[FlorentinDUBOIS]

Summary

Prepares Sōzu 2.3.4, following RELEASE.md and the 2.3.3 preparation (#1907).

The release carries everything merged since 2.3.3:

• fix(mux): yield a progressing session at the loop budget instead of closing it #1918: a fast transfer is no longer cut at the mux loop budget, and a mid-response timeout no longer fires on the peer that is not holding the response up (Large Content-Length response truncated at a random offset through an HTTPS listener with h2 in ALPN (HTTP/1.1 client) #1906).
• fix(router): send a single Host header to HTTP/1.1 backends #1915: a single Host header reaches HTTP/1.1 backends with rewrite_host (rewrite_host sends two Host headers to HTTP/1.1 backends #1908).
• feat(router): add a REGEX_PATH rule matched against the path alone #1916: new REGEX_PATH rule, matched against the path without its query (Match a REGEX path rule against the path without its query #1909). This breaks the library API.
• feat(http): opt-in HTTP/2 prior knowledge (h2c) on HTTP listeners #1917: opt-in HTTP/2 prior knowledge (h2c) on HTTP listeners (HttpListener: opt-in HTTP/2 prior knowledge (h2c) for cleartext gRPC #1911).
• fix(worker): leave the event loop on a command channel error #1914: a worker leaves its event loop on a command channel error (Worker keeps running after an error on its command channel #1912).
• chore(deps): update compatible dependencies #1913, chore(deps): bump pulldown-cmark and async-executor for cargo audit #1919: dependency updates (cargo audit clean).

Changes

• Versions: all six packages (bin, lib, command, e2e, sim, fuzz) are at 2.3.4. The [workspace.dependencies] minima are ^2.3.4. Both lockfiles were refreshed through cargo update --workspace, and only the local packages moved. The RPM Version: is updated too.
• CHANGELOG.md: the [Unreleased] entries move to ## 2.3.4 - 2026-11-04, grouped as Added, Fixed and Upgrade notes. The REGEX_PATH entry carries the BREAKING (library API) label. The five merged-topic slot markers are removed, and the five other slot markers stay. The release workflow's awk extractor returns the section locally: 22 lines, 7262 characters.
• Previous-stable upgrade gate: moved from published 2.3.2 to published 2.3.3, as RELEASE.md asks. It now runs published_2_3_3_upgrades_to_current_and_drains_all_workers.
  • The pinned archive hash 9ca17e97d8e898ac5fd51315a170fb6507ac0ba4cc6773b61f38d136d99c0971 matches the release's SHA256SUMS.
  • The extracted executable hash is 5fe3b59dfae919ead1b62c3250dcb2c5ddc7aaa799c1e639d0fcef66f7a8acdb.
  • The expected version string is sozu 2.3.3 (6c983b6 HEAD), read from the binary itself.
  • The 2.2.1 bridge and 2.3.1 metadata cases are unchanged.
• Upgrade notes: the command schema gains PathRuleKind::REGEX_PATH = 3 and h2c_prior_knowledge (HttpListenerConfig 38, UpdateHttpListenerConfig 44). Upgrade the main process and every worker before using either.

Verification

• cargo +nightly fmt --all -- --check exits 0.
• cargo build --locked exits 0.
• cargo clippy --all-targets --locked -- -D warnings exits 0.
• cargo test -p sozu --locked --test main_upgrade_compatibility_matrix_e2e --no-run exits 0.
• cargo build --locked --manifest-path fuzz/Cargo.toml exits 0.
• The 2.3.3 → 2.3.4 two-worker gate is not run locally. The crypto-ring proc-observer-e2e cell of this PR's CI runs it.

After merge

1. Push a signed tag 2.3.4 on the squash commit.
2. Publish sozu-command-lib, sozu-lib and sozu to crates.io, in that order.
3. Check the release workflow's draft and the clevercloud/sozu:2.3.4 image, then publish the draft.