taskcluster-taskgraph 24.4.0__tar.gz → 24.4.1__tar.gz

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Change Log
 
+## [24.4.1] - 2026-10-08
+
+### Fixed
+
+- `github-issue-comment` tasks now use the PR cache namespaces
+- perf: look up kind dependency tasks by kind in the generator (#1054)
+- perf: extract tar archives while they download in `fetch-content` (#1068)
+- perf: let tar decompress zstd archives in `fetch-content` (#1068)
+- perf: read downloads in 1MiB chunks in `fetch-content` (#1068)
+- perf: resolve each dependent's deadline only once in `optimize` (#1056)
+
 ## [24.4.0] - 2026-10-05
 
 ### Added
@@ -11,6 +22,7 @@
 ### Changed
 
 - `taskgraph init` template and tutorial docs now default to the `public_restricted` PR policy
+- BREAKING CHANGE: `run-task` requires Python 3.8
 
 ### Fixed
 

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: taskcluster-taskgraph
-Version: 24.4.0
+Version: 24.4.1
 Summary: Build taskcluster taskgraphs
 Project-URL: Repository, https://github.com/taskcluster/taskgraph
 Project-URL: Issues, https://github.com/taskcluster/taskgraph/issues

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/docs/howto/use-fetches.rst

@@ -105,3 +105,16 @@ There are a few differences from the earlier ``build`` examples here:
 
    It is not possible to configure the ``dest`` or ``extract`` values when using
    ``fetch`` or ``toolchain`` kinds.
+
+Tuning Download Performance
+---------------------------
+
+The following environment variable tunes how ``fetch-content`` downloads
+artifacts.
+
+``TASKGRAPH_FETCH_STREAM``
+   Tar archives that are extracted are extracted while they download, rather
+   than written to disk and read back, into a staging directory that is only
+   merged into place once the download is complete and verified. This is on
+   by default; set to ``0`` to download to a file first. Zip archives, and
+   fetches that aren't extracted, always go through a file.

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/pyproject.toml

@@ -1,7 +1,7 @@
 ### Project
 [project]
 name = "taskcluster-taskgraph"
-version = "24.4.0"
+version = "24.4.1"
 description = "Build taskcluster taskgraphs"
 readme = "README.rst"
 authors = [
@@ -52,6 +52,7 @@ dev = [
   "sphinx-book-theme >=1.1.4",
   "sphinx-taskgraph>=0.1.0",
   "sphinxcontrib-mermaid>=1.0.0",
+  "vermin>=1.8.0",
   "zstandard>=0.25.0",
 ]
 

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/generator.py

@@ -282,8 +282,21 @@ class TaskGraphGenerator:
                 except KindNotFound:
                     continue
 
+    @staticmethod
+    def _get_kind_dependencies_tasks(kind, tasks_by_kind):
+        """Return the tasks of the kinds `kind` depends on, in the order in
+        which they were loaded."""
+        kind_dependencies = kind.config.get("kind-dependencies", [])
+        return {
+            label: task
+            for kind_name, tasks in tasks_by_kind.items()
+            if kind_name in kind_dependencies
+            for label, task in tasks.items()
+        }
+
     def _load_tasks_serial(self, kinds, kind_graph, parameters):
         all_tasks = {}
+        tasks_by_kind = {}
         for kind_name in kind_graph.visit_postorder():
             logger.debug(f"Loading tasks for kind {kind_name}")
 
@@ -297,11 +310,7 @@ class TaskGraphGenerator:
             try:
                 new_tasks = kind.load_tasks(
                     parameters,
-                    {
-                        k: t
-                        for k, t in all_tasks.items()
-                        if t.kind in kind.config.get("kind-dependencies", [])
-                    },
+                    self._get_kind_dependencies_tasks(kind, tasks_by_kind),
                     self._write_artifacts,
                 )
             except SchemaValidationError as exc:
@@ -310,15 +319,18 @@ class TaskGraphGenerator:
             except Exception:
                 logger.exception(f"Error loading tasks for kind {kind_name}:")
                 raise
+            kind_tasks = tasks_by_kind.setdefault(kind_name, {})
             for task in new_tasks:
                 if task.label in all_tasks:
                     raise Exception("duplicate tasks with label " + task.label)
                 all_tasks[task.label] = task
+                kind_tasks[task.label] = task
 
