Bump the taskcluster-pip group across 1 directory with 5 updates

[dependabot]

Bumps the taskcluster-pip group with 5 updates in the /taskcluster directory:

Package	From	To
mozilla-taskgraph	4.4.0	5.0.0
taskcluster	101.1.0	103.0.1
taskcluster-taskgraph	24.2.0	24.2.3
yarl	1.24.2	1.24.5
sentry-cli	3.6.0	3.6.2

Updates mozilla-taskgraph from 4.4.0 to 5.0.0

Release notes

Sourced from mozilla-taskgraph's releases.

5.0.0

What's Changed

• feat: bug 2055645: add support for direct git tags in landoscript payloads (BREAKING CHANGE) by @​bhearsum in mozilla-releng/mozilla-taskgraph#238

Full Changelog: mozilla-releng/mozilla-taskgraph@4.4.0...5.0.0

Changelog

Sourced from mozilla-taskgraph's changelog.

5.0.0 (2026-07-24)

Changed

• tag actions in the scriptworker-lando payload builder now support git
  • BREAKING CHANGE: This work has necessitated the removal of the automatic look-up of it in parameters; it must now be present in the tag action information.
  • hg_repo_url is now optional

Commits

• 3e5fef6 Merge pull request #239 from bhearsum/chore-version-bump-5.0.0
• 84ee2a3 chore: version bump 5.0.0
• 68fa56f Merge pull request #238 from bhearsum/feat-bug-2055645-add-support-f
• 7c0a745 feat: bug 2055645: add support for direct git tags in landoscript payloads (B...
• See full diff in compare view

Updates taskcluster from 101.1.0 to 103.0.1

Release notes

Sourced from taskcluster's releases.

v103.0.1

WORKER-DEPLOYERS

▶ [patch] Generic worker now continues trying to garbage collect caches even if one removal fails for any reason

USERS

▶ [patch] #8942 Fix workers panicking if a task that's not resolved yet would exhaust enough disk space for the worker to not meet their minimum disk space required to claim new tasks.

▶ [patch] Generic worker will try evicting writable cache directories again when garbage collecting. This was regressed in v100.0.0

▶ [patch] Workers will now reliably clean task directories / users again. The cleanup behavior was regressed in v100.0.0

v103.0.0

DEPLOYERS

▶ [minor] The Helm chart now supports annotations on Taskcluster workload pods. Use the global podAnnotations map for every Deployment and CronJob pod. A service process's podAnnotations map is merged with the global map for that workload, with process values taking precedence for matching keys.

▶ [patch] Fixed a potential panic in websocktunnel when a worker sent a malformed ACK

▶ [patch] Websocktunnel will now close sessions when a client sends an invalid packet instead of silently ignoring it

ADMINS

▶ [patch] bug 2057491 Fixed a bug in the auth service's scope resolver where the scopes :*, ::*, :a*, :as*, :ass*, :assu*, :assum* and :assume* were expanded as if they were *

USERS

▶ [MAJOR] #8869 The client-rust AsyncWriterFactory now needs to be Send and the get_writer method now takes an optional content_length parameter that indicates what size the writer should expect. The get_writer method is also now only called when the initial request succeeded and the response stream is about to be pulled.

▶ [patch] #7590 Add UI to view audit history for client, roles, hooks, secrets

▶ [patch]

... (truncated)

Changelog

Sourced from taskcluster's changelog.

v103.0.1

WORKER-DEPLOYERS

▶ [patch] Generic worker now continues trying to garbage collect caches even if one removal fails for any reason

USERS

▶ [patch] #8942 Fix workers panicking if a task that's not resolved yet would exhaust enough disk space for the worker to not meet their minimum disk space required to claim new tasks.

▶ [patch] Generic worker will try evicting writable cache directories again when garbage collecting. This was regressed in v100.0.0

▶ [patch] Workers will now reliably clean task directories / users again. The cleanup behavior was regressed in v100.0.0

v103.0.0

DEPLOYERS

▶ [minor] The Helm chart now supports annotations on Taskcluster workload pods. Use the global podAnnotations map for every Deployment and CronJob pod. A service process's podAnnotations map is merged with the global map for that workload, with process values taking precedence for matching keys.

▶ [patch] Fixed a potential panic in websocktunnel when a worker sent a malformed ACK

▶ [patch] Websocktunnel will now close sessions when a client sends an invalid packet instead of silently ignoring it

ADMINS

▶ [patch] bug 2057491 Fixed a bug in the auth service's scope resolver where the scopes :*, ::*, :a*, :as*, :ass*, :assu*, :assum* and :assume* were expanded as if they were *

USERS

▶ [MAJOR] #8869 The client-rust AsyncWriterFactory now needs to be Send and the get_writer method now takes an optional content_length parameter that indicates what size the writer should expect. The get_writer method is also now only called when the initial request succeeded and the response stream is about to be pulled.

