Dependency Bump Evaluation

Version change: scality/cloudserver 9.2.34 → 9.3.6 (minor bump, Docker image in e2e test environment)

Changes:

• Access logging: TLS info now reads from proxy headers
• New aclRequired field added to server access logs
• LastModified date format changed to ISO string in XML responses
• Added missing headers for encrypted object operations
• Bucket rate limiting API methods in logging operations
• Server response header made configurable

Breaking changes: None

Security concerns: None — this is an internal Scality image used only in the e2e test environment; no new attack surface exposed

Impact on codebase: The codebase already fully supports all new fields (aclRequired, tlsVersion) in both the ClickHouse schema (pkg/testutil/clickhouse.go) and log record processing (pkg/logcourier/logrecord.go, logobject.go). E2e tests in acl_required_test.go and tls_fields_test.go actively validate these fields. The LastModified format change is transparent (handled by AWS SDK). No code changes required.

Recommendation: SAFE TO MERGE

Notes: CI checks are still in progress at time of review. Ensure "Build and test" and "End-to-end tests" pass before merging.

— Claude Code

Dependency Bump Evaluation

Version change: scality/cloudserver 9.2.36 → 9.3.6 (minor bump, Docker image for e2e tests)
Semver bump type: Minor (9.2 → 9.3)
CI status: In progress (no failures)

Changes across 9.3.x line:

• 9.3.0: AWS SDK v3 migration, nested XML for bucket quota, ListObjectsV2 optional attributes
• 9.3.1-9.3.2: Async/await refactoring, signature requirement relaxation (x-amz-content-sha256)
• 9.3.3-9.3.4: GetObjectAttributes API support
• 9.3.5: LastModified date format changed to ISO string, TLS info in access logs
• 9.3.6: Bucket rate limiting in logging, LastModified date fix, encrypted upload header fix

Breaking changes: None documented or detected

Security concerns: None — no suspicious patterns, no new transitive dependencies, no sensitive code path changes

Impact on codebase:

• Access log format changes (TLS fields, turn-around time, assumed-role ARNs): Already supported — LogRecord struct in pkg/logcourier/logrecord.go already defines TurnAroundTime, CipherSuite, and TlsVersion fields
• LastModified format change: Not applicable — log-courier does not parse LastModified from S3 responses
• x-amz-content-sha256 signing change: Not applicable — AWS SDK v2 handles signing automatically
• GetObjectAttributes API: Not used by log-courier
• Bucket rate limiting: Handled by existing exponential backoff retry logic in processor.go
• E2e tests already validate 9.3.x features: TLS fields (tls_fields_test.go), assumed-role ARNs (requester_field_test.go), turn-around time (helpers_test.go)

Recommendation: SAFE TO MERGE

Notes: Only file changed is env/default/values.yaml (e2e test environment Docker image tag). The codebase is fully compatible with all CloudServer 9.3.x changes — no code modifications needed.

— Claude Code

Dependency Bump Evaluation

Version change: scality/cloudserver 9.2.36 -> 9.3.6 (minor bump, Docker image in e2e test environment only)

Semver bump type: Minor (9.2 -> 9.3), with 7 intermediate releases (9.3.0 through 9.3.6)

Changes across 9.3.x releases:

• 9.3.1: Async/await migrations, bucket logging test migrations
• 9.3.2: Relaxed x-amz-content-sha256 signing requirement, async/await migration
• 9.3.3: Handle invalid Date header gracefully, GetObjectAttributes API support
• 9.3.4: Fix GetObjectAttributes versionId query parameter handling
• 9.3.5: LastModified date format to ISO string in XML, read TLS info from proxy headers in access logs
• 9.3.6: Bucket rate limiting API methods in bucket logging, encrypted object PUT header support, LastModified date fix

Breaking changes: None documented across any 9.3.x release

Security concerns: None. No CVEs referenced. No suspicious changes in release notes.

Impact on codebase:

• This image is only used in the e2e test environment (env/default/values.yaml), not in production.
• Log-courier reads pre-parsed records from ClickHouse by column name, not by position — resilient to field value changes.
• All access log fields referenced in release notes (aclRequired, turnAroundTime, Requester ARN format, tlsVersion/cipherSuite) are already supported in logrecord.go and tested in dedicated e2e tests (acl_required_test.go, requester_field_test.go).
• New API operations (GetObjectAttributes, bucket rate limiting) produce new Operation field values that log-courier handles generically — no hardcoded operation filtering.
• TLS proxy header changes (9.3.5) may alter TLS field values but log-courier treats these as opaque strings.
• The 26-field format validation in helpers_test.go:307 will catch any unexpected field count changes during e2e tests.

Recommendation: SAFE TO MERGE (once CI is green — checks currently in progress)

— Claude Code

Dependency Bump Evaluation

Version change: scality/cloudserver 9.2.37 -> 9.3.6 (minor)
Semver bump type: Minor (9.2 -> 9.3) with multiple intermediate releases

Changes (9.3.0 - 9.3.6):

• AWS SDK v3 migration (internal to CloudServer)
• ListObjectsV2 optional attributes support
• GetObjectAttributes API (new S3 operation)
• TLS info from proxy headers in access logs (CLDSRV-851)
• Bucket rate-limiting API methods added to bucket logging
• Nested XML input for bucket quota
• Various bug fixes and test improvements

Breaking changes: None

Security concerns: None - changes are internal refactors, additive features, and bug fixes

Impact on codebase:

• Only env/default/values.yaml changed (e2e test deployment config)
• Access log schema uses Nullable(String) for all operation-related fields - new operations (GetObjectAttributes, rate-limit APIs) pass through without code changes
• TLS field changes (CLDSRV-851) already validated by existing e2e test (tls_fields_test.go)
• No hardcoded operation whitelists - dynamic handling of any operation type
• Log-courier reads from ClickHouse, not raw S3 responses - SDK migration has zero impact

Recommendation: SAFE TO MERGE

Notes: CI checks are still in progress. The e2e tests will directly validate CloudServer 9.3.6 compatibility by exercising the full pipeline (CloudServer -> Fluent Bit -> ClickHouse -> log-courier -> S3). Wait for CI to pass before merging.

— Claude Code