build(deps): bump the patch group across 2 directories with 25 updates

[dependabot]

Bumps the patch group with 23 updates in the / directory:

Package	From	To
time	0.3.45	0.3.47
reqwest	0.13.1	0.13.2
rand_core	0.10.0-rc-3	0.10.0
crypto-bigint	0.7.0-rc.18	0.7.0-rc.21
sha1	0.11.0-rc.2	0.11.0-rc.3
cbc	0.2.0-rc.1	0.2.0-rc.2
des	0.9.0-rc.1	0.9.0-rc.2
rc2	0.9.0-pre.0	0.9.0-rc.0
pbkdf2	0.13.0-rc.1	0.13.0-rc.8
blowfish	0.10.0-rc.1	0.10.0-rc.2
crypto-common	0.2.0-rc.8	0.2.0-rc.12
universal-hash	0.6.0-rc.4	0.6.0-rc.6
password-hash	0.6.0-rc.8	0.6.0-rc.10
signature	3.0.0-rc.6	3.0.0-rc.7
elliptic-curve	0.14.0-rc.19	0.14.0-rc.22
pkcs8	0.11.0-rc.8	0.11.0-rc.10
sec1	0.8.0-rc.11	0.8.0-rc.13
keccak	0.2.0-rc.0	0.2.0-rc.1
primefield	0.14.0-rc.3	0.14.0-rc.5
primeorder	0.14.0-rc.3	0.14.0-rc.4
crypto-primes	0.7.0-pre.6	0.7.0-pre.7
rand_chacha	0.10.0-rc.6	0.10.0
getrandom	0.4.0-rc.0	0.4.1

Bumps the patch group with 2 updates in the /ffi/wasm directory: serde_json and wasm-bindgen-test.

Updates time from 0.3.45 to 0.3.47

Release notes

Sourced from time's releases.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.47 [2026-02-05]

Security

• The possibility of a stack exhaustion denial of service attack when parsing RFC 2822 has been eliminated. Previously, it was possible to craft input that would cause unbounded recursion. Now, the depth of the recursion is tracked, causing an error to be returned if it exceeds a reasonable limit.

  This attack vector requires parsing user-provided input, with any type, using the RFC 2822 format.

Compatibility

• Attempting to format a value with a well-known format (i.e. RFC 3339, RFC 2822, or ISO 8601) will error at compile time if the type being formatted does not provide sufficient information. This would previously fail at runtime. Similarly, attempting to format a value with ISO 8601 that is only configured for parsing (i.e. Iso8601::PARSING) will error at compile time.

Added

• Builder methods for format description modifiers, eliminating the need for verbose initialization when done manually.
• date!(2026-W01-2) is now supported. Previously, a space was required between W and 01.
• [end] now has a trailing_input modifier which can either be prohibit (the default) or discard. When it is discard, all remaining input is ignored. Note that if there are components after [end], they will still attempt to be parsed, likely resulting in an error.

Changed

• More performance gains when parsing.

Fixed

• If manually formatting a value, the number of bytes written was one short for some components. This has been fixed such that the number of bytes written is always correct.
• The possibility of integer overflow when parsing an owned format description has been effectively eliminated. This would previously wrap when overflow checks were disabled. Instead of storing the depth as u8, it is stored as u32. This would require multiple gigabytes of nested input to overflow, at which point we've got other problems and trivial mitigations are available by downstream users.

0.3.46 [2026-01-23]

Added

• All possible panics are now documented for the relevant methods.
• The need to use #[serde(default)] when using custom serde formats is documented. This applies only when deserializing an Option<T>.
• Duration::nanoseconds_i128 has been made public, mirroring std::time::Duration::from_nanos_u128.

