aws-config and aws-sdk-s3 use default-features = false, keeping default-https-client. That drops the legacy rustls 0.21 / hyper 0.14 / h2 0.3 client. cargo update moves tokio off the yanked 1.54.0. deny.toml and a prek hook run cargo deny check advisories sources. Needed #223 merged first for a green test run; it has merged.
cargo audit: before, 10 vulnerabilities (rustls 0.21, rustls-webpki 0.101, h2 0.3, tokio 1.54.0, crypto-bigint). After, 2: RUSTSEC-2026-0387 in crypto-bigint 0.4.9 and 0.5.5, both through the AWS SDK, with no fix yet.
Verified on 928d13b: cargo test --features aws --locked 174 passed, clippy -D warnings clean, cargo-deny ok, docker build . succeeds.
🤖 Generated with Claude Code