Bump the cargo group across 1 directory with 5 updates

[dependabot]

Bumps the cargo group with 5 updates in the /packages directory:

Package	From	To
time	0.3.44	0.3.47
jsonwebtoken	9.3.1	10.3.0
wasmtime	41.0.2	41.0.4
bytes	1.10.1	1.11.1
keccak	0.1.5	0.1.6

Updates time from 0.3.44 to 0.3.47

Release notes

Sourced from time's releases.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.47 [2026-02-05]

Security

• The possibility of a stack exhaustion denial of service attack when parsing RFC 2822 has been eliminated. Previously, it was possible to craft input that would cause unbounded recursion. Now, the depth of the recursion is tracked, causing an error to be returned if it exceeds a reasonable limit.

  This attack vector requires parsing user-provided input, with any type, using the RFC 2822 format.

Compatibility

• Attempting to format a value with a well-known format (i.e. RFC 3339, RFC 2822, or ISO 8601) will error at compile time if the type being formatted does not provide sufficient information. This would previously fail at runtime. Similarly, attempting to format a value with ISO 8601 that is only configured for parsing (i.e. Iso8601::PARSING) will error at compile time.

Added

• Builder methods for format description modifiers, eliminating the need for verbose initialization when done manually.
• date!(2026-W01-2) is now supported. Previously, a space was required between W and 01.
• [end] now has a trailing_input modifier which can either be prohibit (the default) or discard. When it is discard, all remaining input is ignored. Note that if there are components after [end], they will still attempt to be parsed, likely resulting in an error.

Changed

• More performance gains when parsing.

Fixed

• If manually formatting a value, the number of bytes written was one short for some components. This has been fixed such that the number of bytes written is always correct.
• The possibility of integer overflow when parsing an owned format description has been effectively eliminated. This would previously wrap when overflow checks were disabled. Instead of storing the depth as u8, it is stored as u32. This would require multiple gigabytes of nested input to overflow, at which point we've got other problems and trivial mitigations are available by downstream users.

0.3.46 [2026-01-23]

Added

• All possible panics are now documented for the relevant methods.
• The need to use #[serde(default)] when using custom serde formats is documented. This applies only when deserializing an Option<T>.
• Duration::nanoseconds_i128 has been made public, mirroring std::time::Duration::from_nanos_u128.

... (truncated)

Commits

• d5144cd v0.3.47 release
• f6206b0 Guard against integer overflow in release mode
• 1c63dc7 Avoid denial of service when parsing Rfc2822
• 5940df6 Add builder methods to avoid verbose construction
• 00881a4 Manually format macros everywhere
• bb723b6 Add trailing_input modifier to end
• 31c4f8e Permit W12 in date! macro
• 490a17b Mark error paths in well-known formats as cold
• 6cb1896 Optimize Rfc2822 parsing
• 6d264d5 Remove erroneous #[inline(never)] attributes
• Additional commits viewable in compare view

Updates jsonwebtoken from 9.3.1 to 10.3.0

Changelog

Sourced from jsonwebtoken's changelog.

10.3.0 (2026-01-27)

• Export everything needed to define your own CryptoProvider
• Fix type confusion with exp/nbf when not required

10.2.0 (2025-11-06)

• Remove Clone bound from decode functions

10.1.0 (2025-10-18)

• add dangerous::insecure_decode
• Implement TryFrom &Jwk for DecodingKey

10.0.0 (2025-09-29)

• BREAKING: now using traits for crypto backends, you have to choose between aws_lc_rs and rust_crypto
• Add Clone bound to decode
• Support decoding byte slices
• Support JWS

Commits

• abbc307 Fix type confusion
• e99740d fix: bump minimal version requirements (#481)
• 50d15e0 Use try_sign to avoid panics (#479)
• 245858f Bump some dep
• 122c2ed Bump action number in CI
• 72e0c7f Expose cryptography backends via CryptoProvider (#452)
• 53a3fc2 Do not fail for clippy
• 3226cfc Prepare for release
• dfe58f9 Remove unnecessary Clone bounds from decode functions (#458)
• 9b3e19c Fix function names in README (#457)
• Additional commits viewable in compare view

Updates wasmtime from 41.0.2 to 41.0.4

Release notes

Sourced from wasmtime's releases.

v41.0.4

41.0.4

Released 2026-02-24.