         return all_tasks
 
     def _load_tasks_parallel(self, kinds, kind_graph, parameters, executor):
         all_tasks = {}
+        tasks_by_kind = {}
         futures_to_kind = {}
         futures = set()
         edges = set(kind_graph.edges)
@@ -328,7 +340,6 @@ class TaskGraphGenerator:
             def submit_ready_kinds():
                 """Create the next batch of tasks for kinds without dependencies."""
                 nonlocal kinds, edges, futures
-                loaded_tasks = all_tasks.copy()
                 kinds_with_deps = {edge[0] for edge in edges}
                 ready_kinds = (
                     set(kinds) - kinds_with_deps - set(futures_to_kind.values())
@@ -346,11 +357,7 @@ class TaskGraphGenerator:
                     future = executor.submit(
                         kind.load_tasks,
                         dict(parameters),
-                        {
-                            k: t
-                            for k, t in loaded_tasks.items()
-                            if t.kind in kind.config.get("kind-dependencies", [])
-                        },
+                        self._get_kind_dependencies_tasks(kind, tasks_by_kind),
                         self._write_artifacts,
                     )
                     futures.add(future)
@@ -376,10 +383,12 @@ class TaskGraphGenerator:
                     kind = futures_to_kind.pop(future)
                     futures.remove(future)
 
+                    kind_tasks = tasks_by_kind.setdefault(kind, {})
                     for task in future.result():
                         if task.label in all_tasks:
                             raise Exception("duplicate tasks with label " + task.label)
                         all_tasks[task.label] = task
+                        kind_tasks[task.label] = task
 
                     # Update state for next batch of futures.
                     del kinds[kind]

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/optimize/base.py

@@ -301,6 +301,18 @@ def replace_tasks(
         target_task_graph.graph.links_and_reverse_links_dict()
     )
 
+    # Many tasks share dependents (e.g. docker images or toolchains), so
+    # resolve the deadline of each dependent only once.
+    now = datetime.datetime.now(datetime.timezone.utc)
+    deadlines = {}
+
+    def get_deadline(label):
+        if label not in deadlines:
+            deadlines[label] = resolve_timestamps(
+                now, target_task_graph.tasks[label].task["deadline"]
+            )
+        return deadlines[label]
+
     for label in target_task_graph.graph.visit_postorder():
         logger.debug(f"replace_tasks: {label}")
         # if we're not allowed to optimize, that's easy..
@@ -331,14 +343,9 @@ def replace_tasks(
         opt_by, opt, arg = optimizations(label)
 
         # compute latest deadline of dependents (if any)
-        dependents = [target_task_graph.tasks[l] for l in dependents_of[label]]
         deadline = None
-        if dependents:
-            now = datetime.datetime.now(datetime.timezone.utc)
-            deadline = max(
-                resolve_timestamps(now, task.task["deadline"])
-                for task in dependents  # type: ignore
-            )
+        if dependents_of[label]:
+            deadline = max(get_deadline(l) for l in dependents_of[label])
 
         if isinstance(opt, IndexSearch):
             arg = arg, index_to_taskid, taskid_to_status

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/optimize/strategies.py

@@ -1,3 +1,4 @@
+import functools
 import logging
 from datetime import datetime
 
@@ -10,6 +11,13 @@ from taskgraph.util.taskcluster import find_task_id, status_task
 logger = logging.getLogger("optimization")
 
 
+@functools.cache
+def _parse_time(timestamp, fmt):
+    # Many tasks share the same deadline or replacement task, so avoid parsing
+    # the same timestamps over and over.
+    return datetime.strptime(timestamp, fmt)
+
+
 @register_strategy("index-search")
 class IndexSearch(OptimizationStrategy):
     # A task with no dependencies remaining after optimization will be replaced
@@ -56,10 +64,10 @@ class IndexSearch(OptimizationStrategy):
                     )
                     continue
 
-                if deadline and datetime.strptime(
+                if deadline and _parse_time(
                     status["expires"],  # type: ignore
                     self.fmt,
-                ) < datetime.strptime(deadline, self.fmt):
+                ) < _parse_time(deadline, self.fmt):
                     logger.debug(
                         f"not replacing {task.label} with {task_id} because it expires before {deadline}"
                     )

