[dependabot]

Updates the requirements on oneio to permit the latest version.

Release notes

Sourced from oneio's releases.

v0.27.0

Added

• ONEIO_S3_MAX_CONCURRENCY - number of multipart parts uploaded in parallel (default 4, capped at 16).
• ONEIO_S3_REQUEST_TIMEOUT_SECS - per-request timeout for S3 upload requests (default 300, the previous hardcoded value).

Changed

• S3 multipart uploads now run parts in parallel, reading each part's byte range from a single open handle before uploading it. Previously parts were uploaded one at a time, so a single TCP stream set the ceiling and one stalled part blocked everything until the request timeout. Part retries, abort-on-failure and part ordering are unchanged.
• Peak memory for a multipart upload is concurrency * part_size (4 x 8 MiB with the defaults).
• Multipart parts are read from one open handle instead of reopening the path in each worker, so a file replaced at the same path mid-upload can no longer contribute bytes from two versions to a single object.

Changelog

Sourced from oneio's changelog.

v0.27.0 -- 2026-10-24

Added

• ONEIO_S3_MAX_CONCURRENCY - number of multipart parts uploaded in parallel (default 4, capped at 16).
• ONEIO_S3_REQUEST_TIMEOUT_SECS - per-request timeout for S3 upload requests (default 300, the previous hardcoded value).

Changed

• S3 multipart uploads now run parts in parallel, reading each part's byte range from a single open handle before uploading it. Previously parts were uploaded one at a time, so a single TCP stream set the ceiling and one stalled part blocked everything until the request timeout. Part retries, abort-on-failure and part ordering are unchanged.
• Peak memory for a multipart upload is concurrency * part_size (4 x 8 MiB with the defaults).
• Multipart parts are read from one open handle instead of reopening the path in each worker, so a file replaced at the same path mid-upload can no longer contribute bytes from two versions to a single object.

v0.26.1 -- 2026-09-09

Changed

• Updated suppaftp dependency from 7.0 to 12.0, addressing RUSTSEC-2026-0271 (FTP command injection via CRLF in control channel arguments). suppaftp 12 requires Rust 1.88; the MSRV is now declared as rust-version = "1.88.0".
• Updated rusty-s3 from 0.9 to 0.10 and quick-xml from 0.38 to 0.41, addressing RUSTSEC-2026-0194 and RUSTSEC-2026-0195 (quick-xml parsing denial-of-service). rusty-s3 0.10's parse_response takes &str instead of &[u8]; internal call sites updated accordingly.

Added

• CI: security audit job (cargo audit, runs on Cargo.toml/Cargo.lock changes and weekly) and MSRV check job (cargo msrv verify with all features).
• Ignored integration test against ftp.radb.net (anonymous FTP read of radb.db.gz) for manual FTP-path verification.

v0.26.0 -- 2026-08-31

Added

• oneio s3 delete (alias rm) CLI subcommand for deleting a single S3 object, mirroring the existing s3_upload/s3_delete library API

v0.25.0 -- 2026-08-11

Added

• get_resumable_http_reader (oneio::get_resumable_http_reader and OneIo::get_resumable_http_reader): an opt-in HTTP(S) reader that transparently resumes with Range requests if the connection is dropped mid-transfer, continuing from the last byte read instead of failing. Default readers (get_reader/get_reader_raw) and download are unchanged. Resumed responses are validated (Content-Range start offset, ETag and Last-Modified when the original response provided it) to avoid splicing mismatched data; a 416 Range Not Satisfiable below the declared content length is surfaced as an error rather than a silent truncation. Requests pin Accept-Encoding: identity, so resumed byte ranges always refer to the stored representation (safe to combine with the reqwest-gzip feature). Thanks @​JustinLoye (#76).

Fixed

• Removed Content-Length: 0 from default HTTP headers. This header was sent on every request including GETs, where it incorrectly declared a zero-length request body. Some servers and proxies may reject or mishandle requests with an explicit Content-Length header on bodyless methods (#82).

v0.24.2 -- 2026-07-26

... (truncated)

Commits

• 33f02e4 chore(release): prepare v0.27.0
• 7b98838 feat: upload S3 multipart parts in parallel (#87)
• ba0333b chore(release): prepare v0.26.1
• b969864 fix: update suppaftp to 12.0 and clear remaining audit advisories (#86)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)