Changed

• Wasmtime's implementation of WASI now has the ability to limit resource consumption on behalf of the guest, such as host-allocated memory. This means that some behaviors previously allowed by Wasmtime can now disallowed, such as transferring excessive data from the guest to the host. Additionally calls to wasi:random/random.get-random-bytes, for example, can have limits in place to avoid allocating too much memory on the host. To preserve backwards-compatible behavior these limits are NOT set by default. Embedders must opt-in to configuring these knobs as appropriate for their embeddings. For more information on this see the related security advisory with further details on knobs added and what behaviors can be restricted. GHSA-852m-cvvp-9p4w

Fixed

• Panics when adding too many headers to a wasi:http/types.fields has been resolved GHSA-243v-98vx-264h

• Panic when dropping a [Typed]Func::call_async future. GHSA-xjhv-v822-pf94

v41.0.3

41.0.3

Released 2026-02-04.

Fixed

• Fix an incorrect mid-end optimization rule that could cause a compiler panic due to mismatched types. #12504

Changelog

Sourced from wasmtime's changelog.

41.0.4

Released 2026-02-24.

Changed

• Wasmtime's implementation of WASI now has the ability to limit resource consumption on behalf of the guest, such as host-allocated memory. This means that some behaviors previously allowed by Wasmtime can now disallowed, such as transferring excessive data from the guest to the host. Additionally calls to wasi:random/random.get-random-bytes, for example, can have limits in place to avoid allocating too much memory on the host. To preserve backwards-compatible behavior these limits are NOT set by default. Embedders must opt-in to configuring these knobs as appropriate for their embeddings. For more information on this see the related security advisory with further details on knobs added and what behaviors can be restricted. GHSA-852m-cvvp-9p4w

Fixed

• Panics when adding too many headers to a wasi:http/types.fields has been resolved GHSA-243v-98vx-264h

• Panic when dropping a [Typed]Func::call_async future. GHSA-xjhv-v822-pf94

---

41.0.3

Released 2026-02-04.

Fixed

• Fix an incorrect mid-end optimization rule that could cause a compiler panic due to mismatched types. #12504

---

Commits

• d938a9d Release Wasmtime 41.0.4 (#12654)
• d86b007 [41.0.x] Backport fixes for security advisories (#12650)
• db1c043 Release Wasmtime 41.0.3 (#12529)
• 604f64b [41.0] Backport Cranelift: mid-end: fix constant types in some icmp/select ru...
• See full diff in compare view

Updates bytes from 1.10.1 to 1.11.1

Release notes

Sourced from bytes's releases.

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

• Fix integer overflow in BytesMut::reserve

Bytes v1.11.0

1.11.0 (November 14th, 2025)

• Bump MSRV to 1.57 (#788)

Fixed

• fix: BytesMut only reuse if src has remaining (#803)
• Specialize BytesMut::put::<Bytes> (#793)
• Reserve capacity in BytesMut::put (#794)
• Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

• Guarantee address in slice() for empty slices. (#780)
• Rename Vtable::to_* -> Vtable::into_* (#776)
• Fix latest clippy warnings (#787)
• Ignore BytesMut::freeze doctest on wasm (#790)
• Move drop_fn of from_owner into vtable (#801)

Changelog

Sourced from bytes's changelog.

1.11.1 (February 3rd, 2026)

• Fix integer overflow in BytesMut::reserve

1.11.0 (November 14th, 2025)

• Bump MSRV to 1.57 (#788)

Fixed

• fix: BytesMut only reuse if src has remaining (#803)
• Specialize BytesMut::put::<Bytes> (#793)
• Reserve capacity in BytesMut::put (#794)
• Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

• Guarantee address in slice() for empty slices. (#780)
• Rename Vtable::to_* -> Vtable::into_* (#776)
• Fix latest clippy warnings (#787)
• Ignore BytesMut::freeze doctest on wasm (#790)
• Move drop_fn of from_owner into vtable (#801)

Commits

• 417dccd Release bytes v1.11.1 (#820)
• d0293b0 Merge commit from fork
• a7952fb chore: prepare bytes v1.11.0 (#804)
• 60cbb77 fix: BytesMut only reuse if src has remaining (#803)
• 7ce330f Move drop_fn of from_owner into vtable (#801)
• 4b53a29 Tweak BytesMut::remaining_mut (#795)
• 016fdbd Reserve capacity in BytesMut::put (#794)
• ef7f257 Specialize BytesMut::put::<Bytes> (#793)
• 8b4f54d Ignore BytesMut::freeze doctest on wasm (#790)
• 16132ad Fix latest clippy warnings (#787)
• Additional commits viewable in compare view

Updates keccak from 0.1.5 to 0.1.6

Commits

• a8936d9 keccak v0.1.6
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.