CLDSRV-1015: Drop runtime dependency on @scality/cloudserverclient by francoisferrand · Pull Request #6314 · scality/cloudserver

francoisferrand · 2026-09-30T07:50:39Z

The backbeat routes only used cloudserverclient to get the names of three exceptions for CRR conflict responses, but that made the whole package a runtime dependency shipped in the production image. It's ~235 MB and vendors its own node_modules (including an old fast-xml-parser with a critical CVE), which lockfile scanners don't see and yarn resolutions can't fix.

The error names now live in constants.js, and the client goes back to devDependencies since functional tests still use it. A unit test checks the local names match the client's exception names, so a rename on the client side gets caught.

Checked that a yarn install --production --frozen-lockfile no longer pulls the package and that the server still starts with S3BACKEND=mem. The Dockerfile already installs with --production. yarn.lock is unchanged, since yarn classic doesn't track dev vs prod.

Issue: CLDSRV-1015

The backbeat routes only needed the exception names of cloudserverclient to report CRR conflicts, yet the package was a runtime dependency and got shipped in the production image. It is huge and vendors its own node_modules (including a vulnerable fast-xml-parser), which lockfile scanners and yarn resolutions cannot see or fix. The error names are now defined in constants, and the client is back to being a devDependency for functional tests. A unit test checks the names still match the client's exceptions. Issue: CLDSRV-1015

bert-e · 2026-09-30T07:50:43Z

Hello francoisferrand,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/bypass_source_branch_lineage`	Bypass the cross-branch contamination check	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request.
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

francoisferrand · 2026-09-30T07:52:43Z

note: the size of the CloudserverClient package comes because it bundles its own node_modules inside the published package; which is being addressed in CLDSRVCLT-19

codecov · 2026-09-30T07:53:33Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.49%. Comparing base (b7e9140) to head (0ce6bca).
⚠️ Report is 1 commits behind head on development/9.4.
✅ All tests successful. No failed tests found.

Additional details and impacted files

Files with missing lines	Coverage Δ
lib/routes/routeBackbeat.js	`78.81% <100.00%> (ø)`

@@               Coverage Diff                @@
##           development/9.4    #6314   +/-   ##
================================================
  Coverage            86.49%   86.49%           
================================================
  Files                  212      212           
  Lines                14567    14567           
================================================
  Hits                 12599    12599           
  Misses                1968     1968

Flag	Coverage Δ
checksums-disabled-tests	`35.34% <100.00%> (ø)`
file-ft-tests	`69.98% <100.00%> (ø)`
file-ft-tests-null-compat	`70.52% <100.00%> (+0.06%)`	⬆️
kmip-ft-tests	`28.10% <100.00%> (ø)`
mongo-v0-ft-tests	`71.15% <100.00%> (ø)`
mongo-v1-ft-tests	`71.14% <100.00%> (+0.01%)`	⬆️
multiple-backend	`36.11% <100.00%> (ø)`
s3c-ft-tests-v0	`65.00% <100.00%> (-0.02%)`	⬇️
s3c-ft-tests-v0-null-compat	`65.06% <100.00%> (-0.02%)`	⬇️
s3c-ft-tests-v1	`64.98% <100.00%> (ø)`
sur-tests	`37.51% <100.00%> (+0.87%)`	⬆️
sur-tests-inflights	`39.47% <100.00%> (ø)`
unit	`74.18% <100.00%> (ø)`
utapi-v2-tests	`35.31% <100.00%> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

bert-e · 2026-09-30T07:53:43Z

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

DarkIsDude · 2026-09-30T08:21:13Z

Should we not fix the CVE (upgrade the package or change the dependency in cloudserverclient) ? This PR seems like a hack to hide something...

SylvainSenechal · 2026-09-30T09:53:15Z

Should we not fix the CVE (upgrade the package or change the dependency in cloudserverclient) ? This PR seems like a hack to hide something...

I think he will make a pr in cloudserverclient to fix the node module bug thing

SylvainSenechal

A bit unfortunate we can't use the cloudserverclient errors without important 200mb of node modules

francoisferrand · 2026-09-30T10:16:29Z

A bit unfortunate we can't use the cloudserverclient errors without important 200mb of node modules

not only that, depending on cloudserverclient also creates a kind of a dependency loop

cloudserverc depends on cloudserverclient, which kind of depends on cloudserver (for testing, etc...).

it is not a real dependency loop (in package.json), but still weird - and means it is not possible to one PR (server) before updating the client.

--> decoupling works better in such case, and the risk of copying is managed by a test

francoisferrand · 2026-09-30T10:16:59Z

/approve

bert-e · 2026-09-30T10:17:12Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge bugfix/CLDSRV-1015 into
development/9.4
w/9.5/bugfix/CLDSRV-1015 will be merged into development/9.5

The following branches will NOT be impacted:

development/7.10
development/7.4
development/7.70
development/8.8
development/9.0
development/9.1
development/9.2
development/9.3

You can set option create_pull_requests if you need me to create
integration pull requests in addition to integration branches, with:

@bert-e create_pull_requests

The following options are set: approve

bert-e · 2026-09-30T10:35:37Z

Build failed

The build for commit did not succeed in branch w/9.5/bugfix/CLDSRV-1015

The following options are set: approve

bert-e · 2026-09-30T12:19:17Z

In the queue

The changeset has received all authorizations and has been added to the
relevant queue(s). The queue(s) will be merged in the target development
branch(es) as soon as builds have passed.