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/run-task/fetch-content

@@ -8,9 +8,11 @@ import bz2
 import concurrent.futures
 import contextlib
 import datetime
+import functools
 import gzip
 import hashlib
 import io
+import itertools
 import json
 import lzma
 import multiprocessing
@@ -43,6 +45,12 @@ except ImportError:
 
 CONCURRENCY = multiprocessing.cpu_count()
 
+# Whether to extract tar archives while they download, rather than writing
+# them to disk and reading them back. TASKGRAPH_FETCH_STREAM=0 disables it.
+DEFAULT_STREAMING = True
+
+CHUNK_SIZE = 1024 * 1024
+
 
 def log(msg):
     print(msg, file=sys.stderr)
@@ -219,7 +227,7 @@ def stream_download(url, sha256=None, size=None, headers=None):
                     size = content_length
 
         while True:
-            chunk = fh.read(65536)
+            chunk = fh.read(CHUNK_SIZE)
             if not chunk:
                 break
 
@@ -248,6 +256,13 @@ def stream_download(url, sha256=None, size=None, headers=None):
             )
 
 
+def streaming_enabled():
+    value = os.environ.get("TASKGRAPH_FETCH_STREAM", "").strip().lower()
+    if not value:
+        return DEFAULT_STREAMING
+    return value in ("1", "true", "yes")
+
+
 def download_to_path(url, path, sha256=None, size=None, headers=None):
     """Download a URL to a filesystem path, possibly with verification."""
 
@@ -336,12 +351,19 @@ class ArchiveTypeNotSupported(Exception):
         super(Exception, self).__init__(f"Archive type not supported for {path}")
 
 
+ZSTD_MAGIC = b"\x28\xb5\x2f\xfd"
+
+
 def open_stream(path: pathlib.Path):
     """Attempt to identify a path as an extractable archive by looking at its
     content."""
-    fh = path.open(mode="rb")
-    magic = fh.read(6)
-    fh.seek(0)
+    return open_fileobj(path.open(mode="rb"), path)
+
+
+def open_fileobj(fh, name):
+    """Like ``open_stream``, for a buffered file object that may not be
+    seekable."""
+    magic = fh.peek(6)[:6]
     if magic[:2] == b"PK":
         return "zip", fh
     if magic[:2] == b"\x1f\x8b":
@@ -350,7 +372,7 @@ def open_stream(path: pathlib.Path):
         fh = bz2.BZ2File(fh)
     elif magic == b"\xfd7zXZ\x00":
         fh = lzma.LZMAFile(fh)
-    elif magic[:4] == b"\x28\xb5\x2f\xfd":
+    elif magic[:4] == ZSTD_MAGIC:
         fh = ZstdDecompressor().stream_reader(fh)
     fh = io.BufferedReader(fh)
     try:
@@ -365,7 +387,12 @@ def open_stream(path: pathlib.Path):
             return "tar", fh
     except Exception:
         pass
-    raise ArchiveTypeNotSupported(path)
+    raise ArchiveTypeNotSupported(name)
+
+
+def is_zstd(path: pathlib.Path):
+    with path.open(mode="rb") as fh:
+        return fh.read(4) == ZSTD_MAGIC
 
 
 def archive_type(path: pathlib.Path):
@@ -466,6 +493,13 @@ def extract_archive(path, dest_dir):
             tar = TarFile.open(fileobj=ifh, mode="r|")
             tar.extractall(str(dest_dir))
             args = []
+        elif is_zstd(path) and shutil.which("zstd"):
+            # Decompressing in a separate process keeps it from competing
+            # with concurrent downloads for the GIL.
+            ifh.close()
+            ifh = open(os.devnull, "rb")
+            args = ["tar", "--use-compress-program=zstd", "-xf", str(path)]
+            pipe_stdin = False
         else:
             args = ["tar", "xf", "-"]
             pipe_stdin = True
@@ -478,23 +512,211 @@ def extract_archive(path, dest_dir):
         raise ValueError(f"unknown archive format: {path}")
 
     if args:
-        with ifh, subprocess.Popen(
-            args, cwd=str(dest_dir), bufsize=0, stdin=subprocess.PIPE
-        ) as p:
-            while True:
-                if not pipe_stdin:
-                    break
+        with ifh:
+            chunks = iter(functools.partial(ifh.read, 131072), b"")
+            run_pipeline([args], dest_dir, chunks if pipe_stdin else ())
+
+    log(f"{path} extracted in {time.time() - t0:.3f}s")
 
