chore(deps): Bump the cargo-minor-patch group with 6 updates

[dependabot]

Bumps the cargo-minor-patch group with 6 updates:

Package	From	To
serde-saphyr	1.2.0	1.3.0
aws-sdk-s3	1.146.1	1.148.0
aws-sdk-sts	1.114.0	1.116.0
s3s	0.16.0	0.16.1
s3s-fs	0.16.0	0.16.1
s3s-aws	0.16.0	0.16.1

Updates serde-saphyr from 1.2.0 to 1.3.0

Release notes

Sourced from serde-saphyr's releases.

1.3.0 Maintenance and performance release

• Integer mapping keys now compare by their parsed numeric value for duplicate detection and merge resolution, including inside composite keys (0xB and 11 compare equal). Deserializing to strings preserves the original spelling; FirstWins and LastWins retain the selected key's spelling and associated value.
• Composite keys containing null-like strings now preserve both the key and its associated value; for example, {{"null": 1}: 2} now round-trips correctly.
• Null mapping keys now remain distinct from null-like string keys during duplicate detection and merge resolution, including inside composite keys.
• Null detection now respects string tags and scalar styles, preserving null-like strings such as !!str null, including when deserializing to Option<String>.
• Explicit numeric tags (!!int and !!float) now deserialize correctly through deserialize_any, including quoted and block scalars.
• Floating-point deserialization now rejects incompatible core tags; for example, from_str::<f64>("!!str 1.5") now returns an error.
• Serialization now escapes U+FFFE and U+FFFF as \uFFFE and \uFFFF.
• Serialization now preserves newline-only strings in literal block scalars, including LitStr and LitString, by using keep chomping and retaining every empty line.
• Updated the granit-parser revision to preserve document boundaries after zero-indented root literal and folded block scalars, including empty strings.
• Preserve string scalars across YAML 1.1 readers (PR #90, thanks @​NiklasRosenstein)
• The version increased to 1.3 because it uses granit-parser 1.3, and that is because granit-parser added two methods to Input for performance improvements. As serde-saphyr re-exports it, the version number must be increased to 1.3 as well, even if no new features are added to this crate itself.

Changelog

Sourced from serde-saphyr's changelog.

1.3.0 Maintenance and performance release

Fixed

• Integer mapping keys now compare by their parsed numeric value for duplicate detection and merge resolution, including inside composite keys (0xB and 11 compare equal). Deserializing to strings preserves the original spelling; FirstWins and LastWins retain the selected key's spelling and associated value.
• Composite keys containing null-like strings now preserve both the key and its associated value; for example, {{"null": 1}: 2} now round-trips correctly.
• Null mapping keys now remain distinct from null-like string keys during duplicate detection and merge resolution, including inside composite keys.
• Null detection now respects string tags and scalar styles, preserving null-like strings such as !!str null, including when deserializing to Option<String>.
• Explicit numeric tags (!!int and !!float) now deserialize correctly through deserialize_any, including quoted and block scalars.
• Floating-point deserialization now rejects incompatible core tags; for example, from_str::<f64>("!!str 1.5") now returns an error.
• Serialization now escapes U+FFFE and U+FFFF as \uFFFE and \uFFFF.
• Serialization now preserves newline-only strings in literal block scalars, including LitStr and LitString, by using keep chomping and retaining every empty line.
• Updated the granit-parser revision to preserve document boundaries after zero-indented root literal and folded block scalars, including empty strings.
• Preserve string scalars across YAML 1.1 readers (PR #90, thanks @​NiklasRosenstein)
• The version increased to 1.3 because it uses granit-parser 1.3, and that is because granit-parser added two methods to Input for performance improvements. As serde-saphyr re-exports it, the version number must be increased to 1.3 as well, even if no new features are added to this crate itself.

