deps: bump the deps-patches group across 1 directory with 16 updates

[dependabot]

Bumps the deps-patches group with 15 updates in the / directory:

Package	From	To
aws-config	1.10.1	1.11.0
aws-sdk-cloudwatch	1.123.0	1.127.0
aws-sdk-s3	1.141.0	1.144.0
bestool-kopia	0.5.2	0.5.3
diesel	2.3.12	2.3.13
rss	2.1.0	2.1.1
tera	2.2.0	2.3.0
syn	3.0.3	3.0.5
aws-sdk-route53	1.118.0	1.121.0
rcgen	0.14.9	0.14.10
tower-http	0.7.0	0.7.1
uuid	1.25.0	1.26.0
ipnet	2.12.1	2.12.2
bestool-postgres	1.2.0	1.2.1
algae-cli	1.1.10	1.1.11

Updates aws-config from 1.10.1 to 1.11.0

Commits

• See full diff in compare view

Updates aws-sdk-cloudwatch from 1.123.0 to 1.127.0

Commits

• See full diff in compare view

Updates aws-sdk-s3 from 1.141.0 to 1.144.0

Commits

• See full diff in compare view

Updates aws-sdk-sts from 1.110.0 to 1.113.0

Commits

• See full diff in compare view

Updates bestool-kopia from 0.5.2 to 0.5.3

Commits

• fcad74e repo: release
• f1471a2 fix(pgtune): size effective_cache_size from whole-box RAM
• 84c3e14 feat(canopy): chain follower backups and restore them as a pair (#854)
• dbbc894 follower review fixes
• 8e68018 gate the clobber on podman secrets
• 371d560 cover the podman secret round trip
• 33ce9d5 cover a secret key follower on windows
• 8cc89a4 cover the secret key follower
• 08fdfb2 Merge branch 'feat/follower-backups' into feat/tamanu-config-key-path
• fba876d repo: release
• Additional commits viewable in compare view

Updates diesel from 2.3.12 to 2.3.13

Changelog

Sourced from diesel's changelog.

[2.3.13] 2026-09-4

• Fixed interaction between then_order_by and distinct_on to reject otherwise broken SQL queries
• Fix a clippy::redundant_field_names lint warning generated by #[derive(QueryableByName)]
• MySQL and MariaDB now decode a value according to the signedness the server reports for its column, so a SMALLINT UNSIGNED holding 40000 read as Integer returns 40000 rather than -25536
• Potential stackoverflow on deeply nested JSONB values for the SQLite backend
• Fixed a possible null pointer dereference in the custom SQLite aggregate function support when SQLite fails to allocate the aggregate state
• Fixed undefined behavior in SqliteConnection::serialize_database_to_buffer when SQLite returns a null buffer for an empty deserialized database or an allocation failure. SerializedDatabase::as_slice is deprecated in favor of the new SerializedDatabase::try_as_slice, which reports the allocation failure as an error instead of panicking.
• Fixed SQLite value reads to panic instead of creating invalid slices or returning incorrect data when SQLite allocation fails. Row iteration reports a failed value duplication as an error instead.
• Fixed a use after free where reading a SQLite value in a second representation, for example a blob as text, invalidated slices another SqliteValue of the same field had returned. Such a read now works on a copy of the value.
• Fixed broken prepared statement caching for queries using positional ordering and window functions with frame offset clauses
• Fixed a potential panic while deserializing a PgInterval type from a too short buffer
• Fixed encoding floating point values without a decimal part in a roundtrip safe way in SQLite's jsonb encoding
• Fixed a potential panic while deserializing a PgInterval type from a too short buffer
• Fixed potential code injections in the generated schema.rs file caused by malicious database identifiers

Commits

• 9628f5c Fix encoding negative integers
• 3eb6cf4 Fix old serde
• d2b770f Fix compilation
• 1abf780 Merge branch 'main' into fix/rust_code_injections
• 396ea4a Merge pull request #5195 from LucaCappelletti94/fuzz-sqlite-jsonb-float-writer
• ba02e3a Merge pull request #5196 from weiznich/fix_bigdecimal_cpu_burn
• 86ae22e Merge pull request #5194 from weiznich/fix_panic_in_pg_interval
• b9e01d7 Merge pull request #5193 from weiznich/fix_query_id
• 529f0bd Merge pull request #5183 from LucaCappelletti94/sqlite-serialize-oom-safety
• 8bd540d Merge pull request #5182 from LucaCappelletti94/sqlite-value-oom-safety
• Additional commits viewable in compare view

Updates rss from 2.1.0 to 2.1.1

Release notes

Sourced from rss's releases.

2.1.1

What's Changed

• Fix image height validation to allow the spec maximum of 400 by @​dualfroz in rust-syndication/rss#194
• chore: release rss 2.1.1 by @​DCjanus in rust-syndication/rss#195

New Contributors

• @​dualfroz made their first contribution in rust-syndication/rss#194

Full Changelog: rust-syndication/rss@2.1.0...2.1.1

Changelog

Sourced from rss's changelog.