-                chunk = ifh.read(131072)
-                if not chunk:
-                    break
 
-                p.stdin.write(chunk)
+def run_pipeline(commands, cwd, chunks):
+    """Run ``commands`` in ``cwd``, each reading the output of the previous
+    one, and the first reading ``chunks``."""
+    procs = []
+    stdin = subprocess.PIPE
+    for i, args in enumerate(commands):
+        last = i == len(commands) - 1
+        p = subprocess.Popen(
+            args,
+            cwd=str(cwd),
+            bufsize=0,
+            stdin=stdin,
+            stdout=None if last else subprocess.PIPE,
+        )
+        if procs:
+            # Only the next process holds the pipe, so that the previous one
+            # gets SIGPIPE if it exits.
+            procs[-1].stdout.close()
+        stdin = p.stdout
+        procs.append(p)
+
+    try:
+        for chunk in chunks:
+            procs[0].stdin.write(chunk)
+    except BrokenPipeError:
+        # A process exited early; its exit status says why.
+        pass
+    finally:
+        try:
+            procs[0].stdin.close()
+        except BrokenPipeError:
+            pass
+        for p in procs:
+            p.wait()
 
+    for args, p in zip(commands, procs):
         if p.returncode:
             raise Exception(f"{args!r} exited {p.returncode}")
 
-    log(f"{path} extracted in {time.time() - t0:.3f}s")
+
+class IterReader(io.RawIOBase):
+    """A file object reading from an iterator of chunks.
+
+    Until ``iter_from_start`` or ``forget`` is called, it keeps what it has
+    read, so that the start of a stream can be inspected and then handed on
+    whole.
+    """
+
+    def __init__(self, chunks):
+        self._chunks = chunks
+        self._chunk = b""
+        self._pos = 0
+        self._recorded = []
+        # Whether reading from the iterator raised.
+        self.failed = False
+
+    def readable(self):
+        return True
+
+    def _next(self):
+        try:
+            chunk = next(self._chunks, b"")
+        except Exception:
+            self.failed = True
+            raise
+        if self._recorded is not None and chunk:
+            self._recorded.append(chunk)
+        return chunk
+
+    def readinto(self, b):
+        if self._pos == len(self._chunk):
+            self._chunk = memoryview(self._next())
+            self._pos = 0
+        n = min(len(b), len(self._chunk) - self._pos)
+        b[:n] = self._chunk[self._pos : self._pos + n]
+        self._pos += n
+        return n
+
+    def _rest(self):
+        while True:
+            chunk = self._next()
+            if not chunk:
+                return
+            yield chunk
+
+    def iter_from_start(self):
+        """Iterate over the whole stream, from the start."""
+        recorded, self._recorded = self._recorded, None
+        return itertools.chain(recorded, self._rest())
+
+    def forget(self):
+        """Stop keeping what has been read."""
+        self._recorded = None
+
+    def drain(self):
+        """Read the rest of the stream, discarding it."""
+        self.forget()
+        for _ in self._rest():
+            pass
+
+
+def extract_stream(reader, dest_dir):
+    """Extract the tar archive read from ``reader`` into ``dest_dir``.
+
+    Returns False, having only read the start of the stream, if it isn't a
+    tar archive. Otherwise reads the stream to the end, so that the download
+    it comes from gets verified.
+    """
+    fh = io.BufferedReader(reader, CHUNK_SIZE)
+    magic = fh.peek(4)[:4]
+    try:
+        typ, ifh = open_fileobj(fh, "stream")
+    except (ArchiveTypeNotSupported, ValueError):
+        # ValueError is a zstd archive without the zstandard module, which
+        # extract_archive will report.
+        return False
+    if typ != "tar":
+        return False
+
+    if sys.platform == "win32":
+        # See extract_archive.
+        reader.forget()
+        TarFile.open(fileobj=ifh, mode="r|").extractall(str(dest_dir))
+    elif magic == ZSTD_MAGIC and shutil.which("zstd"):
+        # Not tar --use-compress-program: when reading from stdin, tar relays
+        # it to the decompressor in small blocks, which is several times
+        # slower.
+        run_pipeline(
+            [["zstd", "-dcq"], ["tar", "xf", "-"]],
+            dest_dir,
+            reader.iter_from_start(),
+        )
+    else:
+        reader.forget()
+        run_pipeline(
+            [["tar", "xf", "-"]],
+            dest_dir,
+            iter(functools.partial(ifh.read1, CHUNK_SIZE), b""),
+        )
+    reader.drain()
+    return True
+
+
+def empty_directory(path):
+    """Remove everything in ``path``, including read-only directories."""
+    for root, dirs, _ in os.walk(path):
+        for d in dirs:
+            d = os.path.join(root, d)
+            if not os.path.islink(d):
+                os.chmod(d, stat.S_IRWXU)
+    for entry in os.scandir(path):
+        if entry.is_dir(follow_symlinks=False):
+            shutil.rmtree(entry.path)
+        else:
+            os.unlink(entry.path)
+
+
+def stream_and_extract(url, dest_path, dest_dir, sha256=None, size=None, headers=None):
+    """Download ``url`` and extract it into ``dest_dir`` as it arrives.
+
+    If it turns out not to be a tar archive, it is downloaded to
+    ``dest_path`` instead, and False is returned.
+
+    With ``sha256`` or ``size``, content is extracted before it can be
+    verified. That's fine as long as ``dest_dir`` is a staging directory that
+    is only merged once this returns: on a mismatch it is emptied, the same
+    as a download that fails verification is deleted.
+    """
+    for _ in retrier(attempts=5, sleeptime=60):
+        chunks = stream_download(url, sha256=sha256, size=size, headers=headers)
+        reader = IterReader(chunks)
+        try:
+            t0 = time.time()
+            if extract_stream(reader, dest_dir):
+                log(f"{url} extracted to {dest_dir} in {time.time() - t0:.3f}s")
+                return True
+            log(f"{url} is not a tar archive; downloading it to {dest_path}")
+            with rename_after_close(dest_path, "wb") as fh:
+                for chunk in reader.iter_from_start():
+                    fh.write(chunk)
+            return False
+        except Exception as e:
+            log(f"Download failed: {e}")
+            empty_directory(dest_dir)
+            if not reader.failed:
+                # The download didn't fail, so find out whether it is intact.
+                # If it is, the archive itself is broken and retrying won't
+                # help.
+                try:
+                    reader.drain()
+                except Exception:
+                    pass
+                else:
+                    raise
+        finally:
+            chunks.close()
+
+    raise Exception("Download failed, no more retries!")
 
