[francoisferrand]

Node 24.22.1 updates the bundled root store to NSS 3.131.1, which blocks the compromised eMudhra/emSign intermediate CAs. The Dockerfile was the only place pinning the patch version; CI already uses 24.

Also refreshed yarn.lock to pick up the latest versions allowed by package.json, bringing yarn audit from 17 findings down to 3. No new duplicate versions: encoding and js-yaml@^5 were kept at their previous versions, since the newer ones only added duplicates (iconv-lite@0.7, argparse@3) without any security benefit. The remaining high findings are in @azure/msal-node, which comes in through arsenal.

Issue: CLDSRV-1052

[bert-e]

Hello francoisferrand,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
/after_pull_request	Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval	Bypass the pull request author's approval	⭐
/bypass_build_status	Bypass the build and test status	⭐
/bypass_commit_size	Bypass the check on the size of the changeset TBA	⭐
/bypass_incompatible_branch	Bypass the check on the source branch prefix	⭐
/bypass_jira_check	Bypass the Jira issue check	⭐
/bypass_peer_approval	Bypass the pull request peers' approval	⭐
/bypass_leader_approval	Bypass the pull request leaders' approval	⭐
/bypass_source_branch_lineage	Bypass the cross-branch contamination check	⭐
/approve	Instruct Bert-E that the author has approved the pull request.		✍️
/create_pull_requests	Allow the creation of integration pull requests.
/create_integration_branches	Allow the creation of integration branches.
/no_octopus	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity	Change review acceptance criteria from one reviewer at least to all reviewers
/wait	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
/help	Print Bert-E's manual in the pull request.
/status	Print Bert-E's current status in the pull request.
/clear	Remove all comments from Bert-E from the history TBA
/retry	Re-start a fresh build TBA
/build	Re-start a fresh build TBA
/force_reset	Delete integration branches & pull requests, and restart merge process from the beginning.
/reset	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

[bert-e]

Incorrect fix version

The Fix Version/s in issue CLDSRV-1052 contains:

• 9.5.2

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

• 9.5.2

• 9.6.0

Please check the Fix Version/s of CLDSRV-1052, or the target
branch of this pull request.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.20%. Comparing base (198dbbc) to head (a9ba24c).
✅ All tests successful. No failed tests found.

Additional details and impacted files

see 1 file with indirect coverage changes

@@                 Coverage Diff                 @@
##           development/9.5    #6343      +/-   ##
===================================================
- Coverage            90.23%   90.20%   -0.03%     
===================================================
  Files                  206      206              
  Lines                38673    38673              
===================================================
- Hits                 34897    34886      -11     
- Misses                3776     3787      +11     

Flag	Coverage Δ
checksums-disabled-tests	46.21% <ø> (ø)
file-ft-tests	76.00% <ø> (ø)
file-ft-tests-null-compat	76.50% <ø> (ø)
kmip-ft-tests	37.72% <ø> (ø)
mongo-v0-ft-tests	77.07% <ø> (-0.06%)	⬇️
mongo-v1-ft-tests	77.07% <ø> (-0.03%)	⬇️
multiple-backend	44.56% <ø> (ø)
s3c-ft-tests-v0	71.71% <ø> (ø)
s3c-ft-tests-v0-null-compat	71.77% <ø> (ø)
s3c-ft-tests-v1	71.68% <ø> (ø)
sur-tests	45.15% <ø> (-0.03%)	⬇️
sur-tests-inflights	48.55% <ø> (ø)
unit	79.76% <ø> (ø)
utapi-v2-tests	45.13% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[bert-e]

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

[claude]

The "@scality/arsenal@^8.6.0-0" pattern was dropped, but @scality/utapi still requires "@scality/arsenal" "^8.6.0-0" (line 1409). Without a lock entry for that range, yarn resolves it from the registry at install time. If a newer arsenal 8.x is published, utapi can get a different copy than the one locked here. Running yarn install would add the pattern back, so keep it on this entry:

Suggested change

	"@scality/arsenal@^8.6.0":
	"@scality/arsenal@^8.6.0", "@scality/arsenal@^8.6.0-0":