▶ [patch] #7590 Add UI to view audit history for client, roles, hooks, secrets

... (truncated)

Commits

• 85c75bc v103.0.1
• 79e8100 Merge pull request #8946 from Eijebong/fix-caches
• 6c980e3 Only remove a file cache entry if it is still the one we evicted
• 4c9d9d7 Take the cache lock when evicting file caches during garbage collection
• 84f1d63 Don't give up garbage collecting when one eviction fails
• 134c50e Let the garbage collector reach writable directory caches
• df57906 Purge task directories when a completion is handled by the bottom loop select
• b7c75cc Log when the main loop is waiting for a task to resolve
• 5d576d2 Don't log disk space in the getter for it
• 1e07e05 Don't panic when the GC can't free enough disk space while other tasks are ru...
• Additional commits viewable in compare view

Updates taskcluster-taskgraph from 24.2.0 to 24.2.3

Release notes

Sourced from taskcluster-taskgraph's releases.

24.2.3

What's Changed

• fix(deps): vendor latest robustcheckout by @​ahal in taskcluster/taskgraph#1012
• chore: version bump v24.2.3 by @​ahal in taskcluster/taskgraph#1013

Full Changelog: taskcluster/taskgraph@24.2.2...24.2.3

24.2.2

What's Changed

• fix: index cached tasks for PRs when tasks_for is github-pull-request by @​ahal in taskcluster/taskgraph#1009
• chore: version bump v24.2.2 by @​ahal in taskcluster/taskgraph#1011

Full Changelog: taskcluster/taskgraph@24.2.1...24.2.2

24.2.1

What's Changed

• fix: don't run nested ProcessPoolExecutors by @​bhearsum in taskcluster/taskgraph#1008

Full Changelog: taskcluster/taskgraph@24.2.0...24.2.1

Changelog

Sourced from taskcluster-taskgraph's changelog.

[24.2.3] - 2026-07-29

Fixed

• Vendor latest robustcheckout

[24.2.2] - 2026-07-28

Fixed

• Only write cached tasks to index for github-pull-request tasks_for

[24.2.1] - 2026-07-27

Fixed

• Don't run nested ProcessPoolExecutors (#1008)

Commits

• 305a07f chore: version bump v24.2.3
• 3a280ed fix(deps): vendor latest robustcheckout
• d7efa4b chore: version bump v24.2.2
• e54ccab fix: index cached tasks for PRs when tasks for is github-pull-request
• 30b7440 chore: version bump 24.2.1 (#1010)
• f303f38 fix: don't run nested ProcessPoolExecutors (#1008)
• See full diff in compare view

Updates yarl from 1.24.2 to 1.24.5

Changelog

Sourced from yarl's changelog.

v1.24.5

(2026-07-19)

Contributor-facing changes

• Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1806.

---

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

• Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1804.

---

v1.24.3

(2026-07-19)

... (truncated)

Commits

• 0b30cb0 Release 1.24.5 (#1807)
• 56150c8 Run the IDNA sweep test only on native Linux x86_64 (#1806)
• 515adca Release 1.24.4 (#1805)
• ab5dec2 Do not install hypothesis in the wheel-build test env (#1804)
• f9d10fb Release 1.24.3 (#1803)
• 058b7cb Test lone surrogate handling in encoded and parsed URL paths (#991)
• a181cee Update hypothesis requirement from >=6.156.4 to >=6.157.0 in /requirements (#...
• 28c1bcc Encode scheme-shaped path colon in relative-path builders (#1802)
• 51e2802 Reject hosts with Unicode default-ignorable code points (#1801)
• 3921a73 Drop lone surrogates that split a percent escape in the Cython quoter (#1752)
• Additional commits viewable in compare view

Updates sentry-cli from 3.6.0 to 3.6.2

Release notes

Sourced from sentry-cli's releases.

3.6.2

Fixes

• Do not combine a URL and non-embedded auth token from different configuration files. When configuration sources provide only one of these values, an existing value from another source may be ignored with a warning. Configure the URL and token in the same file or through CLI arguments and environment variables, which are treated as one runtime source. This change does not alter parent-config discovery or how other configuration keys are selected (#3378).

3.6.1

Fixes

• (sourcemaps) Prevent Debug ID collisions between distinct JS files that share identical sourcemaps by hashing both the JS and sourcemap bytes when injecting Debug IDs (#3356)

Changelog

Sourced from sentry-cli's changelog.

3.6.2

Fixes

• Do not combine a URL and non-embedded auth token from different configuration files. When configuration sources provide only one of these values, an existing value from another source may be ignored with a warning. Configure the URL and token in the same file or through CLI arguments and environment variables, which are treated as one runtime source. This change does not alter parent-config discovery or how other configuration keys are selected (#3378).

3.6.1

Fixes

• (sourcemaps) Prevent Debug ID collisions between distinct JS files that share identical sourcemaps by hashing both the JS and sourcemap bytes when injecting Debug IDs (#3356)

Commits

• 24cb9ea release: 3.6.2
• cf9235e fix: Ensure URL and Auth Token come from same source (#3378)
• 5378ef2 chore: Update packages to remove vulnerabilities (#3376)
• bcfdfa2 chore(deps-dev): bump tar from 7.5.16 to 7.5.20 (#3375)
• 8b2b4fa chore(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#3374)
• deb7ef2 build: Update crossbeam-epoch (#3373)
• e9ec88b build(npm): 🤖 Bump optional dependencies to 3.6.1
• 8eb1661 Merge branch 'release/3.6.1'
• b2d322a release: 3.6.1
• 308c9ad chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 (#3366)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
taskcluster	[>= 57.1.a, < 57.2]
taskcluster-taskgraph	[>= 8.a, < 9]