fix(deps): update rust crate rand_core to 0.9#844
Conversation
|
📝 WalkthroughWalkthroughA dependency version bump for Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infrastructure/eid-wallet/src-tauri/Cargo.toml`:
- Line 32: rand_core 0.9 conflicts with argon2 → password-hash which requires
rand_core 0.6.4, causing duplicate trait versions; resolve by picking one
remediation: either (A) downgrade the explicit dependency "rand_core" in
Cargo.toml from 0.9 to 0.6.4 so a single rand_core version is used, then run
cargo update and replace any uses of password_hash::rand_core::OsRng with
rand_core::OsRng if necessary; or (B) upgrade argon2 to a release that depends
on rand_core 0.9 (if available), update Cargo.toml to that argon2 version and
run cargo update to unify versions; ensure after the change there is only one
rand_core entry in Cargo.lock and remove any cross-version OsRng usage.
|
|
||
| argon2 = { version = "0.5.3" } | ||
| rand_core = { version = "0.6", features = ["std"] } | ||
| rand_core = { version = "0.9", features = ["std"] } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n infrastructure/eid-wallet/src-tauri/Cargo.toml | head -50Repository: MetaState-Prototype-Project/prototype
Length of output: 1542
🌐 Web query:
rand_core 0.9 breaking changes API RngCore CryptoRng TryRngCore migration
💡 Result:
rand_core 0.9 (released 2025-01-27) breaking changes & migration notes
1) Fallible RNGs: move try_* methods to the new TryRngCore
TryRngCorewas added to represent RNGs that can fail (with an associatedError).RngCorenow represents infallible RNGs only. For infallible RNGs,TryRngCoreis intended to useError = Infallible. [2]- Migration:
- If your RNG can error: implement
TryRngCore(try_next_u32,try_next_u64,try_fill_bytes). [2] - If your RNG can’t error: implement
RngCoreas before and treat fallibility asInfalliblewhen needed. [2]
- If your RNG can error: implement
2) Crypto marker traits: CryptoRngCore replaced by CryptoRng: RngCore; add TryCryptoRng
CryptoRngis now a sub-trait ofRngCore(replacingCryptoRngCore). For fallible crypto RNGs, useTryCryptoRng(overTryRngCore). [1], [2]
3) SeedableRng constructor renames (common compile break)
SeedableRng::from_rng→try_from_rng, and a new infalliblefrom_rngvariant was added. [1]SeedableRng::from_entropy→from_os_rng, plustry_from_os_rng. [1]SeedableRng::Seedgot extra bounds:CloneandAsRef<[u8]>. [1], [2]
4) Feature / dependency renames that often break Cargo.toml
- Feature
serde1→serde; featuregetrandom→os_rng. [1] - MSRV bumped to Rust 1.63;
getrandomupdated to 0.3.0. [1]
If you share a small snippet of what fails (e.g., your trait bounds / impls), I can translate it to the exact 0.9-style bounds and trait impls.
🌐 Web query:
getrandom 0.3 breaking changes WASM
💡 Result:
getrandom 0.3.0 (released 2025-01-25) changed WASM support in a few breaking ways:
wasm32-wasitarget removed: switch towasm32-wasip1orwasm32-wasip2instead. [1]- Old WASM-related Cargo features were removed: the crate removed the
jsfeature (and alsocustom, etc.) in favor of configuration flags. [1] - New opt-in WASM backend selection model:
- Enable the backend via the
wasm_jsCargo feature. [1][2] - Then select it with the cfg flag
getrandom_backend="wasm_js"(the feature alone doesn’t select it). [1][2]
- Enable the backend via the
Example (for wasm32-unknown-unknown):
# Cargo.toml
getrandom = { version = "0.3", features = ["wasm_js"] }# .cargo/config.toml
[target.wasm32-unknown-unknown]
rustflags = ['--cfg', 'getrandom_backend="wasm_js"']Also in 0.3.0, the wasm_js backend dropped a special Node.js codepath, which bumps the minimum supported Node.js to v19. [1]
Sources: [1] [2]
🌐 Web query:
rand_core 0.9 MSRV minimum supported rust version
💡 Result:
rand_core 0.9.x sets rust-version = "1.63" in its published Cargo.toml, so the MSRV is Rust 1.63 (i.e., rustc >= 1.63). [1]
Sources: [1] (docs.rs)
Citations:
🏁 Script executed:
cd infrastructure/eid-wallet/src-tauri && rg "RngCore|CryptoRng|TryRngCore|SeedableRng|OsRng" --type rustRepository: MetaState-Prototype-Project/prototype
Length of output: 262
🏁 Script executed:
cd infrastructure/eid-wallet/src-tauri && grep -E "^getrandom|rand_core" Cargo.lock | head -20Repository: MetaState-Prototype-Project/prototype
Length of output: 337
🏁 Script executed:
find infrastructure/eid-wallet/src-tauri -name "Cargo.lock" -o -name "*.toml" | xargs grep getrandomRepository: MetaState-Prototype-Project/prototype
Length of output: 886
🌐 Web query:
argon2 0.5.3 rand_core 0.9 compatibility
💡 Result:
argon2 0.5.3 is not compatible with rand_core 0.9 (and thus not directly compatible with rand 0.9’s RNG types) because it pulls in password-hash 0.5, which in turn uses rand_core 0.6.4. That creates a different CryptoRng*/RngCore trait version than rand_core 0.9, so types like rand::rngs::OsRng (rand 0.9) won’t satisfy the traits expected by password-hash/argon2. [1][2][3]
What to do:
- For
argon20.5.3, use theOsRngre-exported bypassword-hash(i.e.,argon2::password_hash::rand_core::OsRng) so you’re usingrand_core0.6.4 end-to-end. [1][4] - If you must standardize on
rand_core/rand0.9 across your project, you’ll need a newerargon2/password-hashrelease line that also depends onrand_core0.9 (otherwise you can’t avoid the duplicatedrand_coreversions). [2][3]
Sources
argon20.5.3Cargo.toml(features +password-hashdep) — https://docs.rs/crate/argon2/0.5.3/source/Cargo.toml.orig [1]argon20.5.3Cargo.lockshowingpassword-hash 0.5.0 -> rand_core 0.6.4— https://docs.rs/crate/argon2/latest/source/Cargo.lock [2]- Rand 0.9 migration guide (rand/rand_core 0.9 line) — https://rust-random.github.io/book/update-0.9.html [3]
- Discussion of the “multiple versions of rand_core” /
OsRngmismatch with argon2 0.5.3 — https://stackoverflow.com/questions/79473286/ [4]
🏁 Script executed:
cd infrastructure/eid-wallet/src-tauri && head -30 src/funcs/mod.rs | grep -A 5 "password_hash\|OsRng"Repository: MetaState-Prototype-Project/prototype
Length of output: 459
rand_core 0.9 is incompatible with argon2 0.5.3 and creates duplicate trait versions in the build.
The project specifies rand_core = "0.9" (line 32), but argon2 0.5.3 depends on password-hash 0.5, which in turn requires rand_core 0.6.4. This causes both versions to coexist in Cargo.lock (rand_core 0.6.4 and 0.9.3), creating separate trait hierarchies that cannot interoperate.
The code currently works around this by using password_hash::rand_core::OsRng (the 0.6.4 version), which bypasses the specified 0.9 dependency. However, this approach masks the underlying version conflict.
Options to resolve:
- Downgrade
rand_coreto 0.6.4 ifrand_core0.9 is not required by other dependencies. - Upgrade
argon2to a version compatible withrand_core0.9 (requires investigation into available releases). - Justify the 0.9 dependency if it serves other parts of the codebase; if so, migrate to a compatible password-hashing solution.
Without resolution, the build carries unnecessary trait duplication and the actual rand_core version in use differs from what's declared in Cargo.toml.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@infrastructure/eid-wallet/src-tauri/Cargo.toml` at line 32, rand_core 0.9
conflicts with argon2 → password-hash which requires rand_core 0.6.4, causing
duplicate trait versions; resolve by picking one remediation: either (A)
downgrade the explicit dependency "rand_core" in Cargo.toml from 0.9 to 0.6.4 so
a single rand_core version is used, then run cargo update and replace any uses
of password_hash::rand_core::OsRng with rand_core::OsRng if necessary; or (B)
upgrade argon2 to a release that depends on rand_core 0.9 (if available), update
Cargo.toml to that argon2 version and run cargo update to unify versions; ensure
after the change there is only one rand_core entry in Cargo.lock and remove any
cross-version OsRng usage.
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update ( If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
2 participants
This PR contains the following updates:
0.6→0.9Release Notes
rust-random/rand_core (rand_core)
v0.9.0Compare Source
API changes
TryRngCore::unwrap_mut, providing an impl ofRngCoreover&mut rng(rand#1589)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.