotent retries could insert multiple
rows into the <code>queue_task_deadlines</code> table for a single task. Once those
duplicates became visible, several deadline-resolver instances could pick up
the same task concurrently, the first cancelled it, and the others crashed
because they assumed they were the only one working on the cancellation of said
task. A new unique constraint on <code>task_id</code> now prevents duplicate deadline
rows, and the migration deduplicates any existing stale rows.</p>
<h3>OTHER</h3>
<p>▶ Additional changes not described here: <a href="https://redirect.github.com/taskcluster/taskcluster/issues/3684">#3684</a>, <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8540">#8540</a>.</p>
<h3>Automated Package Updates</h3>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taskcluster/taskcluster/commit/bc2efe2827821902a59f229b3700d31a3bbf30d3"><code>bc2efe2</code></a> v99.2.0</li>
<li><a href="https://github.com/taskcluster/taskcluster/commit/5d4848c34ad59d6215fc3d37801143ac39f7680f"><code>5d4848c</code></a> Merge pull request <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8541">#8541</a> from Kelpy2004/codex/fix-worker-manager-doc-links</li>
<li><a href="https://github.com/taskcluster/taskcluster/commit/920cfd042e19b2101a7385681de3dfd2daf72772"><code>920cfd0</code></a> Add changelog entry for issue 8540</li>
<li><a href="https://github.com/taskcluster/taskcluster/commit/a8166c82a359de28e8ec12bb6b50f946becf90d6"><code>a8166c8</code></a> Fix worker-manager provider doc links</li>
<li><a href="https://github.com/taskcluster/taskcluster/commit/4f09a7e0773b59b5f0bdbe1f46682169c4691374"><code>4f09a7e</code></a> Merge pull request <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8539">#8539</a> from taskcluster/dependabot/npm_and_yarn/postcss-8.5.10</li>
<li><a href="https://github.com/taskcluster/taskcluster/commit/97fbba720e2e8838b6f06473fc7d8e78700d26f2"><code>97fbba7</code></a> build(deps): bump postcss from 8.5.6 to 8.5.10</li>
<li><a href="https://github.com/taskcluster/taskcluster/commit/34b5d3d6995243f90b6686fc7360428c36858c5c"><code>34b5d3d</code></a> Merge pull request <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8538">#8538</a> from taskcluster/dependabot/cargo/clients/client-rus...</li>
<li><a href="https://github.com/taskcluster/taskcluster/commit/ae9c06296eb4b0b1d05e7149497bdfea36ce8940"><code>ae9c062</code></a> build(deps): bump rustls-webpki in /clients/client-rust</li>
<li><a href="https://github.com/taskcluster/taskcluster/commit/e1ecd49f7c2e1c4055f524d0ed90f810e284dd79"><code>e1ecd49</code></a> Merge pull request <a href="https://redirect.github.com/taskcluster/taskcluster/issues/8535">#8535</a> from Eijebong/fix-deadline-uniqueness</li>
<li><a href="https://github.com/taskcluster/taskcluster/commit/f43d17b4b5af6caa7375b0b7f5e08efac75384dd"><code>f43d17b</code></a> Catch cancellation no-ops early in the deadline resolver</li>
<li>Additional commits viewable in <a href="https://github.com/taskcluster/taskcluster/compare/v99.1.0...v99.2.0">compare view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>

You need to log in before you can comment on or make changes to this bug.