chore: Release candid 0.10.37

[lwshang]

Patch release of candid / candid_derive, 0.10.36 → 0.10.37. No source changes — it dates the two decoder fixes already on master.

Summary

• Bump candid and candid_derive 0.10.36 → 0.10.37, and the = pin between them
• Date the Unreleased changelog entries as 2026-09-25 / Candid 0.10.37, covering:
  • Bounding the byte length of the type-table header, 64 KiB by default and configurable with set_max_header_len (fix: Bound the type-table header by its byte length #770)
  • Bounding the size of a type named in a decoder diagnostic, so its rendering no longer follows the type's own width and depth (fix: Bound the size of a type named in a decoder diagnostic #771)
• Refresh Cargo.lock, rust/bench/Cargo.lock, tools/ui/Cargo.lock and rust/candid/fuzz/Cargo.lock

candid_parser is unchanged at 0.4.1; its dependency on candid is a 0.10.16 floor, so it needs no bump.

The lockfile diffs are version bumps only — no dependency churn.

All four lockfiles this time

The 0.10.36 release noted that rust/candid/fuzz/Cargo.lock was stale at 0.10.34 and that all four lockfiles should move together as a release-checklist step. This one does that, so fuzz goes 0.10.34 → 0.10.37.

tools/ui patches candid to the workspace path, so its lockfile pins the path crate's version and has to move with the bump. candid-ui-release.yml builds didjs there with --locked and triggers on the date tag, so a stale lock would only fail at tag time, after merge.

Test plan

• cargo check -p candid -p candid_derive -p candid_parser
• cargo test -p candid --features all — all suites pass
• cd tools/ui && cargo build --target wasm32-unknown-unknown --profile canister --package didjs --locked — the release workflow's exact command, succeeds
• cd rust/candid/fuzz && cargo check
• Reviewer to confirm release scope and changelog date

After merge

1. Tag 2026-09-25 on master — this is what candid-ui-release.yml triggers on to publish the candid_ui canister wasm
2. Run the Crates Publish workflow (workflow_dispatch) with the candid input checked, which publishes candid_derive then candid

🤖 Generated with Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 23f6a41.

Security Overview

• 🔎 Scanned files: 7 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/7ddf29dd-76dc-4f78-adfa-47ac8f4643e7?scanId=17ed9c3d-b0b2-4cae-828e-e1b25e02651f&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Refactor / Version bumps	► CHANGELOG.md     Bump changelog date and section from Unreleased to 2026-09-25
Bug Fix / Version bumps	► Cargo.lock     Bump candid and related crates from 0.10.36 to 0.10.37 across multiple packages
Refactor / Version bumps	► candid/Cargo.toml     Update candid version from 0.10.36 to 0.10.37 and align candid_derive dependency to 0.10.37
Refactor / Version bumps	► candid_derive/Cargo.toml     Update version from 0.10.36 to 0.10.37
Refactor / Version bumps	► rust/bench/Cargo.lock     Bump candid and candid_derive versions to 0.10.37
Refactor / Version bumps	► rust/candid/Cargo.toml     Update candid version to 0.10.37 and candid_derive dependency to 0.10.37
Refactor / Version bumps	► rust/candid/fuzz/Cargo.lock     Bump candid and candid_derive versions to 0.10.37
Refactor / Version bumps	► rust/candid_derive/Cargo.toml     Update version to 0.10.37
Refactor / Version bumps	► tools/ui/Cargo.lock     Bump candid and candid_derive versions to 0.10.37