Skip to content

chore(deps): bump rand from 0.8.5 to 0.9.2 in the cargo group across 1 directory#8

Merged
anidotnet merged 2 commits into
mainfrom
dependabot/cargo/cargo-39cecc6af4
Jul 23, 2026
Merged

chore(deps): bump rand from 0.8.5 to 0.9.2 in the cargo group across 1 directory#8
anidotnet merged 2 commits into
mainfrom
dependabot/cargo/cargo-39cecc6af4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the cargo group with 1 update in the / directory: rand.

Updates rand from 0.8.5 to 0.9.2

Changelog

Sourced from rand's changelog.

[0.9.2] - 2025-07-20

Deprecated

  • Deprecate rand::rngs::mock module and StepRng generator (#1634)

Additions

  • Enable WeightedIndex<usize> (de)serialization (#1646)

[0.9.1] - 2025-04-17

Security and unsafe

  • Revise "not a crypto library" policy again (#1565)
  • Remove zerocopy dependency from rand (#1579)

Fixes

  • Fix feature simd_support for recent nightly rust (#1586)

Changes

  • Allow fn rand::seq::index::sample_weighted and fn IndexedRandom::choose_multiple_weighted to return fewer than amount results (#1623), reverting an undocumented change (#1382) to the previous release.

Additions

  • Add rand::distr::Alphabetic distribution. (#1587)
  • Re-export rand_core (#1604)

#1565: rust-random/rand#1565 #1579: rust-random/rand#1579 #1586: rust-random/rand#1586 #1587: rust-random/rand#1587 #1604: rust-random/rand#1604 #1623: rust-random/rand#1623 #1634: rust-random/rand#1634 #1646: rust-random/rand#1646

[0.9.0] - 2025-01-27

Security and unsafe

  • Policy: "rand is not a crypto library" (#1514)
  • Remove fork-protection from ReseedingRng and ThreadRng. Instead, it is recommended to call ThreadRng::reseed on fork. (#1379)
  • Use zerocopy to replace some unsafe code (#1349, #1393, #1446, #1502)

Dependencies

  • Bump the MSRV to 1.63.0 (#1207, #1246, #1269, #1341, #1416, #1536); note that 1.60.0 may work for dependents when using --ignore-rust-version
  • Update to rand_core v0.9.0 (#1558)

Features

  • Support std feature without getrandom or rand_chacha (#1354)
  • Enable feature small_rng by default (#1455)
  • Remove implicit feature rand_chacha; use std_rng instead. (#1473)
  • Rename feature serde1 to serde (#1477)
  • Rename feature getrandom to os_rng (#1537)

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 10, 2026
@anidotnet

anidotnet commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
chore(deps): bump rand in the cargo group across 1 directory
2f30ad9 
Bumps the cargo group with 1 update in the / directory: [rand](https://github.com/rust-random/rand).


Updates `rand` from 0.8.5 to 0.9.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...rand_core-0.9.2)

---
updated-dependencies:
- dependency-name: rand
  dependency-version: 0.9.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-39cecc6af4 branch from 15432fd to 2f30ad9 Compare July 21, 2026 09:25
@anidotnet @claude
fix: keep nitrite's rand pinned at 0.8.5, only bump other crates to 0.9
b6e6782 
Dependabot bumped the exact `rand = "=0.8.5"` pin in nitrite/Cargo.toml
to 0.9.2, ignoring the adjacent comment explaining why it's pinned:
rand 0.9's OsRng uses rand_core 0.9, but argon2's password-hash crate
requires rand_core 0.6's CryptoRng/CryptoRngCore traits, which OsRng no
longer satisfies. This broke the nitrite crate build (6 compile errors
in snowflake.rs and security.rs). Reverting just that pin back to
0.8.5 keeps the rand_distr/argon2 chain working while still taking the
0.8 -> 0.9 bump in nitrite-bench, nitrite-spatial, and nitrite-vector,
which don't hit this conflict.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@codecov

codecov Bot commented Jul 23, 2026

Copy link
Copy Markdown

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

@anidotnet
anidotnet merged commit babc22d into main Jul 23, 2026
6 of 7 checks passed
@anidotnet
anidotnet deleted the dependabot/cargo/cargo-39cecc6af4 branch July 23, 2026 18:34
This was referenced Jul 23, 2026
Merged
Merged
anidotnet added a commit that referenced this pull request Jul 24, 2026
@anidotnet @claude
chore(deps): revert rand to 0.8 workspace-wide and pin it in dependab…
6f35485 
…ot config (#10)

nitrite-bench, nitrite-spatial, and nitrite-vector were bumped to rand
0.9 in PR #8, while nitrite/Cargo.toml stayed pinned at 0.8.5 (rand
0.9's OsRng doesn't satisfy the rand_core 0.6 CryptoRng/CryptoRngCore
traits that argon2's password-hash crate needs). Dependabot doesn't
know about that constraint and keeps reopening the same broken bump
(PR #9). Revert the three crates back to rand 0.8 so the whole
workspace uses one rand major version, and add .github/dependabot.yml
with an ignore rule so Dependabot stops proposing rand >=0.9.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
anidotnet added a commit that referenced this pull request Jul 24, 2026
@anidotnet @claude
chore(deps): bump lru from 0.16.3 to 0.18.1 in nitrite-fjall-adapter (#…
3ffd62f 
…11)

Fixes an open low-severity Dependabot advisory. Cherry-picked out of
PR #9, which bundled this together with a rand 0.8.5->0.9.2 bump that
breaks the build (see #8, #10).

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@anidotnet