The changeset will be merged in:

✔️ development/9.4
✔️ development/9.5

The following branches will NOT be impacted:

development/7.10
development/7.4
development/7.70
development/8.8
development/9.0
development/9.1
development/9.2
development/9.3

This pull request does not target the following hotfix branch(es) so they
will be left untouched:

hotfix/7.10.15
hotfix/7.4.2
hotfix/7.70.51
hotfix/6.4.7
hotfix/7.10.30
hotfix/7.10.4
hotfix/7.70.45
hotfix/7.70.73
hotfix/9.2.36
hotfix/9.3.13
hotfix/7.10.28
hotfix/7.70.11
hotfix/9.2.24
hotfix/7.4.1
hotfix/7.2.0
hotfix/7.4.7
hotfix/7.10.8
hotfix/7.4.5
hotfix/7.4.6
hotfix/7.70.21
hotfix/7.10.3
hotfix/7.10.1
hotfix/7.7.0
hotfix/7.9.0
hotfix/7.8.0
hotfix/7.10.27
hotfix/7.4.9
hotfix/7.4.10
hotfix/7.10.49
hotfix/7.4.8
hotfix/7.10.2
hotfix/9.0.32
hotfix/7.6.0
hotfix/9.0.7
hotfix/8.8.45
hotfix/7.10.0
hotfix/7.4.4
hotfix/7.4.3
hotfix/7.4.0

There is no action required on your side. You will be notified here once
the changeset has been merged. In the unlikely event that the changeset
fails permanently on the queue, a member of the admin team will
contact you to help resolve the matter.

IMPORTANT

Please do not attempt to modify this pull request.

Any commit you add on the source branch will trigger a new cycle after the
current queue is merged.
Any commit you add on one of the integration branches will be lost.

If you need this pull request to be removed from the queue, please contact a
member of the admin team now.

The following options are set: approve

bert-e · 2026-09-30T12:38:27Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/9.4
✔️ development/9.5

The following branches have NOT changed:

development/7.10
development/7.4
development/7.70
development/8.8
development/9.0
development/9.1
development/9.2
development/9.3

Please check the status of the associated issue CLDSRV-1015.

Goodbye francoisferrand.

francoisferrand requested review from a team, DarkIsDude and SylvainSenechal September 30, 2026 07:51

scality deleted a comment from bert-e Sep 30, 2026

DarkIsDude approved these changes Sep 30, 2026

View reviewed changes

SylvainSenechal approved these changes Sep 30, 2026

View reviewed changes

bert-e merged commit 0ce6bca into development/9.4 Sep 30, 2026
62 of 64 checks passed

bert-e deleted the bugfix/CLDSRV-1015 branch September 30, 2026 12:38

Navigation Menu

CLDSRV-1015: Drop runtime dependency on @scality/cloudserverclient - #6314

CLDSRV-1015: Drop runtime dependency on @scality/cloudserverclient#6314
bert-e merged 1 commit into
development/9.4from
bugfix/CLDSRV-1015

francoisferrand commented Sep 30, 2026

Uh oh!

bert-e commented Sep 30, 2026

Uh oh!

francoisferrand commented Sep 30, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

bert-e commented Sep 30, 2026

Uh oh!

DarkIsDude commented Sep 30, 2026

Uh oh!

SylvainSenechal commented Sep 30, 2026

Uh oh!

SylvainSenechal left a comment

Uh oh!

francoisferrand commented Sep 30, 2026

Uh oh!

francoisferrand commented Sep 30, 2026

Uh oh!

bert-e commented Sep 30, 2026

Uh oh!

bert-e commented Sep 30, 2026

Uh oh!

bert-e commented Sep 30, 2026

Uh oh!

bert-e commented Sep 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

francoisferrand commented Sep 30, 2026

Uh oh!

bert-e commented Sep 30, 2026

Hello francoisferrand,

Uh oh!

francoisferrand commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bert-e commented Sep 30, 2026

Request integration branches

Uh oh!

DarkIsDude commented Sep 30, 2026

Uh oh!

SylvainSenechal commented Sep 30, 2026

Uh oh!

SylvainSenechal left a comment

Choose a reason for hiding this comment

Uh oh!

francoisferrand commented Sep 30, 2026

Uh oh!

francoisferrand commented Sep 30, 2026

Uh oh!

bert-e commented Sep 30, 2026

Integration data created

Uh oh!

bert-e commented Sep 30, 2026

Build failed

Uh oh!

bert-e commented Sep 30, 2026

In the queue

Uh oh!

bert-e commented Sep 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

francoisferrand commented Sep 30, 2026 •

edited

Loading

codecov Bot commented Sep 30, 2026 •

edited

Loading