2.1.1 - 2026-09-06

• Fix image height validation to accept values up to the RSS 2.0 limit of 400 pixels. [#194](https://github.com/rust-syndication/rss/issues/194)

Commits

• 21ffc2f chore: release rss 2.1.1
• 6dfc218 fix(validation): allow image height up to 400 pixels
• See full diff in compare view

Updates tera from 2.2.0 to 2.3.0

Changelog

Sourced from tera's changelog.

2.3.0 (2026-08-26)

• Add State::{escape,autoescaping_enabled,escape_if_needed}
• Add StringInput to use for input/parameters that is safety aware and use it for built-in filters: this means you should need less | safe and that string safety is passed around correctly. Safety is dropped by filters where the changes depend on the content itself (truncate can cut anywhere) and preserved when they specify exactly what changes (trim, replace).
• Add escape filter that is safety aware (it will not escape an already safe string) and uses the current instance escape function
• Escaping included templates is now done base on where it's included rather than the included template itself: for example a .txt included in a .html will now be autoescaped if Tera autoescapes on .html.
• Fix double escape of filter/set blocks

Commits

• 32c5669 Bump things
• a0d9ad6 Add back locale to date filter (#1026)
• 93a4704 Escaping (#1024)
• dce5070 stop pre-sizing vecs in state
• b7a28b3 DRY writing values in interpreter with fast path for strings
• a460e07 Mention ignore missing in migration
• 747136e Mention jiff format link in migration
• 1c9848a Avoid huge dump in the terminal on sort/group_by error (#1023)
• cd9c2dd Expose escape fn on State (#1019)
• See full diff in compare view

Updates syn from 3.0.3 to 3.0.5

Release notes

Sourced from syn's releases.

3.0.5

• Report correct span for lex errors from LitStr::parse_with (#2080, thanks @​sunshowers)

3.0.4

• Allow safe fn in impl Parse for ForeignItemFn (#2078)

Commits

• e0ad92d Release 3.0.5
• 74e7d75 Merge pull request #2080 from sunshowers/lit-str-span
• 4c264f3 In LitStr::parse_with, report correct span for lex errors
• 7e2b27b Update test suite to nightly-2026-08-26
• b5d62a6 Release 3.0.4
• abf019c Merge pull request #2078 from dtolnay/foreginitemfn
• d454333 Allow safe fn in impl Parse for ForeignItemFn
• 8011b1c Update test suite to nightly-2026-08-18
• 56a8d83 Raise rayon thread size for tests
• f2c5c50 Ignore assert_is_empty pedantic clippy lint
• Additional commits viewable in compare view

Updates aws-sdk-route53 from 1.118.0 to 1.121.0

Commits

• See full diff in compare view

Updates rcgen from 0.14.9 to 0.14.10

Release notes

Sourced from rcgen's releases.

0.14.10

What's Changed

• Spec compliance bug fixes by @​cpu in rustls/rcgen#445
• Take advantage of stable ML-DSA in aws-lc-rs by @​djc in rustls/rcgen#447

Commits

• f4a3b16 Bump version to 0.14.10
• dea3d4d Upgrade to botan 0.13
• 788b093 Upgrade to pem 4
• 7ce21f4 Take advantage of stable ML-DSA in aws-lc-rs
• e2dba45 Remove unused RSASSA-PSS signature algorithm
• 37070de Omit reasonCode unspecified(0) from CRL entry extensions
• b247a87 Write extensions for certs that only set KeyUsage or CRLDP
• 85eafdd Reject empty CRL distribution point URIs
• 3a99b50 Encode CRL invalidityDate as GeneralizedTime
• See full diff in compare view

Updates tower-http from 0.7.0 to 0.7.1

Release notes

Sourced from tower-http's releases.

tower-http-0.7.1

Added

• fs: add ServeDir::redirect_to_trailing_slash() to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default (#728)
• fs: add ignore_multi_range_requests() to ServeDir and ServeFile, serving the full representation when a request asks for multiple byte ranges. The existing 416 Range Not Satisfiable response remains the default (#727)
• request-id: the constructors and accessors on the request-id layers, services, and RequestId are now const fn, so they can be used in const context (#716)

Changed

• fs: the minimum http-range-header requirement is now 0.4.2 (#661)