... (truncated)

Commits

• d5144cd v0.3.47 release
• f6206b0 Guard against integer overflow in release mode
• 1c63dc7 Avoid denial of service when parsing Rfc2822
• 5940df6 Add builder methods to avoid verbose construction
• 00881a4 Manually format macros everywhere
• bb723b6 Add trailing_input modifier to end
• 31c4f8e Permit W12 in date! macro
• 490a17b Mark error paths in well-known formats as cold
• 6cb1896 Optimize Rfc2822 parsing
• 6d264d5 Remove erroneous #[inline(never)] attributes
• Additional commits viewable in compare view

Updates reqwest from 0.13.1 to 0.13.2

Changelog

Sourced from reqwest's changelog.

v0.13.2

• Fix HTTP/2 and native-tls ALPN feature combinations.
• Fix HTTP/3 to send h3 ALPN.
• (wasm) fix RequestBuilder::json() from override previously set content-type.

Commits

• ad83b63 v0.13.2
• c25f3db chore: Add Windows and Linux arm64 to CI (#2960)
• 761b89e chore: upgrade wasm-streams to v0.5 (#2958)
• fd2d507 fix(wasm): custom content-type overidden by json method for wasm (#2908)
• 23eb7d4 chore: update copyright year to 2026 (#2943)
• 10c31c2 fix(http3): specify h3 alpn for http3 connector (#2929)
• 8530ec3 docs: native-tls-alpn has changed to native-tls-no-alpn (#2940)
• 04a216f chore(deps): remove unused webpki-roots and rustls-native-certs (#2932)
• 406b59e fix http2 feature is not enabled for native-tls ALPN (#2927)
• 325a020 Update readme for 0.13 (#2926)
• Additional commits viewable in compare view

Updates rand_core from 0.10.0-rc-3 to 0.10.0

Release notes

Sourced from rand_core's releases.

v0.10.0

What's Changed

This release makes a number of significant changes which we hope will be the last significant breakage before 1.0. Code has moved from the [rust-random/rand] repository to its own [rust-random/rand_core].

User-facing API changes

Changed

• Edition changed to 2024 and MSRV bumped to 1.85 ([rand#1668])
• RngCore and TryRngCore are renamed to Rng and TryRng respectively (#54)
• Rng is now an extension trait of TryRng<Error = Infallible> (#45)
• TryRng::Error is bound on core::error::Error instead of Debug + Display (#58)
• Relax Sized bound on impls of SeedableRng ([rand#1641])

Added

• SeedableRng::{fork, try_fork} methods (#17)
• Re-export of core::convert::Infallible (#56)

Removed

• TryRng::read_adapter method (replaced with rand::RngReader) ([rand#1669])
• os_rng crate feature ([rand#1674])
• OsRng and OsError structs ([rand#1674])
• SeedableRng::from_os_rng and SeedableRng::try_from_os_rng methods ([rand#1674])
• getrandom dependency ([rand#1674])
• std crate feature ([rand#1674])
• Optional serde dependency (#28)
• UnwrapMut struct and Rng::unwrap_mut method (#45)
• Rng::unwrap_err method in favor of explicit wrapping in UnwrapErr (#53)

API changes to PRNG implementation helpers

Added

• BlockRng::reconstruct and BlockRng::remaining_results methods (#36)
• block::Generator::drop method (#35)
• BlockRng::word_offset method (#44)

Changed

• Replaced le helper functions with new utils helpers ([rand#1667], #34, #38, #45)
• Rename BlockRng::generate_and_set method to reset_and_skip (#44)
• Rename block::BlockRngCore trait to block::Generator (#26)
• Rename BlockRngCore::Results associated type to Output and remove type bounds on it (#26)

Removed

• Implementation of Rng for BlockRng, making the latter more generic (#34)
• BlockRng64 struct (#34)
• BlockRng::reset method (#44)
• BlockRng::index method (replaced with BlockRng::word_offset) (#44)
• Generator::Item associated type (#26)
• CryptoBlockRng (#69)

... (truncated)

Changelog

Sourced from rand_core's changelog.

[0.10.0] - 2026-02-01

This release makes a number of significant changes which we hope will be the last significant breakage before 1.0. Code has moved from the [rust-random/rand] repository to its own [rust-random/rand_core].