 
 def should_repack_archive(
@@ -719,12 +941,20 @@ def fetch_and_extract(url, dest_dir, extract=True, sha256=None, size=None):
     If the downloaded URL is an archive, it is extracted automatically
     and the archive is deleted. Otherwise the file remains in place in
     the destination directory.
+
+    When extracting, ``dest_dir`` must be a staging directory: a failed
+    attempt empties it.
     """
 
     basename = urllib.parse.unquote(urllib.parse.urlparse(url).path.split("/")[-1])
     dest_path = dest_dir / basename
 
-    download_to_path(url, dest_path, sha256=sha256, size=size)
+    # Zip archives can't be streamed, so they keep going through a file.
+    if extract and streaming_enabled() and archive_type(dest_path) != "zip":
+        if stream_and_extract(url, dest_path, dest_dir, sha256=sha256, size=size):
+            return
+    else:
+        download_to_path(url, dest_path, sha256=sha256, size=size)
 
     if not extract:
         return

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/src/taskgraph/util/cached_tasks.py

@@ -63,9 +63,14 @@ def add_optimization(
     # Pull requests use a different target cache index route. This way we can
     # be confident they won't be used by anything other than the pull request
     # that created the cache in the first place.
-    if config.params["tasks_for"] == "github-pull-request" and config.graph_config[
-        "taskgraph"
-    ].get("cache-pull-requests", True):
+    #
+    # Comments on a pull request run against the PR's head, so they use the
+    # same cache namespace as the PR itself.
+    tasks_for = config.params["tasks_for"]
+    if tasks_for in (
+        "github-pull-request",
+        "github-issue-comment",
+    ) and config.graph_config["taskgraph"].get("cache-pull-requests", True):
         subs["head_ref"] = config.params["head_ref"]
         if subs["head_ref"].startswith("refs/heads/"):
             subs["head_ref"] = subs["head_ref"][11:]
@@ -76,7 +81,10 @@ def add_optimization(
     # ... and cache at the lowest level.
     subs["level"] = config.params["level"]
 
