build(deps): bump taskcluster from 95.1.4 to 99.1.0 in /backend

[dependabot]

Bumps taskcluster from 95.1.4 to 99.1.0.

Release notes

Sourced from taskcluster's releases.

v99.1.0

GENERAL

▶ [patch] Upgrades to go1.26.2 [SECURITY].

DEPLOYERS

▶ [minor] #8502 A new Prometheus histogram metric iterate_duration_seconds is now emitted by all background iteration loops (provisioner, worker-scanner, queue resolvers, etc.) via lib-iterate.

The metric is registered as a global builtin, meaning it automatically propagates to whichever Prometheus registry a process exposes — no per-service configuration is required. It is a no-op in deployments without Prometheus configured.

▶ [minor] #8497 The worker-manager Azure provider now captures ARM throttling signals for observability. When Azure returns rate-limit headers (x-ms-ratelimit-remaining-subscription-reads, -writes, -deletes, x-ms-ratelimit-remaining-resource, Retry-After), the provider records them as Prometheus metrics and, on HTTP 429 responses, emits a structured azureThrottled warning log with the full header payload.

New Prometheus metrics:

• worker_manager_azure_throttle_total (counter) — incremented on every 429, labeled by providerId and operationType
• worker_manager_azure_ratelimit_remaining (gauge) — tracks the most recently observed remaining-quota value, labeled by providerId and limitType

The error handler in CloudAPI's enqueue path now respects Retry-After headers from Azure, using the server-specified delay (capped at 120 seconds) instead of the previous fixed backoff for 429 responses.

Rate-limit headers are observed on both Track 2 SDK calls (via a pipeline policy) and Track 1 REST polling calls (in handleOperation), covering all Azure API interactions made by the provider.

▶ [patch] #8470 The worker-manager scanner now guards against overlapping scan loops and adds a per-worker timeout to checkWorker calls. Previously, when a scan exceeded maxIterationTime (common with large Azure worker pools), lib-iterate would start a new iteration while the old one was still running, resetting shared state and causing crashes in provider checkWorker methods. The scanner now detects loop overlap to prevent silent state corruption, and times out individual checkWorker calls after 60 seconds so a single hung cloud API call cannot abort the entire scan.

USERS

▶ [minor] #8430 The GitHub service now supports triggering Taskcluster hooks directly from .taskcluster.yml. Add a hooks array to your config to trigger one or more hooks on push, pull request, or other events:

hooks:
  - name: taskgraph/decision
    context:
      project: myproject

Each hook is triggered via the hooks.triggerHook API with a payload

... (truncated)

Changelog

Sourced from taskcluster's changelog.

v99.1.0

GENERAL

▶ [patch] Upgrades to go1.26.2 [SECURITY].

DEPLOYERS

▶ [minor] #8502 A new Prometheus histogram metric iterate_duration_seconds is now emitted by all background iteration loops (provisioner, worker-scanner, queue resolvers, etc.) via lib-iterate.

The metric is registered as a global builtin, meaning it automatically propagates to whichever Prometheus registry a process exposes — no per-service configuration is required. It is a no-op in deployments without Prometheus configured.

▶ [minor] #8497 The worker-manager Azure provider now captures ARM throttling signals for observability. When Azure returns rate-limit headers (x-ms-ratelimit-remaining-subscription-reads, -writes, -deletes, x-ms-ratelimit-remaining-resource, Retry-After), the provider records them as Prometheus metrics and, on HTTP 429 responses, emits a structured azureThrottled warning log with the full header payload.

New Prometheus metrics:

• worker_manager_azure_throttle_total (counter) — incremented on every 429, labeled by providerId and operationType
• worker_manager_azure_ratelimit_remaining (gauge) — tracks the most recently observed remaining-quota value, labeled by providerId and limitType

The error handler in CloudAPI's enqueue path now respects Retry-After headers from Azure, using the server-specified delay (capped at 120 seconds) instead of the previous fixed backoff for 429 responses.

Rate-limit headers are observed on both Track 2 SDK calls (via a pipeline policy) and Track 1 REST polling calls (in handleOperation), covering all Azure API interactions made by the provider.

▶ [patch] #8470 The worker-manager scanner now guards against overlapping scan loops and adds a per-worker timeout to checkWorker calls. Previously, when a scan exceeded maxIterationTime (common with large Azure worker pools), lib-iterate would start a new iteration while the old one was still running, resetting shared state and causing crashes in provider checkWorker methods. The scanner now detects loop overlap to prevent silent state corruption, and times out individual checkWorker calls after 60 seconds so a single hung cloud API call cannot abort the entire scan.

USERS

▶ [minor] #8430 The GitHub service now supports triggering Taskcluster hooks directly from .taskcluster.yml. Add a hooks array to your config to trigger one or more hooks on push, pull request, or other events:

hooks:
  - name: taskgraph/decision
    context:
      project: myproject

... (truncated)

Commits

• c76d61e v99.1.0
• c33c92c Merge pull request #8504 from taskcluster/feat/8497-azure-throttling
• 2cffa18 Apply fixes after review
• bd2eb3e Merge pull request #8481 from taskcluster/auto/fix/sentry-browser-10.47.0
• 1d20a6b Merge pull request #8435 from taskcluster/auto/fix/sentry-node-10.27.0
• 767b591 Merge branch 'main' into auto/fix/sentry-node-10.27.0
• dea4eb2 Merge pull request #8467 from nitishagar/fix/7838-broken-doc-links
• 08fb60a Merge pull request #8469 from taskcluster/dependabot/npm_and_yarn/nodemailer-...
• 740b04e feat(w-m): Track Azure rate limiting errors
• 4e1ab6e Fix broken links in documentation
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)