chore(deps): update rust crate time to v0.3.47 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
time (source)	dependencies	patch	0.3.41 → 0.3.47

GitHub Vulnerability Alerts

CVE-2026-25727

Impact

When user-provided input is provided to any type that parses with the RFC 2822 format, a Denial of Service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.

Patches

A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

Workarounds

Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.

---

Denial of Service via Stack Exhaustion

CVE-2026-25727 / GHSA-r6v5-fh4h-64xc / RUSTSEC-2026-0009

More information

Details

Impact

When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
service attack via stack exhaustion is possible. The attack relies on formally deprecated and
rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
non-malicious input will never encounter this scenario.

Patches

A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
rather than exhausting the stack.

Workarounds

Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
the stack consumed would be at most a factor of the length of the input.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References

• https://crates.io/crates/time
• https://rustsec.org/advisories/RUSTSEC-2026-0009.html
• https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

time vulnerable to stack exhaustion Denial of Service attack

CVE-2026-25727 / GHSA-r6v5-fh4h-64xc / RUSTSEC-2026-0009

More information

Details

Impact

When user-provided input is provided to any type that parses with the RFC 2822 format, a Denial of Service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.

Patches

A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

Workarounds

Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References

• https://github.com/time-rs/time/security/advisories/GHSA-r6v5-fh4h-64xc
• https://nvd.nist.gov/vuln/detail/CVE-2026-25727
• https://github.com/time-rs/time/commit/1c63dc7985b8fa26bd8c689423cc56b7a03841ee
• https://github.com/time-rs/time
• https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
• https://github.com/time-rs/time/releases/tag/v0.3.47
• https://rustsec.org/advisories/RUSTSEC-2026-0009.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

time-rs/time (time)

v0.3.47

Compare Source

Security

• The possibility of a stack exhaustion denial of service attack when parsing RFC 2822 has been
  eliminated. Previously, it was possible to craft input that would cause unbounded recursion. Now,
  the depth of the recursion is tracked, causing an error to be returned if it exceeds a reasonable
  limit.

  This attack vector requires parsing user-provided input, with any type, using the RFC 2822 format.

Compatibility

• Attempting to format a value with a well-known format (i.e. RFC 3339, RFC 2822, or ISO 8601) will
  error at compile time if the type being formatted does not provide sufficient information. This
  would previously fail at runtime. Similarly, attempting to format a value with ISO 8601 that is
  only configured for parsing (i.e. Iso8601::PARSING) will error at compile time.

Added

• Builder methods for format description modifiers, eliminating the need for verbose initialization
  when done manually.
• date!(2026-W01-2) is now supported. Previously, a space was required between W and 01.
• [end] now has a trailing_input modifier which can either be prohibit (the default) or
  discard. When it is discard, all remaining input is ignored. Note that if there are components
  after [end], they will still attempt to be parsed, likely resulting in an error.

Changed

• More performance gains when parsing.

Fixed

• If manually formatting a value, the number of bytes written was one short for some components.
  This has been fixed such that the number of bytes written is always correct.
• The possibility of integer overflow when parsing an owned format description has been effectively
  eliminated. This would previously wrap when overflow checks were disabled. Instead of storing the
  depth as u8, it is stored as u32. This would require multiple gigabytes of nested input to
  overflow, at which point we've got other problems and trivial mitigations are available by
  downstream users.

v0.3.46

Compare Source

Added

• All possible panics are now documented for the relevant methods.

• The need to use #[serde(default)] when using custom serde formats is documented. This applies
  only when deserializing an Option<T>.

• Duration::nanoseconds_i128 has been made public, mirroring
  std::time::Duration::from_nanos_u128.

• Various methods for truncating components have been added, avoiding the need to call the fallible
  replace methods multiple times.

  For PrimitiveDateTime, UtcDateTime, and OffsetDateTime:

  • truncate_to_day

  For Time, PrimitiveDateTime, UtcDateTime, and OffsetDateTime:

  • truncate_to_hour
  • truncate_to_minute
  • truncate_to_second
  • truncate_to_millisecond
  • truncate_to_microsecond

Changed

• The minimum supported Rust version is now 1.88.0.
• Significant performance gains in numerous locations. No public APIs were changed or removed as
  part of this.
• The size of error::ComponentRange, along with types that contain it, has been significantly
  reduced.

Fixed

• The PartialOrd and Ord implementations of UtcOffset now return the expected result.

v0.3.45

Compare Source

Added

• time::format_description::StaticFormatDescription type alias for &'static [BorrowedFormatItem<'static>]. This is the type returned by the
  time::macros::format_description! macro.

Changed

• The minimum supported Rust version is now 1.83.0.
• All floating point methods on Duration are now const fn.
• All setters on Parsed are now const fn.
• The serde dependency has been replaced with serde_core, This reduces compile times by not
  including unused parts of serde.
• Date::from_julian_day uses a new algorithm, resulting in an approximately 16% performance
  improvement. This method is used internally by numerous other methods.
• util::is_leap_year uses a new algorithm, resulting in an approximately 8% performance
  improvement.

v0.3.44

Compare Source

Fixed

• Comparisons of PrimitiveDateTime, UtcDateTime, and OffsetDateTime with differing signs (i.e.
  one negative and one positive year) would return the inverse result of what was expected. This was
  introduced in v0.3.42 and has been fixed.
• Type inference would fail due to feature unification when wasm-bindgen enabled serde_json.
  This has been fixed by explicitly specifying the type in the relevant locations.

v0.3.43

Compare Source

Added

• Support for rand 0.9

Fixed

• In the convert module, any use of per with types that were not the same (such as
  Nanosecond::per(Second)) would not compile due to a bug. This has been fixed.

v0.3.42

Compare Source

Added

• Time::duration_until
• Time::duration_since
• per_t method for all types in time::convert. This is similar to the existing per method, but
  can return any of the primitive numeric types that can represent the result. This will cut down on
  as casts while ensuring correctness. Type inference isn't perfect, so you may need to provide a
  type annotation in some situations.
• impl PartialOrd for Month and impl Ord for Month; this assumes the months are in the same year
• SystemTimeExt trait, adding methods for checked arithmetic with time::Duration and obtaining
  the difference between two SystemTimes as a time::Duration
• Permit using UtcDateTime with rand (this was inadvertently omitted previously)
• impl core::error::Error for all error types (now available when the std feature is disabled)
• MacOS can now obtain the local UTC offset in multi-threaded programs as the system APIs are
  thread-safe.
• #[track_caller] has been added to all relevant methods.

Changed

• The minimum supported Rust version is now 1.81.0.
• The dependency on itoa has been removed, as the standard library now has similar functionality
  by default.
• Formatting a component that involves a floating point number is now guaranteed to be
  deterministic, avoiding any subtle differences between platforms or compiler versions.

Fixed

• Serializing timestamps with nanosecond precision should always emit the correct value.
  Previously, it could be off by one nanosecond due to floating point imprecision.
• A previously unknown bug in OffsetDateTime::to_offset and UtcDateTime::to_offset has been
  fixed. The bug could result in a value that was invalid. It was unlikely to ever occur in
  real-world code, as it involved passing a UTC offset that has never been used in any location.

Miscellaneous

• The amount of code generated by macros has been massively reduced, on the order of 65-70% for
  typical use cases of format_description!.
• Significant performance gains for comparisons of Time, PrimitiveDateTime, UtcDateTime, and
  OffsetDateTime. The first three have gains of approximately 85% (i.e. 6× faster).
• Nearly all methods are #[inline].

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone Europe/Berlin.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.