Vulnerability RUSTSEC-2026-0537

The 0.49.3 fix stopped an overflow when a PRUNE backoff is first stored, but a backoff just small enough to be stored could still overflow later. On each heartbeat, expired backoffs were found with backoff_time + slack > now, which panics when the stored time is close to the largest Instant. A peer that sends one PRUNE with such a backoff crashes the node a heartbeat or so later, and can repeat it after every restart.

The fix caps a remote PRUNE backoff at one hour, uses checked_add for the heartbeat comparison, and replaces other unchecked time arithmetic in the behaviour, peer scoring and time cache with checked or saturating operations. It is in 0.49.4.