Fixed

• behavioral change: fs: make ServeDir::try_call propagate expected filesystem I/O errors when no fallback is configured, as documented, instead of converting them to 404 Not Found responses (#718)
• decompression: don't end the body when a data frame with no remaining bytes arrives after the decompressor reports end-of-stream. Trailers following such a frame were dropped and could not be recovered (#722)
• decompression: return a body error when a data frame with remaining bytes arrives after the decompressor reports end-of-stream, rather than silently truncating. This regressed in 0.7.0 (#712)
• fs: multipart range requests are now rejected before range validation, so they consistently return 416 Range Not Satisfiable with a Cannot serve multipart range requests body instead of a generic unsatisfiable-range response (#661)
• fs: range error responses no longer carry representation headers such as Content-Type and Content-Encoding (#727)
• set-header: SetMultipleResponseHeadersLayer and SetMultipleResponseHeader are now Clone regardless of the response body type, matching the fix applied to the request-side types in 0.7.0 (#714)

#661: tower-rs/tower-http#661 #712: tower-rs/tower-http#712 #714: tower-rs/tower-http#714 #716: tower-rs/tower-http#716 #718: tower-rs/tower-http#718 #722: tower-rs/tower-http#722 #727: tower-rs/tower-http#727 #728: tower-rs/tower-http#728

All the changes

• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in tower-rs/tower-http#708
• fix(compression): reject non-empty data frames after codec is EOF by @​seanmonstar in tower-rs/tower-http#712
• Remove Clone derivations from SetMultipleResponseHeader* types by @​skeet70 in tower-rs/tower-http#714
• feat(request-id): Allow request-id constructor in const context by @​tottoto in tower-rs/tower-http#716
• fs: Avoid unnecessary conversions between SystemTime and HttpDate by @​tottoto in tower-rs/tower-http#717
• fs: Use HeaderValue::is_empty to check for empty values by @​tottoto in tower-rs/tower-http#720
• fs: Use HeaderValue::to_str for date headers by @​tottoto in tower-rs/tower-http#721

... (truncated)

Commits

• c941451 chore(release): prepare 0.7.1 (#729)
• 9697702 chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 (#730)
• e2582e2 Allow ignoring multi-range requests (#727)
• 888f7fe feat(services): configure directory redirects (#728)
• 5ad7654 chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 (#726)
• d154adb fix: reject multipart ranges before validation (#661)
• d9e5c8a ci: Update to cargo-check-external-types 0.5.0 (#724)
• 90c072b Propagate ServeDir::try_call I/O errors (#718)
• 860922e fix(decompression): don't end the body on an empty data frame (#722)
• 8532252 docs(example)/custom future with multiple bodies (#711)
• Additional commits viewable in compare view

Updates uuid from 1.25.0 to 1.26.0

Release notes

Sourced from uuid's releases.

v1.26.0

What's Changed

• Add ContextV7::with_additional_precision_bits by @​ChrisJr404 in uuid-rs/uuid#904
• Prepare for 1.26.0 release by @​KodrAus in uuid-rs/uuid#905

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

Commits

• cdc96a8 Merge pull request #905 from uuid-rs/cargo/v1.26.0
• 34e4f49 don't test macros under miri
• d9e7242 update nightly used for miri
• ec16819 prepare for 1.26.0 release
• 162cd20 Merge pull request #904 from ChrisJr404/v7-additional-precision-bits
• 97eceff Add ContextV7::with_additional_precision_bits for microsecond clocks
• See full diff in compare view

Updates ipnet from 2.12.1 to 2.12.2

Changelog

Sourced from ipnet's changelog.

Version 2.12.2

• Fixes bug with IpNet::aggregate() where if a network containing u32::MAX-1 or u128::MAX-1 is provided, then u32::MAX and u128::MAX respectively are always included in the output. See issue #71.

Commits

• See full diff in compare view

Updates bestool-postgres from 1.2.0 to 1.2.1

Commits

• fcad74e repo: release
• f1471a2 fix(pgtune): size effective_cache_size from whole-box RAM
• 84c3e14 feat(canopy): chain follower backups and restore them as a pair (#854)
• dbbc894 follower review fixes
• 8e68018 gate the clobber on podman secrets
• 371d560 cover the podman secret round trip
• 33ce9d5 cover a secret key follower on windows
• 8cc89a4 cover the secret key follower
• 08fdfb2 Merge branch 'feat/follower-backups' into feat/tamanu-config-key-path
• fba876d repo: release
• Additional commits viewable in compare view

Updates algae-cli from 1.1.10 to 1.1.11

Commits

• 1fd662b repo: release
• bd0f123 fix(alertd): grade only the live cert per name in caddy_certs (#837)
• ef7b78a fix(alertd): skip http_errors when caddy isn't counting requests
• fd8893a fix(alertd): grade only the live cert per name in caddy_certs
• 7250733 repo: release
• fb7010a feat(kopia): cap the cache budget at half the volume's free space
• 6d6de13 refactor(kopia): take the cache budget override from the caller
• c3ac8a7 feat(kopia): size the cache budget as a share of its volume
• 022b79b feat(kopia): bound the local cache on every repository connect
• 89208b0 repo: release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions