Skip to content

fix(deps): bump rand from 0.8 to 0.9#2

Open
raffaelschneider wants to merge 1 commit intozentinel-0.8.0from
deps/bump-rand-0.9-v0.8
Open

fix(deps): bump rand from 0.8 to 0.9#2
raffaelschneider wants to merge 1 commit intozentinel-0.8.0from
deps/bump-rand-0.9-v0.8

Conversation

@raffaelschneider
Copy link
Copy Markdown

Summary

  • Bumps rand from 0.8 to 0.9 across 7 crates to address RUSTSEC advisory (unsoundness with custom loggers using rand::rng())
  • Mechanical API migration: thread_rng()rng(), .gen().random(), .gen_range().random_range(), SliceRandomIndexedRandom, distributionsdistr
  • 16 files changed, 29 insertions, 29 deletions

Test plan

  • cargo check --workspace passes
  • cargo test --workspace --lib — all tests pass
  • CI

Addresses RUSTSEC advisory for rand <0.9.3 (unsound with custom
loggers using rand::rng()). Mechanical API migration across 7 crates:

- thread_rng() -> rng()
- .gen() -> .random()
- .gen_range() -> .random_range()
- SliceRandom -> IndexedRandom
- rand::prelude::ThreadRng -> rand::rngs::ThreadRng
- rand::distributions -> rand::distr
raffaelschneider added a commit to zentinelproxy/zentinel that referenced this pull request Apr 16, 2026
Update pingora fork rev to include rand 0.8→0.9 bump
(zentinelproxy/pingora#2), and update lockfile to pull
rand 0.9.4 and 0.10.1, resolving Dependabot alerts #43#45.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant