Skip to content

chore(deps): update rust crate rand_core to 0.10 #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update rust crate rand_core to 0.10 #26

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion sdk/rust/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,4 +15,4 @@ serde_json = "1"
base64 = "0.22" # 0.5.1 — wallet_hook(privy) needs Basic auth encoding
urlencoding = "2" # 0.5.1 — wallet_hook(privy) URL-encodes the wallet_id path segment
p256 = { version = "0.13", features = ["pkcs8", "ecdsa"] } # 0.6.2 — CDP-JWT (ES256) signing
rand_core = "0.6" # 0.6.2 — nonce randomness for CDP-JWT
rand_core = "0.10" # 0.6.2 — nonce randomness for CDP-JWT

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Rust SDK no longer builds after the random-number library upgrade

The random-number library is upgraded to a version whose randomness source no longer exists (rand_core = "0.10" at sdk/rust/Cargo.toml:18) while the signing code still asks for that removed source, so the Rust SDK fails to build at all.
Impact: Anyone depending on or publishing the Rust client gets a broken package — no requests can be signed or sent.

Removed OsRng/RngCore items in rand_core 0.10 vs. the SDK's usage

sdk/rust/src/lib.rs:22-23 does use rand_core::{OsRng, RngCore}; OsRng.fill_bytes(&mut nonce_bytes); to build the CDP-JWT nonce. rand_core 0.10 removed OsRng (and the os_rng/getrandom support) entirely and renamed RngCore to Rng, so both imports resolve to nothing. Additionally, p256 = "0.13" (sdk/rust/Cargo.toml:17) is built against the rand_core 0.6 trait family, so even after fixing the import the two crates would not share RNG traits. Either keep rand_core = "0.6" (matching the accompanying comment and p256 0.13), or migrate the nonce generation to getrandom/rand and upgrade p256 accordingly.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Dependency change to the published client is not recorded in the changelog

A user-facing dependency requirement of the published Rust client is changed (rand_core = "0.10" at sdk/rust/Cargo.toml:18) without adding an entry under the Unreleased section of the changelog, which the repository contract requires.
Impact: Consumers of the SDK get an undocumented dependency change.

Repository rule

AGENTS.md states: "Conventional Commit titles; update CHANGELOG.md (Unreleased) for user-facing changes." The ## [Unreleased] section of CHANGELOG.md is empty in this PR.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Comment on lines 15 to +18

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 No lockfile or CI build for the Rust SDK to catch dependency drift

There is no Cargo.lock committed under sdk/rust/, and the change here is dependency-only, so nothing in the repo pins or verifies the resolved rand_core version. If CI does not run cargo build for sdk/rust, a bad requirement would only surface at publish time. Worth confirming a Rust build gate exists.

(Refers to lines 12-18)

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 No CHANGELOG entry for the dependency change of a published crate

AGENTS.md asks for a CHANGELOG.md Unreleased entry for user-facing changes. A dependency major bump in a published crate (wave-dispatch) changes the resolved dependency graph for consumers, so it is arguably user-facing; the Unreleased section is currently empty. Worth confirming the repo's convention for dependency-only PRs (e.g. Renovate-generated) before requiring an entry.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Loading