User-facing API changes

Changed

• Edition changed to 2024 and MSRV bumped to 1.85 ([rand#1668])
• RngCore and TryRngCore are renamed to Rng and TryRng respectively (#54)
• Rng is now an extension trait of TryRng<Error = Infallible> (#45)
• TryRng::Error is bound on core::error::Error instead of Debug + Display (#58)
• Relax Sized bound on impls of SeedableRng ([rand#1641])

Added

• SeedableRng::{fork, try_fork} methods (#17)
• Re-export of core::convert::Infallible (#56)

Removed

• TryRng::read_adapter method (replaced with rand::RngReader) ([rand#1669])
• os_rng crate feature ([rand#1674])
• OsRng and OsError structs ([rand#1674])
• SeedableRng::from_os_rng and SeedableRng::try_from_os_rng methods ([rand#1674])
• getrandom dependency ([rand#1674])
• std crate feature ([rand#1674])
• Optional serde dependency (#28)
• UnwrapMut struct and Rng::unwrap_mut method (#45)
• Rng::unwrap_err method in favor of explicit wrapping in UnwrapErr (#53)

API changes to PRNG implementation helpers

Added

• BlockRng::reconstruct and BlockRng::remaining_results methods (#36)
• block::Generator::drop method (#35)
• BlockRng::word_offset method (#44)

Changed

• Replaced le helper functions with new utils helpers ([rand#1667], #34, #38, #45)
• Rename BlockRng::generate_and_set method to reset_and_skip (#44)
• Rename block::BlockRngCore trait to block::Generator (#26)
• Rename BlockRngCore::Results associated type to Output and remove type bounds on it (#26)

Removed

• Implementation of Rng for BlockRng, making the latter more generic (#34)
• BlockRng64 struct (#34)
• BlockRng::reset method (#44)
• BlockRng::index method (replaced with BlockRng::word_offset) (#44)
• Generator::Item associated type (#26)
• CryptoBlockRng (#69)

... (truncated)

Commits

• 0ce22c9 Prepare 0.10.0 (#64)
• a20120c Remove CryptoGenerator and Generator::drop; add BlockRng::clear (#69)
• f9763d8 Add deprecated RngCore/TryRngCore forwarding traits (#70)
• ae88096 Update license year (#67)
• 5de0732 Tweak UnwrapErr impl (#66)
• 9eb6381 Tweak doc links (#65)
• 5864683 Remove outdated comment (#62)
• f5e3b45 Move SeedableRng and UnwrapErr into separate modules (#63)
• e591ff2 Release v0.10.0-rc-6 (#61)
• 423ca87 Enable lints in Cargo.toml (#60)
• Additional commits viewable in compare view

Updates crypto-bigint from 0.7.0-rc.18 to 0.7.0-rc.21

Commits

• 59660c5 v0.7.0-rc.21 (#1137)
• b11fbcc Impl AmmMultiplier for DynMontyMultiplier (#1131)
• e193ed3 Bump rand_core to v0.10.0-rc-5 (#1136)
• 61a0acf CI: adjust clippy lints (#1135)
• d8158bc Have pow_montgomery_form_amm reduce its output (#1133)
• bd8a0a4 Add Unsigned::as(_mut)_uint_ref (#1132)
• 4f17360 Bump ctutils to v0.4 release (#1130)
• d6b4494 UintRef { limbs: ... } (#1129)
• 8e3092c Add pow_vartime for MontyForm, ConstMontyForm (#1118)
• 17084dd Impl ToOwned\<Owned = BoxedUint> for UintRef (#1128)
• Additional commits viewable in compare view

Updates sha1 from 0.11.0-rc.2 to 0.11.0-rc.3

Commits

• 8af25ee Cut rc.3 prereleases (#753)
• ea20cf5 build(deps): bump hex-literal from 1.0.0 to 1.1.0 (#750)
• 90a4289 Bump digest dependency to v0.11.0-rc.4 (#752)
• a05d080 Fix bash-hash entry in the supported algorithms table (#748)
• 21384b5 Remove implementations of the VariableOutput trait (#744)
• e048918 bash-hash: minor refactor (#746)
• 65f8551 bash-hash: initial implementation (#745)
• be84ff7 Migrate from doc_auto_cfg to doc_cfg (#740)
• 72b956c gost94: fix typo (#741)
• c73bd68 build(deps): bump digest from 0.11.0-rc.2 to 0.11.0-rc.3 (#738)
• Additional commits viewable in compare view

Updates cbc from 0.2.0-rc.1 to 0.2.0-rc.2

Commits

• ca6e12a Cut rc.2 prereleases (#93)
• 1493905 Bump cipher dependency to v0.5.0-rc.2 (#92)
• 0f92e05 Remove Clone impls (#91)
• 2812bb7 Migrate to the new blobby format (#90)
• 49e0937 Migrate to new dev macros (#89)
• See full diff in compare view

Updates des from 0.9.0-rc.1 to 0.9.0-rc.2

Commits

• 25df7c9 Cut rc.2 prereleases (#512)
• 69b3746 Bump cipher dependency to v0.5.0-rc.2 (#511)
• 1530141 rc6: 2024 edition; upgrade to cipher v0.5.0-rc.1 (#510)
• 4a65fa4 rc6: RC6 Implementation (#439)
• bf53f63 aes: add VAES support (#508)
• 3eeaff0 rc2 v0.9.0-pre.0 (#507)
• c2e35db Switch from doc_auto_cfg to doc_cfg (#505)
• ffcfc5c magma: fix typos (#506)
• f38301b Migrate to the new blobby format (#503)
• bcedd16 Migrate to new dev macro (#502)
• See full diff in compare view

Updates rc2 from 0.9.0-pre.0 to 0.9.0-rc.0

Commits

• 89dd1fb Cut new prereleases (#520)
• 2e05b00 Bump cipher dependency to v0.5.0-rc.3 (#518)
• db17b11 CI: fix security audit (#517)
• 87c3aa7 aes: vaes detection is provided by cpufeatures-0.2.12 (#514)
• 25df7c9 Cut rc.2 prereleases (#512)
• 69b3746 Bump cipher dependency to v0.5.0-rc.2 (#511)
• 1530141 rc6: 2024 edition; upgrade to cipher v0.5.0-rc.1 (#510)
• 4a65fa4 rc6: RC6 Implementation (#439)
• bf53f63 aes: add VAES support (#508)
• See full diff in compare view

Updates pbkdf2 from 0.13.0-rc.1 to 0.13.0-rc.8

Commits

• 747932f Cut new prereleases (#825)
• a3407a8 bcrypt-pbkdf: improve README.md
• 9b9a7ba README.md: add yescrypt
• 449bd9e scrypt: remove Display/FromStr impls from Params (#824)
• 2cfdb6f Add impls for kdf::{Kdf, Pbkdf} (#823)
• cd61372 bcrypt-pbkdf + password-auth: remove/disable std features (#822)
• be593db Bump password-hash to v0.6.0-rc.9 (#821)
• a6bc5d4 bcrypt-pbkdf: move pub fns to top of file (#820)
• b55851e Update Cargo.lock (#819)
• 07dd940 Bump pbkdf2 to v0.13.0-rc.7
• Additional commits viewable in compare view

Updates blowfish from 0.10.0-rc.1 to 0.10.0-rc.2

Commits

• 25df7c9 Cut rc.2 prereleases (#512)
• 69b3746 Bump cipher dependency to v0.5.0-rc.2 (#511)
• 1530141 rc6: 2024 edition; upgrade to cipher v0.5.0-rc.1 (#510)
• 4a65fa4 rc6: RC6 Implementation (#439)
• bf53f63 aes: add VAES support (#508)
• 3eeaff0 rc2 v0.9.0-pre.0 (#507)
• c2e35db Switch from doc_auto_cfg to doc_cfg (#505)
• ffcfc5c magma: fix typos (#506)
• f38301b Migrate to the new blobby format (#503)
• bcedd16 Migrate to new dev macro (#502)
• See full diff in compare view

