chore(deps): bump the rust-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the rust-minor-patch group with 3 updates in the /packages directory: regex, time and libc.

Updates regex from 1.12.3 to 1.12.4

Changelog

Sourced from regex's changelog.

1.12.4 (2025-06-09)

This release includes a performance optimization for compilation of regexes with very large character classes.

Improvements:

• #1308: Avoid re-canonicalizing the entire interval set when pushing new class ranges.

Commits

• 7b96fdc 1.12.4
• 7b89cf0 deps: update to regex-syntax 0.8.11
• 1401679 regex-syntax-0.8.11
• d709000 changelog: 1.12.4
• 9825c74 syntax: avoid re-canonicalizing the entire IntervalSet on push (#1308)
• a7f2ff6 docs: clarify regex-lite word boundaries
• 2c7b172 docs: clarify unsupported Anchored::Pattern searches
• 839d16b regex-syntax-0.8.10
• c4865a0 syntax: fix negation handling in HIR translation
• d8761c0 cargo: also include benches
• Additional commits viewable in compare view

Updates time from 0.3.47 to 0.3.48

Changelog

Sourced from time's changelog.

0.3.48 [2026-06-12]

Security

• The number of digits parsed by [subsecond digits:1+] is capped at 32 to avoid parsing unbounded user input. Digits after the 9th have no semantic meaning.
• Explicitly specify #[repr] for Weekday. The value of the variants is relied upon in multiple locations for soundness. The practical effect of this change is nothing, as Rust has always mapped C-like enums to 0..N in memory.

Compatibility

• Non-UTF-8 formatting and parsing is deprecated without replacement. It is recommended to only format and parse valid UTF-8.
• format_description::parse is deprecated. It is recommended to use format_description::parse_borrowed::<3> or format_description::parse_owned::<3>.

Added

• All types in the unit module have a generic parameter, though this is currently not used for much. Usage will be expanded in the future.
• Comparisons between types in the unit module and the generic Unit type are permitted.
• Support for rand 0.10
• Version 3 format descriptions
  • Only UTF-8 is supported. As a side effect of this, [ignore] requires that the remaining input not begin mid-codepoint.
  • Representation is deliberately opaque to allow for arbitrary changes going forward.
  • format:false is supported on [optional] components. This is not possible in version 1 and version 2 format descriptions due to API compatibility.
  • The time::serde::format_description! macro uses a new, clearer syntax for version 3.
    • time::serde::format_description!(mod foo [Date] = "[year]-[month]-[day]");
    • Unlike version 1 and version 2 format descriptions, the type is not automatically brought into scope. You must import it yourself.
  • Nonsensical combinations of modifiers are rejected. For example, you cannot specify case-sensitivity when parsing a numerical month.
  • [year] defaults to range:standard
  • Components and modifiers are case sensitive (and always lowercase).

Changed

• The convert module has been renamed to unit.

Fixed

• Macro hygiene has been improved by specifying re-exports.
• Fix handling of T in ISO 8601
• Support parsing the full range of UTC offset hours
• Version 1 nested format descriptions may now start with a component. Previously, a lexer bug unintentionally prohibited this.
• Error when ISO week date overflows the max year. This would previously panic.

... (truncated)

Commits

• 5d8737c v0.3.48 release
• 1bfca87 Use widen instead of extend in sys code
• c57284f fix: return error instead of panicking on truncated strftime padding modifier
• a74f35f Use v3 format descriptions for serde defaults
• 96ff36c Allow eliding serde format description version
• edc58b1 Permit duplicates in v1/v2 in permit_modifiers!
• a838f69 Bump codecov action
• f2f99f8 Fix unused warning
• 7eda800 Refactor format description parsing
• cccc2c0 Directly construct owned variants when parsing v3
• Additional commits viewable in compare view

Updates libc from 0.2.183 to 0.2.186

Release notes

Sourced from libc's releases.

0.2.186

Added

• Apple: Add KEVENT_FLAG_* constants (#5070)
• Linux: Add PR_SET_MEMORY_MERGE and PR_GET_MEMORY_MERGE (#5060)

Changed

• CI: Migrate FreeBSD CI from Cirrus CI to GitHub Actions (#5058)

0.2.185

Added

• EspIDF: Add espidf_picolibc cfg for picolibc O_* flag values (#5035)
• Hexagon: add missing constants and fix types for linux-musl (#5042)
• Redox: Add semaphore functions (#5051)
• Windows: Add sprintf, snprintf, and the scanf family (#5024)

Fixed

• Hexagon: Decouple time64 types from musl symbol redirects (#5040)
• Horizon: Change POLL constants from c_short to c_int (#5045)

