[dependabot]

Bumps the rust group with 2 updates in the / directory: aws-credential-types and aws-sigv4.

Updates aws-credential-types from 1.3.0 to 1.3.1

Commits

• See full diff in compare view

Updates aws-sigv4 from 1.6.0 to 1.6.3

Changelog

Sourced from aws-sigv4's changelog.

October 21st, 2026

New this release:

• 🎉 (all) Add an opt-in structure-prefix callback to schema-based CBOR serialization. The callback receives the value's schema and can write fields before modeled members, enabling RPC v2 CBOR error discriminators while retaining member names.

  Add opt-in definite-length encoding for lists and maps with known lengths, plus integer-list serialization that matches ordinary integer writes. ShapeSerializer provides default length-aware methods that delegate to existing implementations, so other codecs preserve their behavior.

• 🐛 (all, smithy-rs#4924) Enforce the event stream protocol's header value length limit when encoding messages. String and byte array header values longer than 32,767 bytes are now rejected instead of encoded. aws_sigv4::event_stream::sign_message now returns an error instead of panicking when a message cannot be encoded.

October 20th, 2026

New this release:

• 🐛 (client, smithy-rs#4921) Validate @hostLabel members are valid host labels. A @hostLabel value goes straight into the request authority, checked only by http::uri::Authority::from_str against the whole expanded prefix. That parser accepts a colon, and http::Uri then reads everything after it as an unparseable port and discards it. A label containing a colon therefore truncates the resolved host and drops the service suffix.

  The generated code now runs each host label through is_valid_host_label before building the prefix. Accepted labels narrow to [a-zA-Z0-9-]{1,63}. A value holding _ or . used to pass and now fails.

October 19th, 2026

Breaking Changes:

• ⚠️🎉 (server, smithy-rs#4887, @​jeffzha) Add MetricsPool support to aws-smithy-http-server-metrics. The metrics layer now stores a SmithyMetricsPool producer handle in the request extensions. Independently-owned middleware and libraries that cannot name the service's metrics entry type can pull it out and contribute heterogeneous child metrics that flatten into the single per-request entry when the request finishes. Structs annotated with #[smithy_metrics] gain the backing pool automatically through a single hidden flattened field.

  This is a breaking change on two fronts.

  #[smithy_metrics] now injects a hidden __smithy_metrics field, so existing explicit struct literals no longer compile and __smithy_metrics is reserved as a field name. Construct these structs with ..Default::default() (or Default::default()) instead of naming every field:

  #[smithy_metrics]
  #[metrics]

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions