Bump time from 0.3.44 to 0.3.47

[dependabot]

Bumps time from 0.3.44 to 0.3.47.

Release notes

Sourced from time's releases.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.47 [2026-02-05]

Security

• The possibility of a stack exhaustion denial of service attack when parsing RFC 2822 has been eliminated. Previously, it was possible to craft input that would cause unbounded recursion. Now, the depth of the recursion is tracked, causing an error to be returned if it exceeds a reasonable limit.

  This attack vector requires parsing user-provided input, with any type, using the RFC 2822 format.

Compatibility

• Attempting to format a value with a well-known format (i.e. RFC 3339, RFC 2822, or ISO 8601) will error at compile time if the type being formatted does not provide sufficient information. This would previously fail at runtime. Similarly, attempting to format a value with ISO 8601 that is only configured for parsing (i.e. Iso8601::PARSING) will error at compile time.

Added

• Builder methods for format description modifiers, eliminating the need for verbose initialization when done manually.
• date!(2026-W01-2) is now supported. Previously, a space was required between W and 01.
• [end] now has a trailing_input modifier which can either be prohibit (the default) or discard. When it is discard, all remaining input is ignored. Note that if there are components after [end], they will still attempt to be parsed, likely resulting in an error.

Changed

• More performance gains when parsing.

Fixed

• If manually formatting a value, the number of bytes written was one short for some components. This has been fixed such that the number of bytes written is always correct.
• The possibility of integer overflow when parsing an owned format description has been effectively eliminated. This would previously wrap when overflow checks were disabled. Instead of storing the depth as u8, it is stored as u32. This would require multiple gigabytes of nested input to overflow, at which point we've got other problems and trivial mitigations are available by downstream users.

0.3.46 [2026-01-23]

Added

• All possible panics are now documented for the relevant methods.
• The need to use #[serde(default)] when using custom serde formats is documented. This applies only when deserializing an Option<T>.
• Duration::nanoseconds_i128 has been made public, mirroring std::time::Duration::from_nanos_u128.

... (truncated)

Commits

• d5144cd v0.3.47 release
• f6206b0 Guard against integer overflow in release mode
• 1c63dc7 Avoid denial of service when parsing Rfc2822
• 5940df6 Add builder methods to avoid verbose construction
• 00881a4 Manually format macros everywhere
• bb723b6 Add trailing_input modifier to end
• 31c4f8e Permit W12 in date! macro
• 490a17b Mark error paths in well-known formats as cold
• 6cb1896 Optimize Rfc2822 parsing
• 6d264d5 Remove erroneous #[inline(never)] attributes
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[claude]

Claude finished @leighmcculloch's task in 1m 38s —— View job

---

PR Review: Bump time from 0.3.44 to 0.3.47

• Inspect changed files (Cargo.lock diff)
• Verify time is a transitive dependency only
• Assess security/compatibility impact of 0.3.44 → 0.3.47
• Run build and tests — skipped, see note below
• Post review feedback

---

Summary

This is a Cargo.lock-only change. Cargo.toml is untouched and time is not a direct dependency — it is pulled in transitively via serde_with, which itself is gated behind the optional serde feature (Cargo.toml:14). No source files reference the time crate (grep -rn "use time\|time::" in src/ and tests/ returns nothing).

What actually moves in the lockfile

Crate	Old	New
time	0.3.44	0.3.47
time-core	0.1.6	0.1.8
time-macros	0.2.24	0.2.27
num-conv	0.1.0	0.2.0

time now depends on serde_core instead of the full serde crate — a small dependency-tree improvement, no API impact for this project.

Security & correctness assessment

• RUSTSEC-style fix in 0.3.47: stack-exhaustion DoS when parsing RFC 2822 input. Not exploitable here — this crate does no datetime parsing of any kind; serde_with uses time for serialization formats, and stellar-strkey does not use any time-based serializer. The fix is a freebie via the transitive bump.
• 0.3.47 integer-overflow fix (depth tracking switched u8 → u32): also not reachable from this codebase.
• Compile-time error for ill-formed well-known formats: a behavioral change in time itself, but again no code here uses those APIs.

Compatibility

• MSRV stays at 1.81.0 (Cargo.toml:11); the time 0.3.x line has historically held a much lower MSRV, so this should not regress the matrix.
• CI runs both msrv and latest (.github/workflows/rust.yml:23-26), so any MSRV regression would be caught automatically — no need to verify locally.
• The num-conv major bump (0.1 → 0.2) is internal to time-macros; nothing in this repo imports num-conv.

Build verification

I did not run cargo build / cargo test locally — the toolchain is not in the sandbox PATH for this review job. The repo's CI matrix in .github/workflows/rust.yml covers msrv and latest builds plus tests, so the green CI signal on this PR is the authoritative check. If CI is green, this is safe to merge.

Recommendation

LGTM. Low-risk lockfile-only update; transitive only; the headline security fix is a defense-in-depth bonus rather than a load-bearing one for this crate. No inline comments — the diff is purely checksum/version bumps with nothing to suggest changing.
• Branch

[leighmcculloch]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[dependabot]

A newer version of time exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.