26 curated breaking changes across major versions of aws-smithy-query. Use this as a migration checklist before bumping dependencies.
:bug::warning: (client) Now files written by the SDK (like credential caches) are created with file permissions `0o600` on unix systems. This could break customers who were relying on the visibility of those files to other users on the system. **New this release:**
:tada: (client, [smithy-rs#4521](https://github.com/smithy-lang/smithy-rs/issues/4521)) Add `sigv4a_signing_region_set` client configuration. Supports programmatic, environment variable (`AWS_SIGV4A_SIGNING_REGION_SET`), and shared config file (`sigv4a_signing_region_set`) configuration. User-provided values now take priority over endpoint-resolved values.
:bug: (client, [smithy-rs#4340](https://github.com/smithy-lang/smithy-rs/issues/4340)) Prevent memory leak in identity cache when overriding credentials via `config_override`. Each `config_override` that sets a credentials provider now uses an operation-scoped identity cache instead of the shared client-level cache, preventing unbounded partition growth. Additionally, the client-level identity cache now enforces a configurable `max_partitions` cap (default: 64) as a safety net.
:bug: (client, [smithy-rs#4596](https://github.com/smithy-lang/smithy-rs/issues/4596), [aws-sdk-rust#1423](https://github.com/awslabs/aws-sdk-rust/issues/1423), @annahay4) Fix `TokenBucket::is_full()` and `TokenBucket::is_empty()` to convert fractional tokens into whole permits before checking availability. Previously, accumulated fractional tokens from success rewards were not accounted for, causing these methods to return incorrect results.
:bug: (client, [smithy-rs#4587](https://github.com/smithy-lang/smithy-rs/issues/4587)) Upgrade `sha2` from 0.10.x to 0.11.x. The previous version defaulted to software-based compression instead of hardware-accelerated compression, resulting in lower throughput. The new version automatically detects and uses hardware-accelerated instructions when available.
:warning: (all) Upgrade MSRV to Rust 1.91.0.
:warning::tada: (client, [smithy-rs#4454](https://github.com/smithy-lang/smithy-rs/issues/4454), [smithy-rs#4467](https://github.com/smithy-lang/smithy-rs/issues/4467), [aws-sdk-rust#1389](https://github.com/awslabs/aws-sdk-rust/issues/1389)) Enable retries by default for AWS SDK clients using `BehaviorVersion::v2026_01_12()` or later.
:tada: (client, [smithy-rs#312](https://github.com/smithy-lang/smithy-rs/issues/312), @AmitKulkarni23) Add support for Smithy bigInteger and bigDecimal types as string wrappers in aws-smithy-types, allowing users to parse with their preferred big number library.
:tada: (all, [smithy-rs#4484](https://github.com/smithy-lang/smithy-rs/issues/4484)) All Smithy-rs crates, for both servers and clients, now use the 1.x version of the `http` crate for all internal processing. Utility methods are still provided for users to convert between SDK types and both of the `http` 0.x and 1.x types.
:bug: (client, [smithy-rs#4500](https://github.com/smithy-lang/smithy-rs/issues/4500)) Fix JMESPath integer literal handling in waiters to support Smithy 1.66.0, which parses integer literals as `Long` instead of `Double`.
@AmitKulkarni23 ([smithy-rs#312](https://github.com/smithy-lang/smithy-rs/issues/312))
:bug::warning: (server, [smithy-rs#4400](https://github.com/smithy-lang/smithy-rs/issues/4400), [smithy-rs#4397](https://github.com/smithy-lang/smithy-rs/issues/4397)) Fix issue where SigV4 envelopes for EventStreams did not support the initial message. This is _technically_ a breaking change but should not break consumers in practice since the resulting type has the same methods.
:tada: (client, @annahay) Added methods in token bucket to indicate if bucket is full or empty
:bug: (client, [smithy-rs#4427](https://github.com/smithy-lang/smithy-rs/issues/4427)) Fix Content-Type and Accept headers for event streams in RPC v2 CBOR to set `application/vnd.amazon.eventstream`
:bug: (client, [aws-sdk-rust#1390](https://github.com/awslabs/aws-sdk-rust/issues/1390), @arielb1) In `legacy-rustls-ring`, polyfill `with_native_roots` to use `rustls_native_certs 0.8` to avoid RUSTSEC-2025-0134.
:bug: (all, @arielby) Publish an MSRV for all packages
:warning::tada: (server, [smithy-rs#4356](https://github.com/smithy-lang/smithy-rs/issues/4356)) Parse EventStream signed-frames for servers marked with `@sigv4`.
:warning: (all, [smithy-rs#4367](https://github.com/smithy-lang/smithy-rs/issues/4367)) Upgrade MSRV to Rust 1.88.0.
:bug::tada: (server, [smithy-rs#4352](https://github.com/smithy-lang/smithy-rs/issues/4352), [smithy-rs#4345](https://github.com/smithy-lang/smithy-rs/issues/4345)) Update smithy-rs servers to support sending `initial-response` events over event streams.
:tada: (all, @arielby) Include the protocol name in `package.metadata.smithy.protocol` in `Cargo.toml` to allow easily figuring out which protocol was used to generate a crate.
:bug::tada: (client, [smithy-rs#4349](https://github.com/smithy-lang/smithy-rs/issues/4349), @arielby) Make Hyper idle pool timeout configurable, and fix the bug where pool timeouts would not work if the client was built directly.
⚠ (all, [smithy-rs#4191](https://github.com/smithy-lang/smithy-rs/pull/4191)) Update MSRV to Rust 1.86.0 **New this release:**
(client, [smithy-rs#4076](https://github.com/smithy-lang/smithy-rs/issues/4076), [smithy-rs#4198](https://github.com/smithy-lang/smithy-rs/issues/4198)) Allows customers to configure the auth schemes and auth scheme resolver. For more information see the GitHub [discussion](https://github.com/smithy-lang/smithy-rs/discussions/4197).
:warning: (all, [smithy-rs#4154](https://github.com/smithy-lang/smithy-rs/pull/4154)) Update MSRV to 1.85.0
:bug::warning: (server) Fixed SmithyRpcV2CBOR Router to properly respect case in service names, preventing routing failures for services with mixed-case service shape ID. **New this release:**
:bug: (client, [smithy-rs#4165](https://github.com/smithy-lang/smithy-rs/issues/4165)) Fix default supported protocols incorrectly ordered in `ClientProtocolLoader`.
Get this data programmatically \u2014 free, no authentication.
curl https://depscope.dev/api/breaking/cargo/aws-smithy-query