fix(deps): upgrade to Rust 1.99.1 and bump dependencies

Cargo.toml

@@ -22,7 +22,7 @@ geo-traits = { version = "0.3.0", default-features = false }
 geojson = "1.0.0"
 indicatif = { version = "0.18.4", default-features = false }
 log = { version = "0.4.32", default-features = false, features = ["kv"] }
-lru = { version = "0.18.0", default-features = false }
+lru = { version = "0.19.0", default-features = false }
 lz4_flex = "0.14.0"
 memmap2 = "0.9.10"
 once_cell = "1.21.4"
@@ -42,12 +42,12 @@ reqwest = { version = "0.13.4", default-features = false, features = ["http2", "
 rmp-serde = { version = "1.3.1", default-features = false }
 rustls = { version = "0.23.40", default-features = false, features = ["aws_lc_rs"] }
 s2 = "0.2.0"
-s3 = { version = "0.1.36", default-features = false, features = ["blocking", "multipart", "rustls"] }
+s3 = { version = "0.1.38", default-features = false, features = ["blocking", "multipart", "rustls"] }
 serde = "1.0.228"
 serde_json = { version = "1.0.150", default-features = false, features = ["std"] }
 tempfile = "3.27.0"
 time = { version = "0.3.53", default-features = false, features = ["formatting", "parsing", "std"] }
-tokio = { version = "1.52.3", default-features = false }
+tokio = { version = "1.54.1", default-features = false, features = ["fs", "io-util", "macros", "net", "rt-multi-thread", "time"] }
 unicode-normalization = "0.1.26"
 uuid = { version = "1.24.0", default-features = false, features = ["v4", "v5"] }
 webpki-roots = "1.0.6"

deny.toml

@@ -16,39 +16,13 @@ all-features = true
 [advisories]
 yanked = "deny"
 ignore = [
-  # quick-xml 0.40.1, pulled in transitively via the `s3` crate (our
-  # S3-compatible upload client), is affected by two DoS advisories in its
-  # XML attribute/namespace handling. Both only matter for untrusted input;
-  # `s3` uses quick-xml solely to parse XML *responses from the S3 endpoint
-  # we're uploading to*, not attacker-controlled input, so this isn't
-  # exploitable in how osmdiffs uses it. Fix is upstream in `s3`, not
-  # something we can patch here (no git/path deps -- see docs/CONTRIBUTING.md
-  # on why): https://github.com/lvillis/s3-rs/pull/15 bumps it to >=0.41.0.
-  # Re-run `cargo deny check advisories` after that merges and a new `s3`
-  # release picks it up, then drop these two lines.
-  "RUSTSEC-2026-0194", # quadratic run time checking duplicate attribute names
-  "RUSTSEC-2026-0195", # unbounded namespace-declaration allocation (OOM)
   # atomic-polyfill is unmaintained, not vulnerable. It comes in via
   # phonenumber -> postcard -> heapless 0.7, which only uses it on targets
   # without native atomics, so it is never built for the x86_64 and aarch64
   # targets we ship (`cargo tree -i atomic-polyfill` prints nothing there;
   # only `--target all` shows it). Drop this line once postcard moves to
   # heapless 0.8, or phonenumber stops using postcard.
   "RUSTSEC-2023-0089",
-  # zstd 0.13.3 / zstd-safe 7.3.0 come in via s3 -> reqx 0.1.41, which uses
-  # zstd only to decode `Content-Encoding: zstd` HTTP responses from the S3
-  # endpoint, through `zstd::stream::read::Decoder::new`. None of these three
-  # advisories reach that path: 0391 needs `with_context` with a reused
-  # context, 0398 needs the `seekable` feature (not enabled), and 0403 only
-  # affects `zstd::stream::write::Decoder` (the advisory says the read decoder
-  # is not affected). The fixed releases are zstd >=0.14.3 / zstd-safe >=8.2.0,
-  # which reqx 0.1.x can't use; s3 0.1.38 moves to reqx 0.2 but needs Rust
-  # 1.99.1 (we pin 1.96.0 in rust-toolchain.toml). Our direct zstd use, via
-  # parquet, is already on the fixed versions. Drop these three lines once s3
-  # is upgraded.
-  "RUSTSEC-2026-0391", # abandoned stream data leaks into the next stream
-  "RUSTSEC-2026-0398", # Seekable::decompress sets Vec length past capacity
-  "RUSTSEC-2026-0403", # uninitialized memory on failed legacy-frame streaming
 ]
 
