chore(deps): Bump time from 0.3.53 to 0.3.54

[dependabot]

Bumps time from 0.3.53 to 0.3.54.

Release notes

Sourced from time's releases.

v0.3.54

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.54 [2026-07-20]

Added

• PrimitiveDateTime has been renamed to PlainDateTime.
• Duration has been renamed to SignedDuration.
• Iteration is now possible over Date, Month, and Weekday. Relevant iterator methods have been overridden to ensure maximum performance.

For both PlainDateTime and SignedDuration, a non-deprecated type alias has been added for backwards compatibility. The new names should be preferred.

Changed

• The associated metadata type (for powerfmt implementations) for various types has been changed to () and made public. This guarantees that no additional metadata will be present.

Performance

• More gains when parsing RFC 2822.

Commits

• d1c55a4 v0.3.54 release
• 2fb04c4 Add ability to iterate over Weekdays
• 00779fa Add ability to iterate over Months
• b99c5c2 Add ability to iterate over Dates
• 41eea5b Lint on missing panic documentation
• 5a0bdd8 Replace optimizing loop with linear pass
• 687d4a9 Address clippy lints
• 6bf0055 Add LLM policy
• 81f9fe0 Rename Duration to SignedDuration
• 058efae Rename internals for PlainDateTime
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​time@​0.3.53 ⏵ 0.3.54

View full report

[msalvatti]

@dependabot rebase

[msalvatti]

Status: blocked on the supply-chain policy, not on anything wrong with this bump.

cargo deny and cargo audit pass here — no known advisory, no license or ban issue. The only failing step is cargo vet, and it is failing because the new version has no audit yet from any source this repository imports.

#117 has landed and separates the two causes that were tangled together. It refreshed supply-chain/imports.lock, which was five dependencies behind and was making every PR fail for reasons that had nothing to do with the PR, and it pinned CI to cargo vet --locked so the gate answers from what the repository recorded rather than from whatever upstream published that minute. What is left here is genuinely this bump:

$ cargo vet          # with the imports refreshed
Vetting Failed!

(the exact crate is listed in the job log)

Three ways forward, and the right one is a call for the maintainer rather than something to route around:

1. Wait. This is what just happened for anyhow, serde_json, syn and thiserror: Mozilla, Bytecode Alliance and Google published audits between 18 and 22 July, and the versions became vetted with no decision from us. There is no advisory here, so waiting costs nothing.
2. Audit the diff with cargo vet diff, and record it with cargo vet certify. Honest, and real work — the redis 1.3 → 1.5 diff alone is 2377 insertions.
3. Exempt it — record that we accept the version without auditing it. Fastest, and the only one that puts a trust claim in the repository that nobody earned.

Leaving this open rather than forcing it through: a gate that gets bypassed whenever it is inconvenient is not a gate.