Releases

1. ▸▾0.40.04 Oct 2026

   Nothing published for this version

2. ▸▾0.39.19 Dec 2025

   Nothing published for this version

3. ▸▾0.39.016 Sept 2025

   Nothing published for this version

4. ▸▾0.38.030 Aug 20242 sources agree

   This release updates the companion crates to aws-creds 0.40.0 and aws-region 0.29.0.

   Release notes

   rust-s3 0.38.0

   This release updates the companion crates to aws-creds 0.40.0 and
   aws-region 0.29.0.

   Highlights

   • Added bucket policy get, put, and delete operations.
   • Added AWS region identifiers, including newer AWS regions, and the
     tokio-rustls-tls-ring feature for using rustls with its Ring crypto
     provider.
   • Improved credential-provider support and refresh for web identity, ECS
     container credentials, and EKS Pod Identity. Credential secrets are redacted
     from Debug output.
   • Made streamed multipart uploads configurable with a per-upload concurrency
     limit, preserved per-call headers, and added best-effort aborts for failed
     uploads.
   • Improved request reliability with operation-aware retries, request deadlines,
     bounded async downloads, corrected custom-endpoint authorities and encoded
     query signing, and detection of S3 errors returned inside successful XML
     responses.
   • Avoided stale connection reuse in the async-std HTTP/1 transport by disabling
     keep-alive; this can increase connection setup overhead. The Hyper transport
     continues to reuse pooled connections.
   • Corrected multipart-upload pagination to carry both S3 markers and fixed
     bodyless request signing for S3-compatible providers.
   • Updated XML parsing to quick-xml 0.41, which removes the quick-xml advisories
     identified in the prior dependency audit.

   S3-compatible request signing

   Fixed generated Content-Length and Content-Type headers entering signatures
   for bodyless requests, including ranged GET and DELETE operations. This resolves
   signature mismatches on providers such as Cloudflare R2. Multipart initiation
   retains the headers needed by Google Cloud Storage, and requests with bodies
   retain their content headers. The fix is included in this release via
   6c97cb9.

   Thanks to the contributors who investigated this issue and proposed fixes:

   • Piero Molino (@w4nderlust) —
     #452, covering ranged GET signing,
     broader body-header handling, and the GCS multipart-initiation exception.
   • Mohamed Dardouri (@dardourimohamed) —
     #459, addressing ranged GET headers.
   • Roman Oswald (@r-oswald) —
     #465, addressing DeleteObject headers.
   • Eldon Pinheiro (@eldon-databanx) —
     #467, covering bodyless DELETE
     operations and strict signature validation.

   Their contributions are acknowledged here because the fixes were consolidated
   in the audit work rather than merging these PRs separately.

   Streamed multipart upload headers

   Preserved per-call headers across streamed multipart uploads, routing them to
   the requests where S3-compatible services expect them. Thanks to
   @mfroembgen for PR
   #471 and its focused regression
   coverage.

   Migration notes

   • Credentials now contains private refresh-source metadata. External struct
     literals must use a constructor. Manually constructed or deserialized
     credentials, and credentials made from a directly supplied OIDC token, do not
     retain a refresh source; refreshing expired credentials in these cases
     returns CredentialsError::NoRefreshSource. Token-file, container, and
     instance-metadata credentials retain their provider refresh behavior. The
     serialized five-field credential format is unchanged. Add handling for the
     new NoRefreshSource variant if you exhaustively match CredentialsError.
   • aws-region adds variants to its public exhaustive Region enum. Downstream
     exhaustive matches must handle the added regions.
   • Multipart-upload listing now carries the key marker and upload-ID marker.
     Command::ListMultipartUploads and ListMultipartUploadsResult have new
     marker fields, and Bucket::list_multiparts_uploads_page takes an additional
     upload_id_marker argument. Update code constructing or destructuring these
     public types or calling that method. Services that omit an upload-ID marker
     can continue with the returned key marker alone.
   • The public Command enum adds GetBucketPolicy, PutBucketPolicy, and
     DeleteBucketPolicy; update exhaustive matches accordingly.
   • The quick-xml update changes the concrete quick-xml error payload types in
     CredentialsError::SerdeXml, S3Error::SerdeXml, and
     S3Error::XmlSeError. Rust considers types from different quick-xml versions
     distinct, so code that constructs or annotates these payloads may need to
     update its dependency and type references.

   Dependency advisory status

   A dependency audit still reports advisories in legacy optional async-std
   transport dependency branches. The audit did not establish whether those
   findings are reachable or exploitable; this release is not a clean security
   assessment.

• rust-s3crates.ioRust library for working with AWS S3 and compatible object storage APIs
• aws-regioncrates.ioTiny Rust library for working with Amazon AWS regions, supports `s3` crate