0.2.184

MSRV

This release increases the MSRV of libc to 1.65. With this update, you can now always use the core::ffi::c_* types with libc definitions, since libc has been changed to reexport from core rather than redefining them. (This usually worked before but had edge cases.) (#4972)

Added

• BSD: Add IP_MINTTL to bsd (#5026)
• Cygwin: Add TIOCM_DSR (#5031)
• FreeBSD: Added xfile structe and file descriptor types (#5002)
• Linux: Add CAN netlink bindings (#5011)
• Linux: Add struct ethhdr (#4239)
• Linux: Add struct ifinfomsg (#5012)
• Linux: Define max_align_t for riscv64 (#5029)
• NetBSD: Add missing CLOCK_ constants (#5020)
• NuttX: Add _SC_HOST_NAME_MAX (#5004)
• VxWorks: Add flock and F_*LCK constants (#4043)
• WASI: Add all _SC_* sysconf constants (#5023)

Deprecated

The remaining fixed-width integer aliases, __uint128_t, __uint128, __int128_t, and __int128, have been deprecated. Use i128 and u128 instead. (#4343)

... (truncated)

Changelog

Sourced from libc's changelog.

0.2.186 - 2026-04-24

Added

• Apple: Add KEVENT_FLAG_* constants (#5070)
• Linux: Add PR_SET_MEMORY_MERGE and PR_GET_MEMORY_MERGE (#5060)

Changed

• CI: Migrate FreeBSD CI from Cirrus CI to GitHub Actions (#5058)

0.2.185 - 2026-04-13

Added

• EspIDF: Add espidf_picolibc cfg for picolibc O_* flag values (#5035)
• Hexagon: add missing constants and fix types for linux-musl (#5042)
• Redox: Add semaphore functions (#5051)
• Windows: Add sprintf, snprintf, and the scanf family (#5024)

Fixed

• Hexagon: Decouple time64 types from musl symbol redirects (#5040)
• Horizon: Change POLL constants from c_short to c_int (#5045)

0.2.184 - 2026-04-01

MSRV

This release increases the MSRV of libc to 1.65. With this update, you can now always use the core::ffi::c_* types with libc definitions, since libc has been changed to reexport from core rather than redefining them. (This usually worked before but had edge cases.) (#4972)

Added

• BSD: Add IP_MINTTL to bsd (#5026)
• Cygwin: Add TIOCM_DSR (#5031)
• FreeBSD: Added xfile structe and file descriptor types (#5002)
• Linux: Add CAN netlink bindings (#5011)
• Linux: Add struct ethhdr (#4239)
• Linux: Add struct ifinfomsg (#5012)
• Linux: Define max_align_t for riscv64 (#5029)
• NetBSD: Add missing CLOCK_ constants (#5020)
• NuttX: Add _SC_HOST_NAME_MAX (#5004)
• VxWorks: Add flock and F_*LCK constants (#4043)
• WASI: Add all _SC_* sysconf constants (#5023)

Deprecated

... (truncated)

Commits

• 42620ff [0.2] libc: Release 0.2.186
• 9db2eaa apple: add KEVENT_FLAG_* constants
• 3840939 Add PR_SET_MEMORY_MERGE and PR_GET_MEMORY_MERGE for linux
• f697deb chore: migrate from Cirrus CI to GHA
• 71d5bfc libc: Release 0.2.185
• 1027d1c Revert "ci: Pin nightly to 2026-04-01"
• 0e9c6e5 redox: Add semaphore functions
• 24ef457 feat: add back support for gnu windows x86 in ci
• aa75caf horizon: Change POLL constants from c_short to c_int
• b7eda5a hexagon: add missing constants and fix types for linux-musl
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Dependabot Assessment

Dependencies changed (all patch bumps in /packages):

• regex 1.12.3 → 1.12.4: performance optimization for large character class compilation; no behavioral changes
• time 0.3.47 → 0.3.48: security fix — caps subsecond digit parsing at 32 digits to prevent unbounded input; also adds deprecation warnings for non-UTF-8 formatting/parsing and format_description::parse (old APIs still work)
• libc 0.2.183 → 0.2.186: additive-only (new constants for Apple/Linux); 0.2.184 raised MSRV to Rust 1.65 (no impact since we target stable Rust)

Risk: Low. All three are patch bumps with no breaking changes. The time update is a security hardening fix, making it actively beneficial to merge.

CI status: Several checks are still in progress (Pre-commit, Security Audit, build/*). Cannot merge until CI completes.

Decision: Will auto-approve and merge (squash) once all CI checks pass. ✓