[reatang]

Related issue

Fixes the Dependency Advisories failure that every open PR currently hits: RUSTSEC-2026-0441 marks pin-utils as unmaintained (upstream archived on 2026-10-01).

Background

pin-utils 0.1.1 is not a direct dependency. It came in through:

• aws-smithy-http 0.63, aws-smithy-runtime 1.11, aws-smithy-types 1.5 (via aws-sdk-s3 / aws-config)
• our direct aws-smithy-checksums 0.64 dependency in rc-s3

The smithy releases that replace it with pin-project-lite are aws-smithy-types 1.9.0, aws-smithy-runtime 1.16.1, and aws-smithy-http 0.64.2. All of them declare rust-version = 1.94.1. With rust-version = "1.92", the MSRV-aware resolver kept the lockfile on the last 1.92-compatible releases, so cargo update alone could not drop the crate.

An alternative was to add RUSTSEC-2026-0441 to deny.toml's ignore list. That keeps the unmaintained crate and weakens the gate, so this PR removes the dependency instead.

Solution

• Raise rust-version from 1.92 to 1.99.0, matching the RustFS server (rust-version = "1.99.0", stable toolchain).
• Refresh the AWS SDK lockfile entries (aws-sdk-s3 1.137 -> 1.157, aws-config 1.8 -> 1.13, smithy crates to the releases above). No other crates were bulk-updated.
• Move the direct aws-smithy-checksums dependency from 0.64.8 to 0.65.1. payload_checksum.rs uses it to select the same checksum as the SDK, so it should track the SDK's version; leaving it on 0.64 would also keep pin-utils and a second copy of aws-smithy-http.
• Update the CI MSRV job (1.99.0), the Docker builder image (rust:1.99.1-alpine3.23), and the README requirement.

Impact: building rc from source now needs Rust 1.99 or newer. Released binaries and images are unaffected. No CLI, JSON output, or config contract changes.

Tests

• cargo tree -i pin-utils no longer matches any package; cargo tree -d shows no duplicate aws-* crates.
• cargo deny --all-features check advisories: ok. bans and sources: ok.
• cargo fmt --all --check and cargo clippy --workspace --all-targets -- -D warnings: pass.
• cargo test --workspace: 1988 passed, 0 failed.
• cargo +1.99.0 build --workspace: pass.
• The SDK moves 20 minor versions; local unit tests pass, but transfer and checksum behavior against a live server is left to the RustFS smoke jobs in CI.