Commits

• 93e634c Switching to 1.3.0
• b94505a Miri fix
• aa4adad We will need to go 1.3
• 7a1646e Update CHANGELOG.md
• b17fc43 Extend the quoting check to signed lowercase 0o forms
• 8aae8fe Preserve string scalars across YAML 1.1 readers (#190)
• de014b0 Bump rstest from 0.26.1 to 0.27.0 (#191)
• bbd93a8 Switch to released granit parser.
• 49ecf1b Next release start automatically on tag push
• 6bcee83 Fix pirate formatter test
• Additional commits viewable in compare view

Updates aws-sdk-s3 from 1.146.1 to 1.148.0

Commits

• See full diff in compare view

Updates aws-sdk-sts from 1.114.0 to 1.116.0

Commits

• See full diff in compare view

Updates s3s from 0.16.0 to 0.16.1

Changelog

Sourced from s3s's changelog.

v0.16.1 - 2026-09-16

s3s

Migration: v0.16.1 tightens signature coverage for request-metadata headers. The new behaviour is the one to adopt; the item names the option that restores the previous behaviour.

• Request-metadata headers (x-amz-decoded-content-length, x-amz-trailer, x-amz-checksum-algorithm) must be covered by the signature; S3Config::unsigned_amz_header_allowlist exempts a header again.

BREAKING: previously accepted requests are now rejected:

• Require signatures for request metadata headers (#830)

CI

• Remove the s3s dry-run publish step (#824)

Dependencies

• Update rustls to 0.23.45, fixing [RUSTSEC-2026-0285] (handshake messages accepted across encryption level boundaries) and the failing audit job (#828)

Commits

• 333297b release v0.16.1
• ebd00c5 fix(s3s/ops)!: require signatures for request metadata headers (#830)
• 059f033 fix: upgrade rustls to 0.23.45 to fix security vulnerability RUSTSEC-2026-028...
• 18636f1 ci: remove the s3s dry-run publish step (#824)
• See full diff in compare view

Updates s3s-fs from 0.16.0 to 0.16.1

Changelog

Sourced from s3s-fs's changelog.

v0.16.1 - 2026-09-16

s3s

Migration: v0.16.1 tightens signature coverage for request-metadata headers. The new behaviour is the one to adopt; the item names the option that restores the previous behaviour.

• Request-metadata headers (x-amz-decoded-content-length, x-amz-trailer, x-amz-checksum-algorithm) must be covered by the signature; S3Config::unsigned_amz_header_allowlist exempts a header again.

BREAKING: previously accepted requests are now rejected:

• Require signatures for request metadata headers (#830)

CI

• Remove the s3s dry-run publish step (#824)

Dependencies

• Update rustls to 0.23.45, fixing [RUSTSEC-2026-0285] (handshake messages accepted across encryption level boundaries) and the failing audit job (#828)

Commits

• 333297b release v0.16.1
• ebd00c5 fix(s3s/ops)!: require signatures for request metadata headers (#830)
• 059f033 fix: upgrade rustls to 0.23.45 to fix security vulnerability RUSTSEC-2026-028...
• 18636f1 ci: remove the s3s dry-run publish step (#824)
• See full diff in compare view

Updates s3s-aws from 0.16.0 to 0.16.1

Changelog

Sourced from s3s-aws's changelog.

v0.16.1 - 2026-09-16

s3s

Migration: v0.16.1 tightens signature coverage for request-metadata headers. The new behaviour is the one to adopt; the item names the option that restores the previous behaviour.

• Request-metadata headers (x-amz-decoded-content-length, x-amz-trailer, x-amz-checksum-algorithm) must be covered by the signature; S3Config::unsigned_amz_header_allowlist exempts a header again.

BREAKING: previously accepted requests are now rejected:

• Require signatures for request metadata headers (#830)

CI

• Remove the s3s dry-run publish step (#824)

Dependencies

• Update rustls to 0.23.45, fixing [RUSTSEC-2026-0285] (handshake messages accepted across encryption level boundaries) and the failing audit job (#828)

Commits

• 333297b release v0.16.1
• ebd00c5 fix(s3s/ops)!: require signatures for request metadata headers (#830)
• 059f033 fix: upgrade rustls to 0.23.45 to fix security vulnerability RUSTSEC-2026-028...
• 18636f1 ci: remove the s3s dry-run publish step (#824)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions