Bump the cargo group with 2 updates

[dependabot]

Bumps the cargo group with 2 updates: time and ring.

Updates time from 0.3.37 to 0.3.39

Release notes

Sourced from time's releases.

v0.3.39

See the changelog for details.

v0.3.38

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.39 [2025-03-06]

Fixed

• Doc tests run successfully with the default feature set.
• wasm builds work again.

Both of these were regressions in v0.3.38 and are now checked in CI.

0.3.38 [2025-03-05]

Added

• The [year] component (in format descriptions) now supports a range modifier, which can be either standard or extended. The default is extended for backwards compatibility. This is intended as a manner to opt out of the extended range when the large-dates feature is enabled. When the large-dates feature is not enabled, the modifier has no effect.

• UtcDateTime, which is semantically equivalent to an OffsetDateTime with UTC as its offset. The advantage is that it is the same size as a PrimitiveDateTime and has improved operability with well-known formats.

  As part of this, there were some other additions:

  • utc_datetime! macro, which is similar to the datetime! macro but constructs a UtcDateTime.
  • PrimitiveDateTime::as_utc
  • OffsetDateTime::to_utc
  • OffsetDateTime::checked_to_utc

• time::serde::timestamp::milliseconds_i64, which is a module to serialize/deserialize timestamps as the Unix timestamp. The pre-existing module does this as an i128 where an i64 would suffice. This new module should be preferred.

Changed

• error::Format has had its source() implementation changed to no longer return a boxed value from the ComponentRange variant. If you were explicitly expecting this, you will need to update your code. The method API remains unchanged.
• [year repr:century] supports single-digit values.
• All format_into methods accept ?Sized references.

Miscellaneous

• Some non-exhaustive enum variants that are no longer used have been modified to be statically proven as uninhabited. The relevant fields are doc-hidden and not semver-guaranteed to remain as such, though it is unlikely to change.
• An unnecessary check when parsing RFC 2822 has been removed.
• Various methods have had their implementations changed, resulting in significant performance gains. Among the methods changed are
  • util::is_leap_year
  • util::weeks_in_year
  • Month::length
  • Date::to_calendar_date

... (truncated)

Commits

• 7949d2c v0.3.39 release
• f51623b Fix breakage from v0.3.38
• 1a31c05 v0.3.38 release
• addf231 Permit unsized writers for format_into
• 338f84f Allow clippy::ref_option lint for serde::format_description.
• f8ecd81 feat: timestamp::milliseconds_i64 serializer
• ce03bca Update Unicode license for cargo-audit
• 3d0b981 Add parentheses for clarity
• 3096301 Remove specific year from license
• ec327a2 Optimize Julian day calculations
• Additional commits viewable in compare view

Updates ring from 0.17.3 to 0.17.13

Changelog

Sourced from ring's changelog.

Version 0.17.13 (2025-03-06)

Increased MSRV to 1.66.0 to avoid bugs in earlier versions so that we can safely use core::arch::x86_64::__cpuid and core::arch::x86::__cpuid from Rust in future releases.

AVX2-based VAES-CLMUL implementation. This will be a notable performance improvement for most newish x86-64 systems. This will likely raise the minimum binutils version supported for very old Linux distros.

Version 0.17.12 (2025-03-05)

Bug fix: briansmith/ring#2447 for denial of service (DoS).

• Fixes a panic in ring::aead::quic::HeaderProtectionKey::new_mask() when integer overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 2**32 packets sent and/or received.

• Fixes a panic on 64-bit targets in ring::aead::{AES_128_GCM, AES_256_GCM} when overflow checking is enabled, when encrypting/decrypting approximately 68,719,476,700 bytes (about 64 gigabytes) of data in a single chunk. Protocols like TLS and SSH are not affected by this because those protocols break large amounts of data into small chunks. Similarly, most applications will not attempt to encrypt/decrypt 64GB of data in one chunk.

Overflow checking is not enabled in release mode by default, but RUSTFLAGS="-C overflow-checks" or overflow-checks = true in the Cargo.toml profile can override this. Overflow checking is usually enabled by default in debug mode.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.