chore(deps): update rust crate rand_core to 0.10

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
rand_core (source)	dependencies	minor	0.6 → 0.10

---

Release Notes

rust-random/rand_core (rand_core)

v0.10.1

Compare Source

Fixed

• Reference to the rand crate in TryRng docs (#​75)

v0.10.0

This release makes a number of significant changes which we hope will be the
last significant breakage before 1.0. Code has moved from the rust-random/rand
repository to its own rust-random/rand_core.

User-facing API changes

Changed

• Edition changed to 2024 and MSRV bumped to 1.85 (rand#1668)
• RngCore and TryRngCore are renamed to Rng and TryRng respectively (#​54)
• Rng is now an extension trait of TryRng<Error = Infallible> (#​45)
• TryRng::Error is bound on core::error::Error instead of Debug + Display (#​58)
• Relax Sized bound on impls of SeedableRng (rand#1641)

Added

• SeedableRng::{fork, try_fork} methods (#​17)
• Re-export of core::convert::Infallible (#​56)

Removed

• TryRng::read_adapter method (replaced with rand::RngReader) (rand#1669)
• os_rng crate feature (rand#1674)
• OsRng and OsError structs (rand#1674)
• SeedableRng::from_os_rng and SeedableRng::try_from_os_rng methods (rand#1674)
• getrandom dependency (rand#1674)
• std crate feature (rand#1674)
• Optional serde dependency (#​28)
• UnwrapMut struct and Rng::unwrap_mut method (#​45)
• Rng::unwrap_err method in favor of explicit wrapping in UnwrapErr (#​53)

API changes to PRNG implementation helpers

Added

• BlockRng::reconstruct and BlockRng::remaining_results methods (#​36)
• block::Generator::drop method (#​35)
• BlockRng::word_offset method (#​44)

Changed

• Replaced le helper functions with new utils helpers (rand#1667, #​34, #​38, #​45)
• Rename BlockRng::generate_and_set method to reset_and_skip (#​44)
• Rename block::BlockRngCore trait to block::Generator (#​26)
• Rename BlockRngCore::Results associated type to Output and remove type bounds on it (#​26)

Removed

• Implementation of Rng for BlockRng, making the latter more generic (#​34)
• BlockRng64 struct (#​34)
• BlockRng::reset method (#​44)
• BlockRng::index method (replaced with BlockRng::word_offset) (#​44)
• Generator::Item associated type (#​26)
• CryptoBlockRng (#​69)

v0.9.4

Compare Source

v0.9.3

Compare Source

This release makes a number of significant changes which we hope will be the
last significant breakage before 1.0. Code has moved from the rust-random/rand
repository to its own rust-random/rand_core.

User-facing API changes

Changed

• Edition changed to 2024 and MSRV bumped to 1.85 (rand#1668)
• RngCore and TryRngCore are renamed to Rng and TryRng respectively (#​54)
• Rng is now an extension trait of TryRng<Error = Infallible> (#​45)
• TryRng::Error is bound on core::error::Error instead of Debug + Display (#​58)
• Relax Sized bound on impls of SeedableRng (rand#1641)

Added

• SeedableRng::{fork, try_fork} methods (#​17)
• Re-export of core::convert::Infallible (#​56)

Removed

• TryRng::read_adapter method (replaced with rand::RngReader) (rand#1669)
• os_rng crate feature (rand#1674)
• OsRng and OsError structs (rand#1674)
• SeedableRng::from_os_rng and SeedableRng::try_from_os_rng methods (rand#1674)
• getrandom dependency (rand#1674)
• std crate feature (rand#1674)
• Optional serde dependency (#​28)
• UnwrapMut struct and Rng::unwrap_mut method (#​45)
• Rng::unwrap_err method in favor of explicit wrapping in UnwrapErr (#​53)

API changes to PRNG implementation helpers

Added

• BlockRng::reconstruct and BlockRng::remaining_results methods (#​36)
• block::Generator::drop method (#​35)
• BlockRng::word_offset method (#​44)

Changed

• Replaced le helper functions with new utils helpers (rand#1667, #​34, #​38, #​45)
• Rename BlockRng::generate_and_set method to reset_and_skip (#​44)
• Rename block::BlockRngCore trait to block::Generator (#​26)
• Rename BlockRngCore::Results associated type to Output and remove type bounds on it (#​26)

