Bump the taskcluster-pip group across 1 directory with 5 updates

[dependabot]

Bumps the taskcluster-pip group with 5 updates in the /taskcluster directory:

Package	From	To
mozilla-taskgraph	4.4.0	5.0.0
taskcluster	101.1.0	102.0.1
taskcluster-taskgraph	24.2.0	24.2.3
yarl	1.24.2	1.24.5
sentry-cli	3.6.0	3.6.2

Updates mozilla-taskgraph from 4.4.0 to 5.0.0

Release notes

Sourced from mozilla-taskgraph's releases.

5.0.0

What's Changed

• feat: bug 2055645: add support for direct git tags in landoscript payloads (BREAKING CHANGE) by @​bhearsum in mozilla-releng/mozilla-taskgraph#238

Full Changelog: mozilla-releng/mozilla-taskgraph@4.4.0...5.0.0

Changelog

Sourced from mozilla-taskgraph's changelog.

5.0.0 (2026-07-24)

Changed

• tag actions in the scriptworker-lando payload builder now support git
  • BREAKING CHANGE: This work has necessitated the removal of the automatic look-up of it in parameters; it must now be present in the tag action information.
  • hg_repo_url is now optional

Commits

• 3e5fef6 Merge pull request #239 from bhearsum/chore-version-bump-5.0.0
• 84ee2a3 chore: version bump 5.0.0
• 68fa56f Merge pull request #238 from bhearsum/feat-bug-2055645-add-support-f
• 7c0a745 feat: bug 2055645: add support for direct git tags in landoscript payloads (B...
• See full diff in compare view

Updates taskcluster from 101.1.0 to 102.0.1

Release notes

Sourced from taskcluster's releases.

v102.0.1

WORKER-DEPLOYERS

▶ [patch] #8890 Generic Worker FreeBSD build has been fixed.

Automated Package Updates

• build(deps): bump brace-expansion from 1.1.13 to 1.1.16 (1134030fb9)
• build(deps): bump brace-expansion from 2.1.0 to 2.1.2 in /clients/client (b15dd41687)
• build(deps): bump brace-expansion from 1.1.13 to 1.1.16 in /ui (1d5a64cdc6)
• build(deps): bump axios from 1.16.0 to 1.18.1 (9953989868)

Changelog

Sourced from taskcluster's changelog.

v102.0.1

WORKER-DEPLOYERS

▶ [patch] #8890 Generic Worker FreeBSD build has been fixed.

Automated Package Updates

• build(deps): bump brace-expansion from 1.1.13 to 1.1.16 (1134030fb9)
• build(deps): bump brace-expansion from 2.1.0 to 2.1.2 in /clients/client (b15dd41687)
• build(deps): bump brace-expansion from 1.1.13 to 1.1.16 in /ui (1d5a64cdc6)
• build(deps): bump axios from 1.16.0 to 1.18.1 (9953989868)

v102.0.0

GENERAL

▶ [minor] #8855 The task view now has a "Change Priority" action to change a task's priority directly from the UI.

WORKER-DEPLOYERS

▶ [patch] #8859 generic-worker (multiuser engine, macOS) now determines that the task user is ready by running id -un through the task user's launch agent and checking it reports the expected user, instead of parsing last -t console output. Because the probe only succeeds once the user's Aqua session is up and its launch agent is serving, the worker no longer claims a task before it can actually run commands as the task user (which resolved as exception/internal-error, e.g. when a boot-time macOS installer held the login window). This also removes the fragile last output parsing (issue 5006).

USERS

▶ [MAJOR] #8858 The task priority normal is no longer accepted. createTask, changeTaskPriority, and changeTaskGroupPriority now reject it with a 400 InputError, rather than silently aliasing it to lowest (as createTask did) or, in the case of changeTaskPriority specifically, causing an internal error.

normal was marked deprecated in the queue API in 2017, when it was superseded by the current highest-to-lowest scale, but that deprecation notice was inadvertently dropped from the schema again in 2018 -- so it has looked like a supported value ever since, even though it was already being aliased to lowest under the hood. If any task definitions (e.g. in .taskcluster.yml files) still specify priority: normal, update them to lowest (or another priority from the standard scale) before upgrading.

▶ [patch] bug 2055467 D2G scope validation now handles the legacy disableSeccomp capability consistently with docker worker.

▶ [patch] Fetching a github status badge for a repository/branch that doesn't exist will

... (truncated)

Commits

• 7074578 v102.0.1
• 71557fc Merge pull request #8891 from taskcluster/chore/security-notes
• 7072e7a Merge pull request #8893 from taskcluster/issue8890
• 9f20fb7 Issue 8890: test FreeBSD of Generic Worker in CI and fix build
• 8d27e55 chore(security): Update SECURITY guidelines to reflect current Mozilla direct...
• 711363f Merge pull request #8888 from taskcluster/dependabot/npm_and_yarn/brace-expan...
• 04d5a1d Merge pull request #8887 from taskcluster/dependabot/npm_and_yarn/clients/cli...
• 1134030 build(deps): bump brace-expansion from 1.1.13 to 1.1.16
• b15dd41 build(deps): bump brace-expansion from 2.1.0 to 2.1.2 in /clients/client
• 30283f7 Merge pull request #8886 from taskcluster/dependabot/npm_and_yarn/ui/brace-ex...
• Additional commits viewable in compare view

Updates taskcluster-taskgraph from 24.2.0 to 24.2.3

Release notes

Sourced from taskcluster-taskgraph's releases.