Updates crypto-common from 0.2.0-rc.8 to 0.2.0-rc.12

Commits

• 4e195b4 crypto-common v0.2.0-rc.12 (#2218)
• 23f63d8 Cargo.lock: bump dependencies (#2217)
• 327021e Cargo.lock: bump password-hash to v0.6.0-rc.10
• 18fef98 kem: bound Encapsulate on TryKeyInit + KeyExport (#2215)
• ee5e408 crypto-common: add KeyExport trait (#2213)
• f57ec3b password-hash: remove Display/FromStr bounds on Params (#2212)
• 2187175 kdf: Kdf trait documentation improvements (#2211)
• 16deb21 elliptic-curve v0.14.0-rc.23 (#2210)
• fed493a elliptic-curve: RNG followups (#2208)
• 02e91f5 build(deps): bump the all-deps group across 1 directory with 2 updates (#2204)
• Additional commits viewable in compare view

Updates universal-hash from 0.6.0-rc.4 to 0.6.0-rc.6

Commits

• e88f57d crypto-common v0.2.0-rc.11 (#2206)
• 6688e7f Bump rand_core to v0.10.0-rc-5 (#2205)
• 8afadd9 ci: bump actions/checkout from 4 to 6 for kdf (#2199)
• c6a4c0e ci: bump crate-ci/typos from 1.42.0 to 1.42.1 (#2200)
• 7521c0f elliptic-curve v0.14.0-rc.22 (#2203)
• e4c6d94 elliptic-curve: bump crypto-bigint to v0.7.0-rc.20 (#2202)
• 30f5274 workspace: avoid duplicate crypto-common definition when using git dependenci...
• 2100251 elliptic-curve: fixup rand_core API use (#2197)
• 5d95f9f kem v0.4.0-rc.3
• 4be5aa4 Bump rand_core to v0.10.0-rc-4 (#2195)
• Additional commits viewable in compare view

Updates password-hash from 0.6.0-rc.8 to 0.6.0-rc.10

Commits

• f57ec3b password-hash: remove Display/FromStr bounds on Params (#2212)
• 2187175 kdf: Kdf trait documentation improvements (#2211)
• 16deb21 elliptic-curve v0.14.0-rc.23 (#2210)
• fed493a elliptic-curve: RNG followups (#2208)
• 02e91f5 build(deps): bump the all-deps group across 1 directory with 2 updates (#2204)
• fbc8fe2 elliptic-curve: bump crypto-bigint to v0.7.0-rc.21 (#2207)
• 3018e75 Cargo.lock: update signature version
• e88f57d crypto-common v0.2.0-rc.11 (#2206)
• 6688e7f Bump rand_core to v0.10.0-rc-5 (#2205)
• 8afadd9 ci: bump actions/checkout from 4 to 6 for kdf (#2199)
• Additional commits viewable in compare view

Updates signature from 3.0.0-rc.6 to 3.0.0-rc.7

Commits

• 4be5aa4 Bump rand_core to v0.10.0-rc-4 (#2195)
• 226d743 ci: bump crate-ci/typos from 1.41.0 to 1.42.0 (#2185)
• ad2b8a3 build(deps): bump cmov from 0.4.3 to 0.4.5 (#2193)
• 8711221 kdf v0.1.0-pre.1 (#2192)
• 90ded85 CI: test docs build with --cfg docsrs (#2191)
• 1ad0231 build(deps): bump the all-deps group with 4 updates (#2186)
• 17520aa kdf: impl Display and core::error::Error for Error (#2189)
• bf55539 kdf: remove redundant build-* badge links from README.md
• c706b4e kdf v0.1.0-pre.0 (#2188)
• 0d18c7d kdf crate (#1879)
• Additional commits viewable in compare view

