fix: update time from 0.3.44 to 0.3.47 (RUSTSEC-2026-0009)

[Copilot]

What problem does this PR solve?

Problem Summary:

Addresses RUSTSEC-2026-0009: DoS vulnerability via stack exhaustion in time crate when parsing RFC 2822 formatted input. Versions <0.3.47 have unbounded recursion in deprecated RFC 2822 features, allowing malicious input to exhaust stack.

What is changed and how it works?

What's Changed:

• Updated workspace dependency time from 0.3.36 → 0.3.47
• Updated Cargo.lock with patched versions of time, time-core, time-macros, and num-conv

Version 0.3.47 adds recursion depth limits, returning errors instead of stack exhaustion. No breaking changes - the codebase only uses basic datetime operations (OffsetDateTime::now_utc(), formatting), not RFC 2822 parsing.

Related changes

• N/A

Check List

Tests

• No code

Side effects

• N/A

Original prompt

---

This section details on the original issue you should resolve

<issue_title>RUSTSEC-2026-0009: Denial of Service via Stack Exhaustion</issue_title>
<issue_description>

Denial of Service via Stack Exhaustion

Details
Package	time
Version	0.3.44
URL	https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
Date	2026-02-05
Patched versions	>=0.3.47
Unaffected versions	<0.3.6

Impact

When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
service attack via stack exhaustion is possible. The attack relies on formally deprecated and
rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
non-malicious input will never encounter this scenario.

Patches

A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
rather than exhausting the stack.

Workarounds

Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
the stack consumed would be at most a factor of the length of the input.

See advisory page for additional details.
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes RUSTSEC-2026-0009: Denial of Service via Stack Exhaustion #5103

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[driftluo]

close by #5105