-    if config.params["tasks_for"].startswith("github-pull-request"):
+    if (
+        tasks_for.startswith("github-pull-request")
+        or tasks_for == "github-issue-comment"
+    ):
         if config.graph_config["taskgraph"].get("cache-pull-requests", True):
             taskdesc.setdefault("routes", []).append(
                 f"index.{TARGET_PR_CACHE_INDEX.format(**subs)}"

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/taskcluster/config.yml

@@ -45,4 +45,4 @@ workers:
             provisioner: 'taskgraph-t'
             implementation: generic-worker
             os: windows
-            worker-type: win11-64-24h2
+            worker-type: win11-64-25h2

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/taskcluster/docker/index-task/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf
+FROM node:24-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1
 
 ENV       NODE_ENV        production
 RUN       mkdir /app

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/taskcluster/docker/index-task/yarn.lock

@@ -139,9 +139,9 @@ hawk@^9.0.1:
     "@hapi/hoek" "9.x.x"
 
 http-cache-semantics@^4.2.0:
-  version "4.2.0"
-  resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz#205f4db64f8562b76a4ff9235aa5279839a09dd5"
-  integrity sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==
+  version "4.3.0"
+  resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz#09eead3b16c6d85552857cc3fbd888d8353a2aaf"
+  integrity sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==
 
 http2-wrapper@^2.2.1:
   version "2.2.1"
@@ -228,16 +228,16 @@ taskcluster-lib-urls@^13.0.0:
   integrity sha512-IehEsRYfvTx8lvSEq7TaCn296+gSIf/3bOTHcm8gQ3ljna0OUvc/FEqMcCOPBG5gus9nh+L/ZOGCpXJi8tYf9w==
 
 type-fest@^5.6.0:
-  version "5.9.0"
-  resolved "https://registry.yarnpkg.com/type-fest/-/type-fest-5.9.0.tgz#0a4dd554d397f1a44447477eaeb3d1f4d8c7680f"
-  integrity sha512-yANm3Jr3GiJ1qgJlxGAVxTOIcEOk1rhQHamlXtnrCK7EHP4HeM9OGxtMg/W7HFdrVzw/ZWJKGVIJusVH85sLtw==
+  version "5.10.0"
+  resolved "https://registry.yarnpkg.com/type-fest/-/type-fest-5.10.0.tgz#bf0131fdf662889c94c409d37402e364fb2016f7"
+  integrity sha512-NoSdpq/WEiAg5sjmBkmV/hfxv6HJH4NqPNrqjtSO5CwRmpsDfaf4begxW34KdJykH/l1yHtwBWQkCRdoXO8mPA==
   dependencies:
     tagged-tag "^1.0.0"
 
 uint8array-extras@^1.5.0:
-  version "1.5.0"
-  resolved "https://registry.yarnpkg.com/uint8array-extras/-/uint8array-extras-1.5.0.tgz#10d2a85213de3ada304fea1c454f635c73839e86"
-  integrity sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==
+  version "1.6.0"
+  resolved "https://registry.yarnpkg.com/uint8array-extras/-/uint8array-extras-1.6.0.tgz#ab895526255bddd698e75a02992ee73f1b112ebe"
+  integrity sha512-8iAasVS4wUx0gPLjH8Xtz2PeDzTSiy8QiLGu2DT3X5GU+egFEQhpnbtkehbAwjvDcxIERmCYcysiODFmE3Ud0Q==
 
 uuid@^9.0.0:
   version "9.0.1"

{taskcluster_taskgraph-24.4.0 → taskcluster_taskgraph-24.4.1}/taskcluster/kinds/check/kind.yml

@@ -39,3 +39,15 @@ tasks:
         run:
             command: >-
                 uv run --all-extras pyright
+    scripts-min-python:
+        description: >-
+            Verify that the standalone scripts consumers run inside tasks
+            still support the oldest Python they're used with
+        treeherder:
+            symbol: check(scripts-min-python)
+        run:
+            command: >-
+                uv run vermin --target=3.8- --violations --eval-annotations --no-tips
+                src/taskgraph/run-task/run-task src/taskgraph/run-task/fetch-content &&
+                uv run --no-project --python 3.8 python src/taskgraph/run-task/run-task --help > /dev/null &&
+                uv run --no-project --python 3.8 python src/taskgraph/run-task/fetch-content --help > /dev/null