Updates elliptic-curve from 0.14.0-rc.19 to 0.14.0-rc.22

Commits

• 7521c0f elliptic-curve v0.14.0-rc.22 (#2203)
• e4c6d94 elliptic-curve: bump crypto-bigint to v0.7.0-rc.20 (#2202)
• 30f5274 workspace: avoid duplicate crypto-common definition when using git dependenci...
• 2100251 elliptic-curve: fixup rand_core API use (#2197)
• 5d95f9f kem v0.4.0-rc.3
• 4be5aa4 Bump rand_core to v0.10.0-rc-4 (#2195)
• 226d743 ci: bump crate-ci/typos from 1.41.0 to 1.42.0 (#2185)
• ad2b8a3 build(deps): bump cmov from 0.4.3 to 0.4.5 (#2193)
• 8711221 kdf v0.1.0-pre.1 (#2192)
• 90ded85 CI: test docs build with --cfg docsrs (#2191)
• Additional commits viewable in compare view

Updates pkcs8 from 0.11.0-rc.8 to 0.11.0-rc.10

Commits

• df57138 pkcs8 v0.11.0-rc.10 (#2189)
• bcbfd88 pkcs5 v0.8.0-rc.13 (#2188)
• 315413f Bump rand_core to v0.10.0-rc-6 (#2187)
• 7368fd5 sec1 v0.8.0-rc.13 (#2186)
• 1226243 sec1: group imports (#2185)
• eb63b10 sec1: simplify ModulusSize bounds (#2184)
• 336020c chore(deps): bump the all-deps group across 1 directory with 10 updates (#2183)
• 655139a chore(deps): bump rand_core to 0.10.0-rc-5 (#2182)
• 701baca sec1 v0.8.0-rc.12 (#2180)
• ba98810 pkcs5,pkcs8: new release candidates (#2176)
• Additional commits viewable in compare view

Updates sec1 from 0.8.0-rc.11 to 0.8.0-rc.13

Commits

• 7368fd5 sec1 v0.8.0-rc.13 (#2186)
• 1226243 sec1: group imports (#2185)
• eb63b10 sec1: simplify ModulusSize bounds (#2184)
• 336020c chore(deps): bump the all-deps group across 1 directory with 10 updates (#2183)
• 655139a chore(deps): bump rand_core to 0.10.0-rc-5 (#2182)
• 701baca sec1 v0.8.0-rc.12 (#2180)
• ba98810 pkcs5,pkcs8: new release candidates (#2176)
• 8811b55 chore(deps): bump crate-ci/typos from 1.42.0 to 1.42.1 (#2173)
• 580bdcd chore(deps): bump cmov to 0.4.6 (#2177)
• 08b22e5 rand_core: upcoming API breaks (#2175)
• Additional commits viewable in compare view

Updates keccak from 0.2.0-rc.0 to 0.2.0-rc.1

Commits

• d0c9b2a keccak v0.2.0-rc.1 (#98)
• 4519b3b keccak: test asm feature in CI (#97)
• 2d857d1 keccak: test on aarch64-apple-darwin (#96)
• b7f8770 bash-f: tweak benchmarks (#94)
• 868527a bash-f: minor tweaks (#93)
• 4d77857 Add bash-f (STB 34.101.77-2020) (#92)
• f205d0e Use doc_cfg in place of removed doc_auto_cfg feature (#91)
• See full diff in compare view

Updates primefield from 0.14.0-rc.3 to 0.14.0-rc.5

Commits

• 1c3c174 Cut new prereleases
• bcc0f42 RNG cleanups (#1624)
• 775a4c0 k256: use Generate::generate() for tests (#1622)
• 380777f Upgrade dependencies (#1621)
• b65c24a primeorder: DRY out duplicated debug_assert_eq! checks
• 126b054 Update variable_base.rs (#1607)
• a221d3e ed448-goldilocks: deduplicate OKM→FieldElement test logic (#1611)
• cc2123c chore(deps): bump rand_core to 0.10.0-rc-5 (#1620)
• f8c7386 build(deps): bump cmov from 0.4.3 to 0.4.5 (#1610)
• ca52bae build(deps): bump crate-ci/typos from 1.41.0 to 1.42.0 (#1608)
• Additional commits viewable in compare view

Updates primeorder from 0.14.0-rc.3 to 0.14.0-rc.4
<d...

Description has been truncated