Skip to content

chore(deps): bump the rust-minor-patch group across 1 directory with 23 updates#3382

Open
dependabot[bot] wants to merge 5 commits into
mainfrom
dependabot/cargo/rust-minor-patch-edd4234e55
Open

chore(deps): bump the rust-minor-patch group across 1 directory with 23 updates#3382
dependabot[bot] wants to merge 5 commits into
mainfrom
dependabot/cargo/rust-minor-patch-edd4234e55

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 13, 2026 •
edited
Loading

Weekly dependabot refresh of Cargo.lock.

Dependabot's original PR also raised the lower-bound version requirements
in Cargo.toml (arrow, tokio, aws-sdk-, etc.) to match the new lockfile
versions. That forces our library's consumers onto newer minimum
versions and broke the MSRV check, which downgrades aws-sdk- crates to
verify they still build on Rust 1.91.

Changes from the original:

  • Reverted all Cargo.toml requirement changes; Cargo.lock regenerated
    with cargo update within the existing ranges. The lockfile (and the
    binaries we ship) stays current on security fixes without bumping our
    public minimum versions.
  • Set versioning-strategy: lockfile-only in .github/dependabot.yml so
    future cargo dependabot PRs only touch Cargo.lock.

Note: aws-lc-rs stays at 1.16.3 — nodejs/Cargo.toml pins it with =,
which lockfile-only cannot move; bumping it needs a manual change.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file Rust Rust related issues labels May 13, 2026
claude[bot]
claude Bot reviewed May 13, 2026
View reviewed changes
Copy link
Copy Markdown

@claude claude Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

Tip: disable this comment in your organization's Code Review settings.

@github-actions github-actions Bot added Python Python SDK chore Small non-consequential change. Hidden from changelogs. labels May 13, 2026
@dependabot
chore(deps): bump the rust-minor-patch group across 1 directory with …
fb95c4c 
…23 updates

Bumps the rust-minor-patch group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [arrow](https://github.com/apache/arrow-rs) | `58.1.0` | `58.3.0` |
| [pin-project](https://github.com/taiki-e/pin-project) | `1.1.11` | `1.1.13` |
| [semver](https://github.com/dtolnay/semver) | `1.0.27` | `1.0.28` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.50.0` | `1.52.3` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.18.0` | `3.20.0` |
| [aws-sdk-bedrockruntime](https://github.com/awslabs/aws-sdk-rust) | `1.113.0` | `1.125.0` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.22.0` | `1.23.1` |
| [aws-sdk-dynamodb](https://github.com/awslabs/aws-sdk-rust) | `1.96.0` | `1.105.0` |
| [aws-sdk-kms](https://github.com/awslabs/aws-sdk-rust) | `1.91.0` | `1.101.0` |
| [test-log](https://github.com/d-e-s-o/test-log) | `0.2.19` | `0.2.20` |
| [napi](https://github.com/napi-rs/napi-rs) | `3.8.3` | `3.8.6` |
| [napi-derive](https://github.com/napi-rs/napi-rs) | `3.5.2` | `3.5.6` |
| [aws-lc-rs](https://github.com/aws/aws-lc-rs) | `1.16.3` | `1.17.0` |
| [napi-build](https://github.com/napi-rs/napi-rs) | `2.3.1` | `2.3.2` |
| [libc](https://github.com/rust-lang/libc) | `0.2.183` | `0.2.186` |



Updates `arrow` from 58.1.0 to 58.3.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.1.0...58.3.0)

Updates `arrow-array` from 58.1.0 to 58.3.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.1.0...58.3.0)

Updates `arrow-data` from 58.1.0 to 58.3.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.1.0...58.3.0)

Updates `arrow-ipc` from 58.1.0 to 58.3.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.1.0...58.3.0)

Updates `arrow-ord` from 58.1.0 to 58.3.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.1.0...58.3.0)

Updates `arrow-schema` from 58.1.0 to 58.3.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.1.0...58.3.0)

Updates `arrow-select` from 58.1.0 to 58.3.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.1.0...58.3.0)

Updates `arrow-cast` from 58.1.0 to 58.3.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.1.0...58.3.0)

Updates `pin-project` from 1.1.11 to 1.1.13
- [Release notes](https://github.com/taiki-e/pin-project/releases)
- [Changelog](https://github.com/taiki-e/pin-project/blob/main/CHANGELOG.md)
- [Commits](taiki-e/pin-project@v1.1.11...v1.1.13)

Updates `semver` from 1.0.27 to 1.0.28
- [Release notes](https://github.com/dtolnay/semver/releases)
- [Commits](dtolnay/semver@1.0.27...1.0.28)

Updates `tokio` from 1.50.0 to 1.52.3
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.50.0...tokio-1.52.3)

Updates `serde_with` from 3.18.0 to 3.20.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.18.0...v3.20.0)

Updates `aws-sdk-bedrockruntime` from 1.113.0 to 1.125.0
- [Release notes](https://github.com/awslabs/aws-sdk-rust/releases)
- [Commits](https://github.com/awslabs/aws-sdk-rust/commits)

