build(deps): bump taskcluster from 103.0.1 to 106.0.0 in /backend

[dependabot]

Bumps taskcluster from 103.0.1 to 106.0.0.

Release notes

Sourced from taskcluster's releases.

v106.0.0

USERS

▶ [MAJOR] bug 2064901 Github hooks triggered from .taskcluster.yml now require the github:trigger-hook:<name> scope instead of hooks:trigger-hook:<name>.

▶ [minor] #8378 The auth service can now hand out repository scoped tokens through /api/auth/v1/github/<app>/<owner>/repo-token. See the route documentation for more information.

▶ [patch] bug 2062167 Fixed a bug where multiple interactive sessions on a worker with capacity greater than 1 would override eachother's secrets.

DEVELOPERS

▶ [patch] Upgrade json-e to 4.8.4.

v105.1.0

GENERAL

▶ [patch] Upgrades to Node.js v24.19.0.

▶ [patch] Upgrades to go1.26.6.

Release notes here.

WORKER-DEPLOYERS

▶ [patch] #9008 Generic worker now purges a task's writable directory caches when the worker kills the task's commands (cancellation, max runtime, OOM), instead of keeping a potentially corrupt cache

USERS

▶ [minor] bug 2064373 Slack notifications no longer show link previews by default. You can re-enable that through the unfurlLinks / unfurlMedia fields on the slack API endpoint or with task.extra.notify.slackUnfurlLinks / slackUnfurlMedia for route based notifications.

▶ [patch] Properly report errors from d2g when a docker image has an invalid name rather than letting docker fail on it and reporting those errors.

... (truncated)

Changelog

Sourced from taskcluster's changelog.

v106.0.0

USERS

▶ [MAJOR] bug 2064901 Github hooks triggered from .taskcluster.yml now require the github:trigger-hook:<name> scope instead of hooks:trigger-hook:<name>.

▶ [minor] #8378 The auth service can now hand out repository scoped tokens through /api/auth/v1/github/<app>/<owner>/repo-token. See the route documentation for more information.

▶ [patch] bug 2062167 Fixed a bug where multiple interactive sessions on a worker with capacity greater than 1 would override eachother's secrets.

DEVELOPERS

▶ [patch] Upgrade json-e to 4.8.4.

v105.1.0

GENERAL

▶ [patch] Upgrades to Node.js v24.19.0.

▶ [patch] Upgrades to go1.26.6.

Release notes here.

WORKER-DEPLOYERS

▶ [patch] #9008 Generic worker now purges a task's writable directory caches when the worker kills the task's commands (cancellation, max runtime, OOM), instead of keeping a potentially corrupt cache

USERS

▶ [minor] bug 2064373 Slack notifications no longer show link previews by default. You can re-enable that through the unfurlLinks / unfurlMedia fields on the slack API endpoint or with task.extra.notify.slackUnfurlLinks / slackUnfurlMedia for route based notifications.

▶ [patch] Properly report errors from d2g when a docker image has an invalid name rather

... (truncated)

Commits

• 124220f v106.0.0
• 87ef8b9 Merge pull request #9038 from taskcluster/worktree-json-e-bump-4.8.4
• 80e2fa0 build(deps): bump json-e from 4.8.2 to 4.8.4
• 6325d44 Merge pull request #9036 from taskcluster/chore/readme-security
• 78b2cc5 Merge pull request #9015 from Eijebong/github-auth-tokens
• 3d11193 Merge pull request #9034 from Eijebong/change-github-hooks-scope
• 8d76c2d Merge pull request #9035 from Eijebong/global-variables-are-bad
• 3030199 chore(docs): Improve readme wording for security reporting
• 3b361ab Bug 2062167 - Ensure each interactive session is authenticated against its ow...
• 72a51a7 Add user documentation for the github repo tokens route
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)