renovate[bot]
1ebfc9158f
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [time](https://time-rs.github.io) ([source](https://redirect.github.com/time-rs/time)) | workspace.dependencies | patch | `0.3.44` → `0.3.47` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. ### GitHub Vulnerability Alerts #### [CVE-2026-25727](https://redirect.github.com/time-rs/time/security/advisories/GHSA-r6v5-fh4h-64xc) ### Impact When user-provided input is provided to any type that parses with the RFC 2822 format, a Denial of Service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. ### Patches A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack. ### Workarounds Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input. --- ### Release Notes <details> <summary>time-rs/time (time)</summary> ### [`v0.3.47`](https://redirect.github.com/time-rs/time/blob/HEAD/CHANGELOG.md#0347-2026-02-05) [Compare Source](https://redirect.github.com/time-rs/time/compare/v0.3.46...v0.3.47) ##### Security - The possibility of a stack exhaustion denial of service attack when parsing RFC 2822 has been eliminated. Previously, it was possible to craft input that would cause unbounded recursion. Now, the depth of the recursion is tracked, causing an error to be returned if it exceeds a reasonable limit. This attack vector requires parsing user-provided input, with any type, using the RFC 2822 format. ##### Compatibility - Attempting to format a value with a well-known format (i.e. RFC 3339, RFC 2822, or ISO 8601) will error at compile time if the type being formatted does not provide sufficient information. This would previously fail at runtime. Similarly, attempting to format a value with ISO 8601 that is only configured for parsing (i.e. `Iso8601::PARSING`) will error at compile time. ##### Added - Builder methods for format description modifiers, eliminating the need for verbose initialization when done manually. - `date!(2026-W01-2)` is now supported. Previously, a space was required between `W` and `01`. - `[end]` now has a `trailing_input` modifier which can either be `prohibit` (the default) or `discard`. When it is `discard`, all remaining input is ignored. Note that if there are components after `[end]`, they will still attempt to be parsed, likely resulting in an error. ##### Changed - More performance gains when parsing. ##### Fixed - If manually formatting a value, the number of bytes written was one short for some components. This has been fixed such that the number of bytes written is always correct. - The possibility of integer overflow when parsing an owned format description has been effectively eliminated. This would previously wrap when overflow checks were disabled. Instead of storing the depth as `u8`, it is stored as `u32`. This would require multiple gigabytes of nested input to overflow, at which point we've got other problems and trivial mitigations are available by downstream users. ### [`v0.3.46`](https://redirect.github.com/time-rs/time/blob/HEAD/CHANGELOG.md#0346-2026-01-23) [Compare Source](https://redirect.github.com/time-rs/time/compare/v0.3.45...v0.3.46) ##### Added - All possible panics are now documented for the relevant methods. - The need to use `#[serde(default)]` when using custom `serde` formats is documented. This applies only when deserializing an `Option<T>`. - `Duration::nanoseconds_i128` has been made public, mirroring `std::time::Duration::from_nanos_u128`. - Various methods for truncating components have been added, avoiding the need to call the fallible `replace` methods multiple times. For `PrimitiveDateTime`, `UtcDateTime`, and `OffsetDateTime`: - `truncate_to_day` For `Time`, `PrimitiveDateTime`, `UtcDateTime`, and `OffsetDateTime`: - `truncate_to_hour` - `truncate_to_minute` - `truncate_to_second` - `truncate_to_millisecond` - `truncate_to_microsecond` ##### Changed - The minimum supported Rust version is now 1.88.0. - Significant performance gains in numerous locations. No public APIs were changed or removed as part of this. - The size of `error::ComponentRange`, along with types that contain it, has been significantly reduced. ##### Fixed - The `PartialOrd` and `Ord` implementations of `UtcOffset` now return the expected result. ### [`v0.3.45`](https://redirect.github.com/time-rs/time/blob/HEAD/CHANGELOG.md#0345-2026-01-13) [Compare Source](https://redirect.github.com/time-rs/time/compare/v0.3.44...v0.3.45) ##### Added - `time::format_description::StaticFormatDescription` type alias for `&'static [BorrowedFormatItem<'static>]`. This is the type returned by the `time::macros::format_description!` macro. ##### Changed - The minimum supported Rust version is now 1.83.0. - All floating point methods on `Duration` are now `const fn`. - All setters on `Parsed` are now `const fn`. - The `serde` dependency has been replaced with `serde_core`, This reduces compile times by not including unused parts of `serde`. - `Date::from_julian_day` uses a new algorithm, resulting in an approximately 16% performance improvement. This method is used internally by numerous other methods. - `util::is_leap_year` uses a new algorithm, resulting in an approximately 8% performance improvement. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- Release Notes: - N/A <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45NS4yIiwidXBkYXRlZEluVmVyIjoiNDIuOTUuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Zed
Welcome to Zed, a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter.
Installation
On macOS, Linux, and Windows you can download Zed directly or install Zed via your local package manager (macOS/Linux/Windows).
Other platforms are not yet available:
- Web (tracking issue)
Developing Zed
Contributing
See CONTRIBUTING.md for ways you can contribute to Zed.
Also... we're hiring! Check out our jobs page for open roles.
Licensing
License information for third party dependencies must be correctly provided for CI to pass.
We use cargo-about to automatically comply with open source licenses. If CI is failing, check the following:
- Is it showing a
no license specifiederror for a crate you've created? If so, addpublish = falseunder[package]in your crate's Cargo.toml. - Is the error
failed to satisfy license requirementsfor a dependency? If so, first determine what license the project has and whether this system is sufficient to comply with this license's requirements. If you're unsure, ask a lawyer. Once you've verified that this system is acceptable add the license's SPDX identifier to theacceptedarray inscript/licenses/zed-licenses.toml. - Is
cargo-aboutunable to find the license for a dependency? If so, add a clarification field at the end ofscript/licenses/zed-licenses.toml, as specified in the cargo-about book.
Sponsorship
Zed is developed by Zed Industries, Inc., a for-profit company.
If you’d like to financially support the project, you can do so via GitHub Sponsors. Sponsorships go directly to Zed Industries and are used as general company revenue. There are no perks or entitlements associated with sponsorship.