fix(deps): migrate to rand 0.10 and protect reset keys - #18
Merged
Merged
Conversation
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/cargo/cargo-40d972a74b
branch
2 times, most recently
from
September 22, 2026 20:36
a89a312 to
1b6bc58
Compare
Bumps the cargo group with 1 update in the / directory: [rand](https://github.com/rust-random/rand). Updates `rand` from 0.9.5 to 0.10.2 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](rust-random/rand@0.9.5...0.10.2) --- updated-dependencies: - dependency-name: rand dependency-version: 0.10.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/cargo/cargo-40d972a74b
branch
from
September 25, 2026 21:41
1b6bc58 to
85e4527
Compare
rldyourmnd
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
W10.2/W10.6 increment. The rand 0.10 dependency update failed owned-transport builds because the reset-key constructor used the removed
RngCorename. Requirerand::CryptoRngat this cryptographic boundary, keeping the existing thread-local secure generator. The workspace requirement is 0.10 and the lockfile resolves its consumers to 0.10.3, already present transitively.Also redact the reset key's
Debugoutput and compare authentication tags throughblake3::Hash::eq, which preserves the library's constant-time comparison. Key, message, tag-length/tamper and debug-redaction regressions cover the boundary; the keyed-BLAKE3 algorithm and wire format are unchanged.Local validation: formatting; all-feature, default and X11 workspace clippy with warnings denied; 176 owned-transport/relay tests; and 557 combined workspace tests passed (zero failures, three explicit ignores). All GitHub checks passed for final head
3a5bd15db4618e7048565b2bad68a3c57cf82c9b: Linux/macOS tests and lint, native packaging, CodeQL, supply chain, and the Vector/OpenObserve pipeline. Linux logs also confirm the bounded owned-relay scenario, native H.264 reference recovery and seven dedicated Xvfb capture/input checks. This branch includes #33, now merged first, so the final combined source was exercised. No deployment or new release is introduced.Primary API references: rand 0.10 migration, CryptoRng, BLAKE3 Hash comparison.