24.2.3

What's Changed

• fix(deps): vendor latest robustcheckout by @​ahal in taskcluster/taskgraph#1012
• chore: version bump v24.2.3 by @​ahal in taskcluster/taskgraph#1013

Full Changelog: taskcluster/taskgraph@24.2.2...24.2.3

24.2.2

What's Changed

• fix: index cached tasks for PRs when tasks_for is github-pull-request by @​ahal in taskcluster/taskgraph#1009
• chore: version bump v24.2.2 by @​ahal in taskcluster/taskgraph#1011

Full Changelog: taskcluster/taskgraph@24.2.1...24.2.2

24.2.1

What's Changed

• fix: don't run nested ProcessPoolExecutors by @​bhearsum in taskcluster/taskgraph#1008

Full Changelog: taskcluster/taskgraph@24.2.0...24.2.1

Changelog

Sourced from taskcluster-taskgraph's changelog.

[24.2.3] - 2026-07-29

Fixed

• Vendor latest robustcheckout

[24.2.2] - 2026-07-28

Fixed

• Only write cached tasks to index for github-pull-request tasks_for

[24.2.1] - 2026-07-27

Fixed

• Don't run nested ProcessPoolExecutors (#1008)

Commits

• 305a07f chore: version bump v24.2.3
• 3a280ed fix(deps): vendor latest robustcheckout
• d7efa4b chore: version bump v24.2.2
• e54ccab fix: index cached tasks for PRs when tasks for is github-pull-request
• 30b7440 chore: version bump 24.2.1 (#1010)
• f303f38 fix: don't run nested ProcessPoolExecutors (#1008)
• See full diff in compare view

Updates yarl from 1.24.2 to 1.24.5

Changelog

Sourced from yarl's changelog.

v1.24.5

(2026-07-19)

Contributor-facing changes

• Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1806.

---

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

• Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1804.

---

v1.24.3

(2026-07-19)

... (truncated)

Commits

• 0b30cb0 Release 1.24.5 (#1807)
• 56150c8 Run the IDNA sweep test only on native Linux x86_64 (#1806)
• 515adca Release 1.24.4 (#1805)
• ab5dec2 Do not install hypothesis in the wheel-build test env (#1804)
• f9d10fb Release 1.24.3 (#1803)
• 058b7cb Test lone surrogate handling in encoded and parsed URL paths (#991)
• a181cee Update hypothesis requirement from >=6.156.4 to >=6.157.0 in /requirements (#...
• 28c1bcc Encode scheme-shaped path colon in relative-path builders (#1802)
• 51e2802 Reject hosts with Unicode default-ignorable code points (#1801)
• 3921a73 Drop lone surrogates that split a percent escape in the Cython quoter (#1752)
• Additional commits viewable in compare view

Updates sentry-cli from 3.6.0 to 3.6.2

Release notes

Sourced from sentry-cli's releases.

3.6.2

Fixes

• Do not combine a URL and non-embedded auth token from different configuration files. When configuration sources provide only one of these values, an existing value from another source may be ignored with a warning. Configure the URL and token in the same file or through CLI arguments and environment variables, which are treated as one runtime source. This change does not alter parent-config discovery or how other configuration keys are selected (#3378).

3.6.1

Fixes

• (sourcemaps) Prevent Debug ID collisions between distinct JS files that share identical sourcemaps by hashing both the JS and sourcemap bytes when injecting Debug IDs (#3356)

Changelog

Sourced from sentry-cli's changelog.

3.6.2

Fixes

• Do not combine a URL and non-embedded auth token from different configuration files. When configuration sources provide only one of these values, an existing value from another source may be ignored with a warning. Configure the URL and token in the same file or through CLI arguments and environment variables, which are treated as one runtime source. This change does not alter parent-config discovery or how other configuration keys are selected (#3378).

3.6.1

Fixes

• (sourcemaps) Prevent Debug ID collisions between distinct JS files that share identical sourcemaps by hashing both the JS and sourcemap bytes when injecting Debug IDs (#3356)

Commits

• 24cb9ea release: 3.6.2
• cf9235e fix: Ensure URL and Auth Token come from same source (#3378)
• 5378ef2 chore: Update packages to remove vulnerabilities (#3376)
• bcfdfa2 chore(deps-dev): bump tar from 7.5.16 to 7.5.20 (#3375)
• 8b2b4fa chore(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#3374)
• deb7ef2 build: Update crossbeam-epoch (#3373)
• e9ec88b build(npm): 🤖 Bump optional dependencies to 3.6.1
• 8eb1661 Merge branch 'release/3.6.1'
• b2d322a release: 3.6.1
• 308c9ad chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 (#3366)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
taskcluster	[>= 57.1.a, < 57.2]
taskcluster-taskgraph	[>= 8.a, < 9]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions