Skip to content

chore(deps): bump rand from 0.8.7 to 0.10.2 - #1011

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rand-0.10.2
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rand-0.10.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor

Bumps rand from 0.8.7 to 0.10.2.

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

  • Document panic behavior of make_rng and add #[track_caller] (#1761)
  • Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

... (truncated)

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

This PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.

Link the matching evalops/mono source PR (legacy maestro-internal links remain accepted), then re-run the check:

  • https://github.com/evalops/mono/pull/<number>
  • evalops/mono#<number>
  • maestro-internal#<number>

Mirrored files touched:

  • Cargo.lock
  • Cargo.toml
  • packages/ambient-agent-rs/Cargo.toml

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0e32b4f819

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".


# Utilities
rand = "0.8"
rand = "0.10"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Migrate ambient token generation to rand 0.10

With rand = "0.10", src/ipc.rs still imports rand::RngCore and calls rand::thread_rng() to generate auth tokens. Rand 0.10's public API now exposes rng() and renamed the core trait to Rng/RngExt per its migration notes, so this crate fails to compile as soon as Cargo resolves the new manifest; please migrate the token generation call site along with the version bump. https://rust-random.github.io/book/update-0.10.html

Useful? React with 👍 / 👎.

Comment thread packages/tui-rs/Cargo.toml Outdated

# Random selection for tooltips
rand = "0.9"
rand = "0.10"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Migrate TUI rand call sites before bumping

With rand = "0.10", maestro-tui no longer gets the 0.9 extension trait imported by existing files (use rand::Rng for random/random_range, plus rand::RngCore in openai_cli.rs for fill_bytes). Rand 0.10 moved those user-level methods to RngExt and renamed RngCore to Rng, so the TUI target will not compile until these imports/calls are updated with the dependency bump. https://rust-random.github.io/book/update-0.10.html

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch 2 times, most recently from 0da24c2 to 493377c Compare August 16, 2026 04:49
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 493377c to 30cf8b2 Compare August 16, 2026 06:38
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 30cf8b2 to 021ffbb Compare August 17, 2026 18:18
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 021ffbb to a59ce09 Compare August 19, 2026 00:00
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from a59ce09 to 6b4188f Compare August 19, 2026 07:25
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 6b4188f to ab67581 Compare August 20, 2026 14:44
@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from ab67581 to 7416a2e Compare September 1, 2026 20:48
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 7416a2e to aacde6f Compare September 2, 2026 00:37
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch 2 times, most recently from 38388a0 to 9f8b931 Compare September 6, 2026 02:50
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 9f8b931 to 896fa97 Compare September 6, 2026 06:52
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 896fa97 to 6632536 Compare September 6, 2026 09:05
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 6632536 to 86b5503 Compare September 7, 2026 09:30
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@socket-security

socket-security Bot commented Sep 7, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedcargo/​rand@​0.8.7 ⏵ 0.8.810010093100100

View full report

@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 86b5503 to 6e1013d Compare September 7, 2026 21:25
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

Bumps [rand](https://github.com/rust-random/rand) from 0.8.7 to 0.10.2.
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.7...0.10.2)

---
updated-dependencies:
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/rand-0.10.2 branch from 6e1013d to 644fd31 Compare September 8, 2026 00:27
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@haasonsaas

Copy link
Copy Markdown
Contributor

Superseded by dx-corp/mono#9724 — this bump now lives in the mono source of truth and reaches code via the public mirror sync, which this mirror PR can never satisfy (provenance policy). Closing.

@haasonsaas haasonsaas closed this Sep 19, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 19, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/cargo/rand-0.10.2 branch September 19, 2026 04:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant