Tracing Taskcluster's GraphQL Filter to new Function() Taskcluster's historical web server passed a GraphQL JSON filter to sift@17.1.3, where a $where string reached new Function() and ran as JavaScript. Sep 24, 2026