Updates `uuid` from 1.22.0 to 1.23.1
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.22.0...v1.23.1)

Updates `aws-sdk-dynamodb` from 1.96.0 to 1.105.0
- [Release notes](https://github.com/awslabs/aws-sdk-rust/releases)
- [Commits](https://github.com/awslabs/aws-sdk-rust/commits)

Updates `aws-sdk-kms` from 1.91.0 to 1.101.0
- [Release notes](https://github.com/awslabs/aws-sdk-rust/releases)
- [Commits](https://github.com/awslabs/aws-sdk-rust/commits)

Updates `test-log` from 0.2.19 to 0.2.20
- [Release notes](https://github.com/d-e-s-o/test-log/releases)
- [Changelog](https://github.com/d-e-s-o/test-log/blob/main/CHANGELOG.md)
- [Commits](d-e-s-o/test-log@v0.2.19...v0.2.20)

Updates `arrow-buffer` from 58.1.0 to 58.3.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.1.0...58.3.0)

Updates `napi` from 3.8.3 to 3.8.6
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](napi-rs/napi-rs@napi-v3.8.3...napi-v3.8.6)

Updates `napi-derive` from 3.5.2 to 3.5.6
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](napi-rs/napi-rs@napi-derive-v3.5.2...napi-derive-v3.5.6)

Updates `aws-lc-rs` from 1.16.3 to 1.17.0
- [Release notes](https://github.com/aws/aws-lc-rs/releases)
- [Commits](aws/aws-lc-rs@v1.16.3...v1.17.0)

Updates `napi-build` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](napi-rs/napi-rs@napi-build-v2.3.1...napi-build-v2.3.2)

Updates `libc` from 0.2.183 to 0.2.186
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.186/CHANGELOG.md)
- [Commits](rust-lang/libc@0.2.183...0.2.186)

---
updated-dependencies:
- dependency-name: arrow
  dependency-version: 58.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: arrow-array
  dependency-version: 58.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: arrow-buffer
  dependency-version: 58.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: arrow-cast
  dependency-version: 58.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: arrow-data
  dependency-version: 58.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: arrow-ipc
  dependency-version: 58.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: arrow-ord
  dependency-version: 58.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: arrow-schema
  dependency-version: 58.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: arrow-select
  dependency-version: 58.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: aws-lc-rs
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: aws-sdk-bedrockruntime
  dependency-version: 1.125.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: aws-sdk-dynamodb
  dependency-version: 1.105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: aws-sdk-kms
  dependency-version: 1.101.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: libc
  dependency-version: 0.2.186
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor-patch
- dependency-name: napi
  dependency-version: 3.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor-patch
- dependency-name: napi-build
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor-patch
- dependency-name: napi-derive
  dependency-version: 3.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor-patch
- dependency-name: pin-project
  dependency-version: 1.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor-patch
- dependency-name: semver
  dependency-version: 1.0.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor-patch
- dependency-name: serde_with
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: test-log
  dependency-version: 0.2.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor-patch
- dependency-name: tokio
  dependency-version: 1.52.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
- dependency-name: uuid
  dependency-version: 1.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/cargo/rust-minor-patch-edd4234e55 branch from 41754f3 to fb95c4c Compare May 14, 2026 22:33
Will Jones and others added 4 commits May 14, 2026 15:51
@claude
chore(deps): only update Cargo.lock, not Cargo.toml requirements
a12b28c 
Dependabot raised the lower-bound version requirements in Cargo.toml
(arrow, tokio, aws-sdk-*, etc.) to match the new lockfile versions. That
forces our library's consumers onto newer minimum versions and broke the
MSRV check, which downgrades aws-sdk-* crates to verify they still build
on Rust 1.91 — the downgrades could no longer satisfy the bumped
constraints.

Revert all Cargo.toml changes and regenerate Cargo.lock within the
existing requirement ranges. The point of this dependabot job is to keep
the lockfile (and the binaries we ship) current on security fixes, not
to bump our public minimum versions.

Also set `versioning-strategy: lockfile-only` so future dependabot PRs
only touch Cargo.lock.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@wjones127 @claude
ci: downgrade aws-smithy-* in MSRV check
3995ca7 
aws-runtime, aws-sigv4, aws-credential-types, and the aws-smithy-*
crates bumped their MSRV to 1.91.1 in late 2026, so they no longer
build on our pinned 1.91.0 MSRV. Pin them to the latest 1.91.0
compatible versions in the MSRV downgrade step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@wjones127
Merge remote-tracking branch 'upstream/main' into pr-3382
4bd65e6 
# Conflicts:
#	Cargo.lock
@wjones127 @claude
ci: reorder MSRV downgrades so they all apply
f2f748c 
aws-types 1.3.15 pins aws-credential-types ^1.2.14 and aws-smithy-query
0.60.15 pins aws-smithy-types ^1.4.6, so the original ordering aborted
mid-script. Reorder so each pinning crate is downgraded before the one
it pins.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claude claude[bot] claude[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

chore Small non-consequential change. Hidden from changelogs. dependencies Pull requests that update a dependency file Python Python SDK Rust Rust related issues

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@wjones127