build(deps): update oneio requirement from 0.23 to 0.24

[dependabot]

Updates the requirements on oneio to permit the latest version.

Release notes

Sourced from oneio's releases.

v0.24.2

Fixed

• S3 multipart upload now retries individual parts on transient transport errors (connection reset, timeout) with exponential backoff. Previously, a single transient failure on any part aborted the entire upload, wasting all successfully uploaded parts. This caused large file backups (~1 GB) to fail intermittently on constrained network paths such as Railway to Cloudflare R2.
• Added a 300-second per-request timeout to S3 upload operations (previously only connect timeout was set).

Added

• ONEIO_S3_MAX_RETRIES environment variable to configure retry attempts after the initial request for transient S3 transport errors (default: 3).
• ONEIO_S3_RETRY_BACKOFF_MS environment variable to configure initial retry backoff in milliseconds (default: 1000, doubles each attempt).

Changelog

Sourced from oneio's changelog.

v0.24.2 -- 2026-07-26

Fixed

• S3 multipart upload now retries individual parts on transient transport errors (connection reset, timeout) with exponential backoff. Previously, a single transient failure on any part aborted the entire upload, wasting all successfully uploaded parts. This caused large file backups (~1 GB) to fail intermittently on constrained network paths such as Railway to Cloudflare R2.
• Added a 300-second per-request timeout to S3 upload operations (previously only connect timeout was set).

Added

• ONEIO_S3_MAX_RETRIES environment variable to configure retry attempts after the initial request for transient S3 transport errors (default: 3).
• ONEIO_S3_RETRY_BACKOFF_MS environment variable to configure initial retry backoff in milliseconds (default: 1000, doubles each attempt).

v0.24.1 -- 2026-07-23

Fixed

• CLI no longer buffers multi-GB single-line files into memory before output. Default mode now streams decompressed bytes directly to stdout via io::copy instead of line-by-line reading. --stats mode uses byte-chunk scanning to count lines and characters without building full-line String allocations.
  • Behavior change: the default mode now outputs raw decompressed bytes with no UTF-8 decoding or line-based rewriting. This means --strict-utf8 has no effect outside --stats mode (it issues a warning and continues), and files without a trailing newline are no longer rewritten to add one.

v0.24.0 -- 2026-07-22

Bug fixes

• Preserve leading-slash S3 object keys when using path-style endpoints such as Cloudflare R2.

Added

• Re-exported reqwest as oneio::reqwest (under the http feature) so downstream crates can name HTTP types (StatusCode, header, blocking::Response) without declaring their own reqwest dependency and risking version skew. Note: this makes reqwest part of oneio's public API contract; a reqwest major-version bump is a breaking oneio change.
• New opt-in reqwest-gzip feature: advertises Accept-Encoding: gzip and transparently decodes Content-Encoding: gzip responses (e.g. ~97 MB to ~4.6 MB for rpki.cloudflare.com/rpki.json). Distinct from the gz family, which is URL-suffix-based file decompression. Off by default; no dependency-tree change unless enabled.

v0.23.0 -- 2026-05-12

Added

• OneIo::to_lines_lossy — lossy line iterator from any Box<dyn Read + Send>
• read_lines_lossy / OneIo::read_lines_lossy — line iteration with invalid UTF-8 replaced by U+FFFD
• read_to_string_lossy / OneIo::read_to_string_lossy / read_to_string_lossy_async — full-file read with lossy UTF-8
• read_to_bytes / OneIo::read_to_bytes / read_to_bytes_async — byte-perfect read without UTF-8 validation
• --strict-utf8 CLI flag for strict UTF-8 validation in the CLI

Changed

• CLI now defaults to lossy UTF-8 reading; no longer exits on invalid byte sequences
• Documentation examples updated to use lossy APIs

Deprecated

• read_lines — use read_lines_lossy for lossy text, read_to_bytes for byte-perfect whole-file reads, or get_reader + BufReader for streaming byte processing
• read_to_string — use read_to_string_lossy or read_to_bytes
• read_to_string_async — use read_to_string_lossy_async or read_to_bytes_async

v0.22.0 -- 2026-05-01

Breaking changes

• Migrated S3 implementation from rust-s3 to rusty-s3 (sans-IO signing + reqwest HTTP)
  • s3_bucket() now returns S3Bucket instead of rust_s3::Bucket
  • s3_stats() now returns S3ObjectMetadata instead of rust_s3::serde_types::HeadObjectResult
  • Removed re-export of rust-s3 types; all S3 types are now owned by oneio

... (truncated)

Commits

• 38468a9 chore(release): prepare v0.24.2
• 9ed10e9 fix: retry S3 multipart parts on transient transport errors (#81)
• 941a895 chore(release): prepare v0.24.1
• 9775671 fix: stream CLI output instead of line-buffering to memory
• 1726f78 chore: bump version to 0.24.0 for release
• fd47980 Merge pull request #79 from bgpkit/dev/reqwest-reexport-http-gzip
• 89aec0b docs: mark spec 03 status as Complete
• dd58419 feat: re-export reqwest and add opt-in reqwest-gzip feature
• b1a81d7 Merge pull request #78 from bgpkit/fix/leading-slash-r2-keys
• 0bfb178 fix: preserve leading-slash S3 keys
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)