Removed

• Implementation of Rng for BlockRng, making the latter more generic (#​34)
• BlockRng64 struct (#​34)
• BlockRng::reset method (#​44)
• BlockRng::index method (replaced with BlockRng::word_offset) (#​44)
• Generator::Item associated type (#​26)
• CryptoBlockRng (#​69)

v0.9.2

Compare Source

Other

• Remove zerocopy dependency (rand#1607)
• Deprecate rand_core::impls::fill_via_u32_chunks, fill_via_u64_chunks (rand#1607)

v0.9.1

Compare Source

API changes

• Relax Sized bound on impls of TryRngCore, TryCryptoRng and UnwrapMut (rand#1593)
• Add UnwrapMut::re to reborrow the inner rng with a tighter lifetime (rand#1595)

v0.9.0

Compare Source

API changes

• Add TryRngCore::unwrap_mut, providing an impl of RngCore over &mut rng (rand#1589)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Note

Update rand_core dependency to 0.10 in the Rust SDK

Bumps rand_core in Cargo.toml from 0.6 to 0.10.

^{Macroscope summarized 00f55a3.}

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 73cb8f9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🟢 WAVE BugBot — clear

No confident findings on the changed lines.

_{Local review · $0 inference · wave-dispatch}

[devin-ai-integration]

Devin Review found 3 potential issues.

[devin-ai-integration]

🔴 Rust SDK no longer builds after the random-number library upgrade

The random-number library is upgraded to a version whose randomness source no longer exists (rand_core = "0.10" at sdk/rust/Cargo.toml:18) while the signing code still asks for that removed source, so the Rust SDK fails to build at all.
Impact: Anyone depending on or publishing the Rust client gets a broken package — no requests can be signed or sent.

Removed OsRng/RngCore items in rand_core 0.10 vs. the SDK's usage

sdk/rust/src/lib.rs:22-23 does use rand_core::{OsRng, RngCore}; OsRng.fill_bytes(&mut nonce_bytes); to build the CDP-JWT nonce. rand_core 0.10 removed OsRng (and the os_rng/getrandom support) entirely and renamed RngCore to Rng, so both imports resolve to nothing. Additionally, p256 = "0.13" (sdk/rust/Cargo.toml:17) is built against the rand_core 0.6 trait family, so even after fixing the import the two crates would not share RNG traits. Either keep rand_core = "0.6" (matching the accompanying comment and p256 0.13), or migrate the nonce generation to getrandom/rand and upgrade p256 accordingly.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 Dependency change to the published client is not recorded in the changelog

A user-facing dependency requirement of the published Rust client is changed (rand_core = "0.10" at sdk/rust/Cargo.toml:18) without adding an entry under the Unreleased section of the changelog, which the repository contract requires.
Impact: Consumers of the SDK get an undocumented dependency change.

Repository rule

AGENTS.md states: "Conventional Commit titles; update CHANGELOG.md (Unreleased) for user-facing changes." The ## [Unreleased] section of CHANGELOG.md is empty in this PR.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔍 No lockfile or CI build for the Rust SDK to catch dependency drift

There is no Cargo.lock committed under sdk/rust/, and the change here is dependency-only, so nothing in the repo pins or verifies the resolved rand_core version. If CI does not run cargo build for sdk/rust, a bad requirement would only surface at publish time. Worth confirming a Rust build gate exists.

(Refers to lines 12-18)

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in f4d43a4. Unresolved review comments identify a build-breaking issue: rand_core 0.10 doesn't exist on crates.io, and versions 0.9+ have incompatible API changes that would prevent the Rust SDK from compiling. Human review needed to resolve the dependency conflict.

No code changes detected at 00f55a3. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🔍 No CHANGELOG entry for the dependency change of a published crate

AGENTS.md asks for a CHANGELOG.md Unreleased entry for user-facing changes. A dependency major bump in a published crate (wave-dispatch) changes the resolved dependency graph for consumers, so it is arguably user-facing; the Unreleased section is currently empty. Worth confirming the repo's convention for dependency-only PRs (e.g. Renovate-generated) before requiring an entry.

---

Was this helpful? React with 👍 or 👎 to provide feedback.