build(deps): bump time from 0.3.47 to 0.3.49 in /apps/desktop/src-tauri

[dependabot]

Bumps time from 0.3.47 to 0.3.49.

Release notes

Sourced from time's releases.

v0.3.49

See the changelog for details.

v0.3.48

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.49 [2026-06-13]

Fixed

• Due to a long-standing bug in the Rust compiler, v0.3.48 caused a number of crates to stop compiling. A patch has been added that avoids triggering the bug.

0.3.48 [2026-06-12] [YANKED]

Security

• The number of digits parsed by [subsecond digits:1+] is capped at 32 to avoid parsing unbounded user input. Digits after the 9th have no semantic meaning.
• Explicitly specify #[repr] for Weekday. The value of the variants is relied upon in multiple locations for soundness. The practical effect of this change is nothing, as Rust has always mapped C-like enums to 0..N in memory.

Compatibility

• Non-UTF-8 formatting and parsing is deprecated without replacement. It is recommended to only format and parse valid UTF-8.
• format_description::parse is deprecated. It is recommended to use format_description::parse_borrowed::<3> or format_description::parse_owned::<3>.

Added

• All types in the unit module have a generic parameter, though this is currently not used for much. Usage will be expanded in the future.
• Comparisons between types in the unit module and the generic Unit type are permitted.
• Support for rand 0.10
• Version 3 format descriptions
  • Only UTF-8 is supported. As a side effect of this, [ignore] requires that the remaining input not begin mid-codepoint.
  • Representation is deliberately opaque to allow for arbitrary changes going forward.
  • format:false is supported on [optional] components. This is not possible in version 1 and version 2 format descriptions due to API compatibility.
  • The time::serde::format_description! macro uses a new, clearer syntax for version 3.
    • time::serde::format_description!(mod foo [Date] = "[year]-[month]-[day]");
    • Unlike version 1 and version 2 format descriptions, the type is not automatically brought into scope. You must import it yourself.
  • Nonsensical combinations of modifiers are rejected. For example, you cannot specify case-sensitivity when parsing a numerical month.
  • [year] defaults to range:standard
  • Components and modifiers are case sensitive (and always lowercase).

Changed

• The convert module has been renamed to unit.

Fixed

... (truncated)

Commits

• ff8683c v0.3.49 release
• f189886 fix: resolve E0119 trait coherence error in rustc >= 1.95.0
• 5d8737c v0.3.48 release
• 1bfca87 Use widen instead of extend in sys code
• c57284f fix: return error instead of panicking on truncated strftime padding modifier
• a74f35f Use v3 format descriptions for serde defaults
• 96ff36c Allow eliding serde format description version
• edc58b1 Permit duplicates in v1/v2 in permit_modifiers!
• a838f69 Bump codecov action
• f2f99f8 Fix unused warning
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[opencode-agent]

OpenCode Agent could not approve because GitHub Checks were still pending before approval.

• Result: REQUEST_CHANGES
• Reason: current-head GitHub Checks did not all complete before the bounded approval wait ended for aaa57b37896bef82fb0e09efa033052bde438d64.
• Head SHA: aaa57b37896bef82fb0e09efa033052bde438d64
• Workflow run: 27635741632
• Workflow attempt: 1

Pending checks:

• ci/gate / ci / rust-check: QUEUED (https://github.com/Seongho-Bae/bandscope/actions/runs/27635743512/job/81722338075)
• build-baseline/build / windows / arm64: IN_PROGRESS (https://github.com/Seongho-Bae/bandscope/actions/runs/27635740888/job/81722328810)
• build-baseline/build / macos / amd64: QUEUED (https://github.com/Seongho-Bae/bandscope/actions/runs/27635740888/job/81722328953)

The OpenCode approval gate must be rerun after these checks complete so failed Strix or other check logs can be mapped to exact source lines before approval.

[opencode-agent]

OpenCode Review Overview

• Head SHA: d84bf7ee289803e2e20be9fad471bfe1e4f03e8f
• Workflow run: 27749524965
• Workflow attempt: 1
• Gate result: APPROVE (approval step)

Pull request overview

PR updates Cargo.lock by removing an unused dependency (powerfmt) from the deranged crate. The build passed, indicating no breakage.

Findings

No blocking findings from OpenCode's independent review.

Verification

• Review source: independent OpenCode review of the current checkout, focused changed hunks, and current-head GitHub Check evidence.
• Structural exploration: completed before approval; if structural exploration, changed-file inspection, or evidence completeness is missing, OpenCode must not approve.
• Result: APPROVE
• Reason: Lockfile update removes unused dependency; build passed

Gate evidence

• Head SHA: d84bf7ee289803e2e20be9fad471bfe1e4f03e8f
• Workflow run: 27749524965
• Workflow attempt: 1

[github-actions]

@coderabbitai review

Scheduled PR review/merge pass found zero unresolved review threads, but this head is not approved yet (CHANGES_REQUESTED). Please review this current head so the normal merge gate can decide it.

[opencode-agent]

Pull request overview

PR updates Cargo.lock by removing an unused dependency (powerfmt) from the deranged crate. The build passed, indicating no breakage.

Findings

No blocking findings from OpenCode's independent review.

Verification

• Review source: independent OpenCode review of the current checkout, focused changed hunks, and current-head GitHub Check evidence.
• Structural exploration: completed before approval; if structural exploration, changed-file inspection, or evidence completeness is missing, OpenCode must not approve.
• Result: APPROVE
• Reason: Lockfile update removes unused dependency; build passed

Gate evidence

• Head SHA: d84bf7ee289803e2e20be9fad471bfe1e4f03e8f
• Workflow run: 27749524965
• Workflow attempt: 1

[seonghobae]

Merge evidence for current head d84bf7ee289803e2e20be9fad471bfe1e4f03e8f:

• Review threads: none open.
• OpenCode: APPROVED on current head after rerun; stale earlier REQUEST_CHANGES was for pending checks on old head aaa57b3... and is superseded.
• Copilot: review attempt errored, but no unresolved threads exist.
• Structural scope checked: apps/desktop/src-tauri/Cargo.lock only; no Rust source, Tauri config, IPC, file handling, WebView, subprocess, model, export, or runtime code changed. Lockfile updates time 0.3.47 -> 0.3.49 with transitive time-core, time-macros, num-conv, and lock dependency edge cleanup.
• Required checks: CodeQL, ci / build-and-test, dependency-review, gate / build / macos, gate / build / windows, release-preflight, sbom, security-audit, and trivy-fs-scan are passing.
• Cross-platform build-baseline: Windows amd64/arm64 and macOS amd64/arm64 are passing.

The only remaining merge blocker is the known Scorecard code-scanning neutral result while the workflow-level scanner evidence is passing where present. I will temporarily remove only the Scorecard code-scanning tool from ruleset 14316398 for this merge and restore CodeQL/Scorecard/Trivy immediately after.