chore(deps): revert rand to 0.8 workspace-wide and pin it in dependabot config

[anidotnet]

Summary

• Reverts rand in nitrite-bench, nitrite-spatial, and nitrite-vector from 0.9 back to 0.8, so the whole workspace uses a single rand major version (matching nitrite's existing =0.8.5 pin).
• Adds .github/dependabot.yml with an ignore rule for rand >=0.9.0, since rand 0.9's OsRng doesn't satisfy the rand_core 0.6 CryptoRng/CryptoRngCore traits that argon2's password-hash crate needs. This is the same conflict that broke chore(deps): bump rand from 0.8.5 to 0.9.2 in the cargo group across 1 directory #8 and that dependabot re-proposed in chore(deps): bump rand from 0.8.5 to 0.9.2 in the cargo group across 1 directory #9 (dependabot has no way to know about this constraint on its own).
• Follow-up to chore(deps): bump rand from 0.8.5 to 0.9.2 in the cargo group across 1 directory #8, and supersedes/closes chore(deps): bump rand from 0.8.5 to 0.9.2 in the cargo group across 1 directory #9.

Test plan

• cargo build --workspace — clean, no errors
• cargo test --workspace — all passing

Summary by CodeRabbit

• Chores
  • Added weekly automated checks for Rust dependency updates.
  • Pinned the rand dependency to version 0.8 across benchmarking, spatial, and vector components.
  • Preserved existing random-number generator functionality and compatibility with related components.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: af21ec34-c8ef-4f79-9dcf-c89c6014365c

📥 Commits

Reviewing files that changed from the base of the PR and between babc22d and 391e91e.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/dependabot.yml
• nitrite-bench/Cargo.toml
• nitrite-spatial/Cargo.toml
• nitrite-vector/Cargo.toml

---

📝 Walkthrough

Walkthrough

Dependabot is configured for weekly Cargo updates while ignoring rand versions >=0.9.0. The benchmark, spatial, and vector packages now specify rand 0.8; the vector package retains the small_rng feature.

Changes

rand version pinning

Layer / File(s)	Summary
Configure rand dependency pinning .github/dependabot.yml, nitrite-bench/Cargo.toml, nitrite-spatial/Cargo.toml, nitrite-vector/Cargo.toml	Dependabot ignores rand 0.9 or newer updates, and the three package manifests use rand 0.8. The vector dependency continues to enable small_rng.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR keeps rand at 0.8 and adds an ignore rule, so it does not fulfill #9’s requested 0.9.2 upgrade and related compatibility updates.	Implement the rand 0.9.2 upgrade in the root Cargo group, update renamed features and rand_core 0.9 usage, then verify the workspace builds successfully.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: reverting rand to 0.8 workspace-wide and pinning Dependabot against 0.9+ updates.
Out of Scope Changes check	✅ Passed	The diff is tightly scoped to reverting rand versions and Dependabot pinning, with no unrelated changes visible in the reviewed files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pin-rand-0.8.5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.89%. Comparing base (babc22d) to head (391e91e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #10   +/-   ##
=======================================
  Coverage   93.89%   93.89%           
=======================================
  Files         156      156           
  Lines       73638    73638           
=======================================
+ Hits        69140    69141    +1     
+ Misses       4498     4497    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.