GENERAL

▶ [patch]
Upgrades to go1.26.1 [SECURITY], Node.js v24.14.0, yarn v4.13.0, and golangci-lint v2.11.2.

USERS

▶ [minor] #8287
Add ability to provide taskId in the payload to triggerHook and triggerHookWithToken. The hook service will look for taskId in the payload and use it to set the task ID if provided.

▶ [patch] #8357
Fix third-party login flow with extra window not being closed.

▶ [patch] #8341
Fixes issues with local dev env where tc-admin image was built for single architecture. tc-admin:5.2.0 publishes multi-arch image

▶ [patch] #8300
Task log profiler returns empty profile when log doesn't have correct time markers instead of throwing an error.

▶ [patch]
The generic-worker now notifies task status listeners outside of the internal status lock, reducing the risk of lock contention or deadlock when listeners query task status during callbacks.

Internal artifact upload error handling was also refactored into a dedicated classifier helper without changing runtime behavior.

Automated Package Updates

No changes

WORKER-DEPLOYERS

▶ [patch]
D2G: avoids unnecessary I/O of copying cached docker image to task user's directory.

▶ [patch] #8326
Generic Worker: when running with worker-runner, the worker now checks with Worker Manager before shutting down due to idle timeout. If Worker Manager says the worker is still needed (e.g., to satisfy minCapacity), the idle timer resets instead of shutting down. Workers not running with worker-runner are unaffected.

▶ [patch] #8328
Worker Manager: the worker scanner now uses a dedicated target capacity formula for termination decisions based on pending tasks, claimed tasks, and minCapacity/maxCapacity. Previously, the provisioning formula was reused, which inflated the target by existing worker counts, so idle workers were never terminated even when minCapacity was lowered to 0.

USERS

▶ [patch] #8323
Fixes queue.listTaskGroup endpoint that in some cases didn't return full list of tasks in the given group.

Automated Package Updates

WORKER-DEPLOYERS

▶ [minor] #7652
Generic Worker & Livelog: fix livelog temporary streaming files not being cleaned up. The livelog process creates a temp directory per stream, but since the generic worker kills it with SIGKILL, the process never has a chance to clean up. Fixed by having the generic worker create a dedicated temp directory for each livelog process (via the new LIVELOG_TEMP_DIR env var) and removing it after the process is killed.

▶ [patch] #8318
Generic Worker & Livelog: fix intermittent "address already in use" error on livelog ports. When a livelog process failed to start, an orphaned goroutine would keep polling the port and later send a duplicate PUT request to the next task's livelog process, causing its GET server to fail binding. Fixed by cancelling the goroutine on early process exit, killing orphaned livelog processes on connection failure, and fixing the livelog binary's duplicate PUT request guard which was checked but never set.

USERS

▶ [minor] #8101
Queue artifact creation (createArtifact) now accepts an optional contentLength field for S3 and object artifacts. When provided, the artifact size in bytes is stored and returned in listArtifacts, artifactInfo, and related endpoints.

Automated Package Updates

WORKER-DEPLOYERS

▶ [patch] #8314
Azure double-checks if vm is gone by calling virtualMachines.get after instanceView returns 404.
This is to prevent situations when worker is being removed based on one failed instanceView call.

▶ [patch]
Adds Weight Distribution Playground for Launch Configurations in documentation
to see how initialWeight value change affect distribution

USERS

▶ [patch] #8311
Fixes UI issue for LaunchConfigs not showing location when ARM deployment template was used

Automated Package Updates

DEPLOYERS

▶ [patch] #7472
The queue service's workerRemovedResolver now also listens for workerStopped events from worker-manager, in addition to workerRemoved events. This ensures claimed tasks are resolved as exception/worker-shutdown as early as possible when a worker disappears. Both events are handled idempotently, so receiving both for the same worker is safe.

DEPLOYERS

▶ [minor] #7472
The queue service now listens for workerRemoved events from worker-manager and immediately resolves any tasks claimed by that worker as exception/worker-shutdown, triggering an automatic retry.
Previously, when a worker disappeared (due to VM preemption, crash, or manual termination), its claimed tasks would wait up to 20 minutes for the claim to expire before being retried.
This new workerRemovedResolver background process runs alongside the existing claim-resolver and requires no configuration changes.

USERS

▶ [patch] #8300
Task log profiler optimizations for parsing large task logs, more memory and cpu efficient.

Automated Package Updates

WORKER-DEPLOYERS

▶ [patch] #8083
Generic Worker (windows): waits for the User Profile Service (ProfSvc) to be running before performing profile operations on first boot, and fixes a bug where LoadUserProfile retry logic for "device not ready" errors never actually retried due to an incorrect error type assertion.

DEPLOYERS

▶ [patch] #8292
Claim-resolver and deadline-resolver expose metrics.

GENERAL

▶ [patch]
Upgrades to go1.26.0

Release notes here.

WORKER-DEPLOYERS

▶ [minor] #7147
Worker-manager now decides which workers should be kept during the worker-scanner loop, surfaced via the shouldWorkerTerminate API.
Decision is being made based on several policies:

• if launch config is archived - worker would be marked as "shouldTerminate=true"
• if workers exceed the desired capacity (more workers than pending tasks) - the oldest workers would be marked as "shouldTerminate=true" (newest workers are kept)

▶ [patch] #8289
Generic Worker: fixes credential expiration during high-volume artifact uploads by narrowing the scope of the queue client lock so that credential refresh is no longer blocked by in-flight HTTP calls.

▶ [patch] #8291
Generic Worker: handles SIGTERM during task execution by triggering graceful termination, ensuring preempted tasks are properly resolved as exception/worker-shutdown instead of exception/claim-expired.

USERS

▶ [minor] #8035
The index service no longer adds a bewit (time-limited auth token) to redirect URLs for public artifacts. Artifacts are considered public if the anonymous role has the necessary scopes to get them. The index service caches the scopes associated to the anonymous role and refreshes them from the auth service every 5 minutes. Additionally, for public artifacts, the index service now resolves the final artifact URL server-side by calling the queue's latestArtifact endpoint, reducing the redirect chain from two hops (Index → Queue → storage) to one (Index → storage).

▶ [patch] #8070
Show a warning banner in the UI when live updates are disabled due to missing web:read-pulse scope, instead of silently showing stale data.

DEVELOPERS

▶ [patch] #8292
Add missing queue_exception_tasks metric to the claim-resolver and deadline-resolver.

▶ [patch] #8261
Fix webpack-dev-server crash (ECONNRESET) when proxying WebSocket /subscription endpoint during local UI development.

OTHER

▶ Additional change not described here: #8271.

Automated Package Updates