From 73721ec4c3616d1b751c4f9404a189aee615f702 Mon Sep 17 00:00:00 2001
From: Luca Tescari <luca@ltescari.ch>
Date: Tue, 11 Aug 2026 12:39:34 +0200
Subject: [PATCH] chore: release 1.3.1, bump rand to 0.8.6
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dependabot fired its first alert the moment the security fix landed on
`dev` (GHSA-cq8v-f236-94qc, low): rand < 0.8.6 is unsound with a custom
logger using `rand::rng()`. gitveil calls `OsRng.fill_bytes` directly and
never installs a custom logger, so it was not affected — but the bump is
free and clears the alert.

`cargo audit` is now down to one warning, RUSTSEC-2026-0190 in anyhow.
`cargo tree -i anyhow --target all` prints nothing: it is a Cargo.lock
entry that is not reachable in the resolved graph, so it is not compiled
into the binary.

Version bumped for the release carrying the key-name injection fix
(#28) and the GPG hardening (#29).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TYMP8eH52L6rNdjbukfuyZ
---
 Cargo.lock | 6 +++---
 Cargo.toml | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ce0ea4a..f2057cd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -282,7 +282,7 @@ dependencies = [
 
 [[package]]
 name = "gitveil"
-version = "1.3.0"
+version = "1.3.1"
 dependencies = [
  "aes",
  "byteorder",
@@ -456,9 +456,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha",
diff --git a/Cargo.toml b/Cargo.toml
index 52a1e36..0325041 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "gitveil"
-version = "1.3.0"
+version = "1.3.1"
 edition = "2021"
 description = "Transparent file encryption in git (git-crypt compatible)"
 license = "GPL-3.0-only"