build(deps): bump time from 0.3.53 to 0.3.55 in /apps/desktop/src-tauri

[dependabot]

Dependency outcome

Update the desktop Tauri lock from time 0.3.53 to 0.3.55 and time-macros 0.2.31 to 0.2.32. The update includes upstream correctness and robustness fixes for iterator bounds, timestamp deserialization, out-of-range nanosecond timestamps, offset conversion, and error propagation.

Upstream freshness was reverified against the authoritative time-rs/time release feed on 2026-08-16: v0.3.55, published 2026-08-01, remains the latest non-prerelease GitHub release. Its release-tag changelog records the same correctness fixes claimed here. This PR therefore remains aligned with the current upstream release rather than carrying a stale intermediate bump.

Exact current scope

Exact head: 966d5f1204ec90c303f8903e55f71f67bcba136d.
Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.

Exactly one file differs from protected develop:

• apps/desktop/src-tauri/Cargo.lock

The lock delta is limited to:

• time 0.3.53 → 0.3.55 plus checksum;
• time-macros 0.2.31 → 0.2.32 plus checksum.

No JavaScript manifest/lock, Python lock, Rust manifest, source, workflow, model, database, network, filesystem, IPC, or application-permission authority changes.

Exact-head verification

Repository checks for exact head 966d5f1204ec90c303f8903e55f71f67bcba136d:

• success: ci, release, bandit, sbom, secret-scan-gate, build-baseline, SAST Semgrep;
• failure: security-audit, aggregate Security Scan.

The security-audit log fails in the repository-wide npm audit before Rust audit executes. The reported high-severity findings are the protected-base JavaScript dependencies nanoid, pdfjs-dist, and undici; this PR has no npm manifest or lock delta. Canonical #783 owns that protected-base dependency remediation and must not be duplicated, suppressed, or partially copied into this Cargo lock PR. After #783 reaches protected develop, this exact dependency update must be regenerated or rebased and revalidated against the new base so Rust audit can complete on the resulting exact head.

Central OpenCode run 31818630238 attempt 2 used this exact head but failed before executing repository tests because the trusted central uv archive download returned HTTPError. The prerequisite is ContextualWisdomLab/.github#1008. Re-running the unchanged head before that prerequisite reaches protected central main would reproduce infrastructure failure rather than create valid review evidence.

Current actionable inline review threads are zero. There is no qualifying independent non-author exact-head approval; repeated OpenCode CHANGES_REQUESTED reviews reflect the central coverage prerequisite above.

Merge gate

• Lock delta is limited to the intended time/time-macros versions and checksums
• v0.3.55 is the latest authoritative upstream non-prerelease release as of 2026-08-16
• Repository build, release, SBOM, SAST, secret, and baseline checks pass on the exact head
• Current actionable inline review threads are zero
• fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 establishes a clean protected-develop JavaScript dependency baseline
• The Cargo update is regenerated/rebased on that protected base and all repository audits, including Rust audit, reach terminal success
• .github#1008 reaches protected central main
• Exact-current-head central coverage/review succeeds after the prerequisite
• Qualifying independent non-author exact-head approval satisfies the last-push rule
• Branch protection permits merge without bypass

Queued, in-progress, skipped, cancelled, inherited-base-only, predecessor-head, self/author, or administrative-bypass evidence is not success.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• apps/desktop/src-tauri/Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 94200280-de72-436b-bb7b-50a2f3952b91

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 9900a65fd077d698870f03cf525a5c09a82a79c2.

• Head SHA: 9900a65fd077d698870f03cf525a5c09a82a79c2

• Workflow run: 31002410269

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: Cargo.lock"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: Cargo.lock"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 966d5f1204ec90c303f8903e55f71f67bcba136d
• Workflow run: 31818630238
• Workflow attempt: 2
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 966d5f1204ec90c303f8903e55f71f67bcba136d.

• Head SHA: 966d5f1204ec90c303f8903e55f71f67bcba136d

• Workflow run: 31818630238

• Workflow attempt: 2

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: Cargo.lock"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: Cargo.lock"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 9ad57a95b1c395117dab0fb4b5e22582afffa40f.

• Head SHA: 9ad57a95b1c395117dab0fb4b5e22582afffa40f

• Workflow run: 31565238431

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

@dependabot recreate

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 966d5f1204ec90c303f8903e55f71f67bcba136d.

• Head SHA: 966d5f1204ec90c303f8903e55f71f67bcba136d

• Workflow run: 31818630238

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: Cargo.lock"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: Cargo.lock"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 966d5f1204ec90c303f8903e55f71f67bcba136d.

• Head SHA: 966d5f1204ec90c303f8903e55f71f67bcba136d

• Workflow run: 31818630238

• Workflow attempt: 2

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: Cargo.lock"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: Cargo.lock"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

Exact-head gate reconciliation for 966d5f1204ec90c303f8903e55f71f67bcba136d:

• Repository ci, build-baseline, release, sbom, SAST Semgrep, bandit, and secret-scan-gate have successful exact-head evidence. Whole-tree security-audit / aggregate Security Scan remain failed on the protected-base JavaScript dependency baseline owned by fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783; this Cargo-only PR does not waive or duplicate that repair.
• OpenCode dispatch run 31818630238 attempt 2 was inspected at coverage-evidence job 94896845378. Trusted workflow-source materialization, current PR merge-tree extraction, replay guard, and changed-file syntax gate all passed. Measure test and docstring evidence then failed before repository test execution with Could not materialize base Python locks: trusted uv archive download failed: HTTPError.
• That is the central trusted-uv materialization defect owned by ContextualWisdomLab/.github#1008 (d14ad6ca0260eabf1373213e76e521b98a57e86b), not a semantic finding against this Cargo.lock update.

Do not rerun or re-mention reviewer agents for this unchanged head while protected central main still lacks #1008. After #783 and the central prerequisite land, update/revalidate against the then-current protected develop, regenerate exact-head central coverage/review once, and require qualifying independent non-author approval plus branch protection. Failed inherited-base/central-infrastructure, predecessor-head, queued/skipped, self/author, or administrative-bypass evidence is not merge success.