 # ── licenses: only accept licenses we've reviewed as OK to redistribute ─────
@@ -66,7 +40,6 @@ allow = [
   "ISC",
   "MIT",
   "MIT-0",
-  "MPL-2.0", # weak/file-level copyleft only (`option-ext`, via `dirs`); fine to redistribute as-is in a binary
   "Unicode-3.0",
   "Unlicense",
   "Zlib",

rust-toolchain.toml

@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.96.0"
+channel = "1.99.1"
 components = [ "cargo", "clippy", "llvm-tools", "rust-std", "rustc", "rustfmt" ]

src/matchers/mod.rs

@@ -357,12 +357,12 @@ impl<'a> OsmCandidate<'a> {
     /// `StringPool` indices -- into `(key, value)` string pairs. Cheap: a
     /// handful of string-pool lookups.
     pub fn tags(&self) -> impl Iterator<Item = (&'a str, &'a str)> + '_ {
-        self.feature.tags.chunks_exact(2).map(move |kv| {
-            (
-                self.strings.get(kv[0] as usize),
-                self.strings.get(kv[1] as usize),
-            )
-        })
+        self.feature
+            .tags
+            .as_chunks::<2>()
+            .0
+            .iter()
+            .map(move |[k, v]| (self.strings.get(*k as usize), self.strings.get(*v as usize)))
     }
 
     /// Decodes `feature.geometry_wkb` into a `geo::Geometry`. Not cheap

src/pipeline/conflate/writer.rs

@@ -680,11 +680,13 @@ impl ParquetRow {
             osm_modified_version = NonZeroU32::new(feature.version);
             osm_tags = feature
                 .tags
-                .chunks_exact(2)
-                .map(|kv| {
+                .as_chunks::<2>()
+                .0
+                .iter()
+                .map(|[k, v]| {
                     (
-                        osm_strings.get(kv[0] as usize).to_owned(),
-                        osm_strings.get(kv[1] as usize).to_owned(),
+                        osm_strings.get(*k as usize).to_owned(),
+                        osm_strings.get(*v as usize).to_owned(),
                     )
                 })
                 .collect();

src/pipeline/osm/assemble.rs

@@ -905,9 +905,11 @@ fn relation_type_tag<'a>(tags: impl Iterator<Item = (&'a str, &'a str)>) -> Opti
 /// the time [`assemble_super_relations`] runs has already gone through
 /// [`assemble_tags`] once, in [`assemble_leaf_relations`]).
 fn relation_type_from_feature_tags<'a>(tags: &[u32], strings: &'a StringPool) -> Option<&'a str> {
-    tags.chunks_exact(2)
-        .find(|pair| strings.get(pair[0] as usize) == "type")
-        .map(|pair| strings.get(pair[1] as usize))
+    tags.as_chunks::<2>()
+        .0
+        .iter()
+        .find(|[k, _]| strings.get(*k as usize) == "type")
+        .map(|[_, v]| strings.get(*v as usize))
 }
 
 /// OSM documents `type=multipolygon` and `type=boundary` relations as

src/pipeline/osm_views.rs

@@ -126,8 +126,10 @@ impl OsmViewsQuantiles {
             bail!("{} is truncated", path.display());
         }
         let sorted = body
-            .chunks_exact(4)
-            .map(|c| f32::from_le_bytes([c[0], c[1], c[2], c[3]]))
+            .as_chunks::<4>()
+            .0
+            .iter()
+            .map(|c| f32::from_le_bytes(*c))
             .collect();
         Ok(OsmViewsQuantiles { sorted })
     }

src/pipeline/wikidata_ids.rs

@@ -123,9 +123,11 @@ fn collect_from_osm(osm: &OsmFeatures, progress: &MultiProgress) -> Result<Vec<u
             let feature = osm.index.get_feature(r)?;
             let ids: Vec<u64> = feature
                 .tags
-                .chunks_exact(2)
-                .filter(|kv| key_ids.contains(&kv[0]))
-                .flat_map(|kv| parse_wikidata_ids(osm.strings.get(kv[1] as usize)))
+                .as_chunks::<2>()
+                .0
+                .iter()
+                .filter(|[k, _]| key_ids.contains(k))
+                .flat_map(|[_, v]| parse_wikidata_ids(osm.strings.get(*v as usize)))
                 .collect();
             Ok::<_, anyhow::Error>(ids)
         })