[dependabot]

Bumps object_store from 0.13.2 to 0.14.2.

Release notes

Sourced from object_store's releases.

object_store v0.14.2

Changelog

v0.14.2 (2026-09-11)

Full Changelog

Implemented enhancements:

• Implement Clone for MicrosoftAzure #824
• Support URLs for jurisdiction-restricted buckets on R2 #814
• Lightweight DNS cache with shuffle to prevent DNS flooding #726
• Allow presigning object_store multipart uploads #271
• Allow specifying Content-Type when signing object_store PUT requests #270

Fixed bugs:

• Incomplete ASF license header in src/client/s3.rs (caused -1 vote on 0.14.2 RC1) #853
• WriteMultipart::finish should abort after part upload failure #818
• The 1.85 MSRV is inaccurate with all features #811
• When the backend service returns an HTTP 500, the object store panics #414

Documentation updates:

• Docs: point users uploading large objects at the multipart API #839 (alamb)
• [object-store]: update release schedule #834 (alamb)
• Add doc example for multipart upload to GoogleCloudStorage::create_multipart #803 (alamb)
• Add doc example for multipart upload to MicrosoftAzure::create_multipart #802 (alamb)
• Add doc example for multipart upload to AmazonS3::create_multipart #801 (alamb)

Closed issues:

... (truncated)

Changelog

Sourced from object_store's changelog.

Historical Changelog

v0.14.1 (2026-07-10)

Full Changelog

Implemented enhancements:

• Cache Azure user delegation key for SAS signing #800
• Add deregister to ObjectStoreRegistry #795
• Support for S3 dual-stack endpoints #779
• Coalesce contiguous ranges in LocalFileSystem::get_ranges #778
• Support for HF Storage Buckets #706

Fixed bugs:

• Clippy failing on main #798
• Upgrade quick-xml to resolve RUSTSEC-2026-0194 and RUSTSEC-2026-0195 #786
• InMemory and LocalFileSystem return unquoted ETags, violating RFC 9110 #769

Closed issues:

• Bump quick-xml to 0.41.0 for RustSec advisories #787

Merged pull requests:

• Pin Rust toolchain to 1.97.0 and fix clippy #799 (alamb)
• chore: reduce lock hold time in DefaultObjectStoreRegistry::deregister #792 (kszucs)
• Do not explicitly add Host header when making requests with S3Builder #790 (ntjohnson1)
• impl HttpError::new_boxed to provide user with ability to ctor from already boxed error #789 (DoumanAsh)
• build(deps): update quick-xml requirement from 0.40.1 to 0.41.0 #785 (dependabot[bot])

... (truncated)

Commits

• 279572e Update CHANGELOG for latest main (#855)
• 4ff7d04 Restore missing first line of ASF license header in src/client/s3.rs (#854)
• 25fa079 Update version to 0.14.2 and add CHANGELOG (#850)
• c37db72 feat: retry failed multipart part uploads (#849)
• 135984f Add doc hints pointing large-object uploads at the multipart API (#839)
• b07471e [object-store]: update release schedule (#834)
• 978fb48 Fix MSRV violation in parse.rs test, check --all-targets in MSRV CI (#837)
• e2a4934 Speed up MSRV CI check by installing cargo-msrv via taiki-e/install-action (#...
• e28807d feat: presigned URLs with extra query params and signed headers (SignedUrlOpt...
• 5c74363 Restore UnwindSafe/RefUnwindSafe on ClientOptions by bounding DnsResolver (#836)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[lidavidm]

We can't do this until Datafusion itself upgrades.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.