[dependabot]

Bumps the cargo group with 8 updates in the /rs-cli directory:

Package	From	To
tokio	1.53.3	1.54.1
aws-config	1.12.0	1.13.0
aws-sdk-s3	1.146.1	1.155.0
aws-sdk-lambdamicrovms	1.8.0	1.16.0
aws-sdk-cloudformation	1.125.0	1.134.0
aws-sdk-sts	1.114.0	1.124.0
zip	9.0.5	9.1.2
webbrowser	1.2.4	1.2.5

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates aws-config from 1.12.0 to 1.13.0

Commits

• See full diff in compare view

Updates aws-sdk-s3 from 1.146.1 to 1.155.0

Commits

• See full diff in compare view

Updates aws-sdk-lambdamicrovms from 1.8.0 to 1.16.0

Commits

• See full diff in compare view

Updates aws-sdk-cloudformation from 1.125.0 to 1.134.0

Commits

• See full diff in compare view

Updates aws-sdk-sts from 1.114.0 to 1.124.0

Commits

• See full diff in compare view

Updates zip from 9.0.5 to 9.1.2

Release notes

Sourced from zip's releases.

v9.1.1

🐛 Bug Fixes

• store the raw count instead of a bool (#1174)
• preserve extra fields in raw_copy_file_touch (#1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

v9.1.0

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)
• Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)
• target lzma-rust2 v0.23 (#1096)

Bench

• add Criterion benchmarks (#754)
• add deflate_many_small_files bench for #633 (#964)

Changelog

Sourced from zip's changelog.

9.1.2 - 2026-10-26

🐛 Bug Fixes

• preserve the file kind (normal/directory/symlink) in raw_copy_file_touch (#1179)
• (write) reject a Unicode Path extra field that would rename the entry (#1177)
• (extract) prevent following symbolic links during file creation (#1116)

9.1.1 - 2026-10-25

🐛 Bug Fixes

• store the raw count instead of a bool (#1174)
• preserve extra fields in raw_copy_file_touch (#1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

9.1.0 - 2026-10-24

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)
• Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)

... (truncated)

Commits

• 662ae13 chore: release v9.1.2 (#1176)
• e221cd0 fix: preserve the file kind (normal/directory/symlink) in raw_copy_file_touch...
• 525d81e fix(write): reject a Unicode Path extra field that would rename the entry (#1...
• dcc28ed ci(fuzz): Fixes for fallback when Rust nightly is updated mid-run (#1178)
• 68e7e84 fix(extract): prevent following symbolic links during file creation (#1116)
• b7201ce chore: release v9.1.1 (#1173)
• 67b3e52 fix: store the raw count instead of a bool (#1174)
• 9d710d3 ci: Share cargo-afl build across workflows (#1167)
• d6c0278 fix: preserve extra fields in raw_copy_file_touch (#1172)
• c3232c4 test: cover unreserved validation for prepared files (#1169)
• Additional commits viewable in compare view

Updates webbrowser from 1.2.4 to 1.2.5

Release notes

Sourced from webbrowser's releases.

v1.2.5

Fixed

• Windows: use raw-dylib for shlwapi to fix GNU/LLD linking. See #123

Changelog

Sourced from webbrowser's changelog.

[1.2.5] - 2026-10-22

Fixed

• Windows: use raw-dylib for shlwapi to fix GNU/LLD linking. See #123

Commits

• 278ec1b Release v1.2.5
• 19127fc Merge branch 'tasnimjabir-fix/windows-raw-dylib'. See PR #123
• da8736f Fix i686 GNU CI runtime setup
• 98ab38b fix build
• 96d1973 Fix Windows GNU linking with raw-dylib
• See full diff in compare view