Updated outdated dependencies

[coot]

• Fixed deprecation warning generated by random >= 1.3.0
• Updated outdated dependencies

[andreasabel]

@dcoutts : Could you approve the workflow run?

[gorban]

I tested the proposed merge against the dependency versions used by our application, rather than only testing the older Hackage releases. This gives a red/green result for the compatibility work here.

Exact source and environment

• Base: 6ef2791ca41b397a3e36c868ad3e66a0d09f19b2.
• PR head: b47b5752a8d79debc98e6c0b5cd1fb147f137b99.
• Tested tree: a clean, uncommitted merge of that head into that base; no additional source/test patches.
• Linux, GHC 9.14.1/base 4.22.0.0, Cabal 3.16.1.0, optimization 2, debug information enabled, LLVM lld.
• Frozen application versions include containers 0.8, time 1.15, bytestring 0.12.2.0, primitive 0.9.1.0, QuickCheck 2.18.0.0, aeson 2.3.1.0 and random 1.3.1. The additional upstream test dependency resolved to quickcheck-instances 0.4. Hackage index-state: 2026-09-12T04:56:46Z.

Before/after

Check	Base	Proposed merge
Resolve against the frozen application versions, without allow-newer	Fails: Serialise requires time <1.15	Passes
Strict Cborg/Serialise build and upstream suites	With only the PR's relevant bound differences relaxed diagnostically, Cborg tests fail on deprecated uniformShortByteString	290 Cborg + 406 Serialise tests pass with -Werror, no allow-newer, no downstream patches
Application server-runtime integration with merged libraries	Not rerun against base	53 examples, 0 failures, including TLS 1.2/1.3 negotiation, rejection of older TLS versions, and distinct-peer pre-handshake observability

The diagnostic base run relaxed only serialise:time, serialise:QuickCheck, cborg:QuickCheck and cborg:aeson, to get past the bounds and isolate the source change. It failed at cborg/tests/Tests/Properties.hs:1037 with [-Wdeprecations, -Werror=deprecations], recommending uniformShortByteStringM. The merged run needs none of those relaxations.

For the strict runs, our project explicitly sets:

package cborg
  ghc-options: -Werror
package serialise
  ghc-options: -Werror

This does not inherit the upstream root project's -Wno-error=deprecations. We retain the packages' own Cabal declarations. Both library and test components rebuild under the strict options. The experiment began with an empty separate Cabal store; later comparison runs reuse only dependencies built within that experiment and have separate build directories.

What this PR resolves for us

Together with fixes already on master, this PR lets us build and test Cborg/Serialise against our application’s pinned GHC 9.14 dependencies with -Werror, without our bounds exceptions, warning allowances, or test patch. A release containing these changes would let us retire those workarounds. Happy to provide the reproduction commands and logs.

[andreasabel]

@gorban: Your comment looks LLM generated, sorry. What is the point of copying it here? What is the point it is trying to make?
We are all still learning how to deal with the new technology. But I think if we are not willing to read and digest LLM output into a concise (human-written) message, we should not impose it on others by dumping it on issue trackers etc.

[gorban]

The short of it, I tested it and this PR also improves our build. I am looking forward, along with a PR or two elsewhere, to open up our ability to build a working stack, on newer GHC and with treating warnings as errors (strict build -Werror). Right now, I can use workarounds and allow-newer, which I would like to retire. Will keep things concise in the future here until someone explicitly asks for the details.