[renovate]

This PR contains the following updates:

Package	Type	Update	Change
rand (source)	dependencies	minor	0.8.5 → 0.9.0
rand (source)	dependencies	patch	0.9.2 → 0.9.3
rand (source)	dependencies	minor	0.8.5 → 0.9.3

---

Rand is unsound with a custom logger using rand::rng()

GHSA-cq8v-f236-94qc

More information

Details

It has been reported (by @​lopopolo) that the rand library is unsound (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:

• The log and thread_rng features are enabled
• A custom logger is defined
• The custom logger accesses rand::rng() (previously rand::thread_rng()) and calls any TryRng (previously RngCore) methods on ThreadRng
• The ThreadRng (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
• Trace-level logging is enabled or warn-level logging is enabled and the random source (the getrandom crate) is unable to provide a new seed

TryRng (previously RngCore) methods for ThreadRng use unsafe code to cast *mut BlockRng<ReseedingCore> to &mut BlockRng<ReseedingCore>. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of aliased mutable references is Undefined Behaviour, the behaviour of optimized builds is hard to predict.

Severity

Low

References

• https://github.com/rust-random/rand/pull/1763
• https://rustsec.org/advisories/RUSTSEC-2026-0097.html
• https://github.com/advisories/GHSA-cq8v-f236-94qc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rust-random/rand (rand)

v0.9.3

Compare Source

This release back-ports a fix from v0.10. See also [#​1763].

Changes

• Deprecate feature log (#​1764)
• Replace usages of doc_auto_cfg (#​1764)

Full Changelog: rust-random/rand@0.9.2...0.9.3

v0.9.2

Compare Source

Deprecated

• Deprecate rand::rngs::mock module and StepRng generator ([#​1634])

Additions

• Enable WeightedIndex<usize> (de)serialization ([#​1646])

v0.9.1

Compare Source

Security and unsafe

• Revise "not a crypto library" policy again (#​1565)
• Remove zerocopy dependency from rand (#​1579)

Fixes

• Fix feature simd_support for recent nightly rust (#​1586)

Changes

• Allow fn rand::seq::index::sample_weighted and fn IndexedRandom::choose_multiple_weighted to return fewer than amount results (#​1623), reverting an undocumented change ([#​1382]) to the previous release.

Additions

• Add rand::distr::Alphabetic distribution. (#​1587)
• Re-export rand_core (#​1604)

v0.9.0

Compare Source

Security and unsafe

• Policy: "rand is not a crypto library" (#​1514)
• Remove fork-protection from ReseedingRng and ThreadRng. Instead, it is recommended to call ThreadRng::reseed on fork. (#​1379)
• Use zerocopy to replace some unsafe code (#​1349, #​1393, #​1446, #​1502)

Dependencies

• Bump the MSRV to 1.63.0 (#​1207, #​1246, #​1269, #​1341, #​1416, #​1536); note that 1.60.0 may work for dependents when using --ignore-rust-version
• Update to rand_core v0.9.0 (#​1558)

Features

• Support std feature without getrandom or rand_chacha (#​1354)
• Enable feature small_rng by default (#​1455)
• Remove implicit feature rand_chacha; use std_rng instead. (#​1473)
• Rename feature serde1 to serde (#​1477)
• Rename feature getrandom to os_rng (#​1537)
• Add feature thread_rng (#​1547)

API changes: rand_core traits

• Add fn RngCore::read_adapter implementing std::io::Read (#​1267)
• Add trait CryptoBlockRng: BlockRngCore; make trait CryptoRng: RngCore (#​1273)
• Add traits TryRngCore, TryCryptoRng (#​1424, #​1499)
• Rename fn SeedableRng::from_rng -> try_from_rng and add infallible variant fn from_rng (#​1424)
• Rename fn SeedableRng::from_entropy -> from_os_rng and add fallible variant fn try_from_os_rng (#​1424)
• Add bounds Clone and AsRef to associated type SeedableRng::Seed (#​1491)

API changes: Rng trait and top-level fns

• Rename fn rand::thread_rng() to rand::rng() and remove from the prelude (#​1506)
• Remove fn rand::random() from the prelude (#​1506)
• Add top-level fns random_iter, random_range, random_bool, random_ratio, fill (#​1488)
• Re-introduce fn Rng::gen_iter as random_iter (#​1305, #​1500)
• Rename fn Rng::gen to random to avoid conflict with the new gen keyword in Rust 2024 (#​1438)
• Rename fns Rng::gen_range to random_range, gen_bool to random_bool, gen_ratio to random_ratio (#​1505)
• Annotate panicking methods with #[track_caller] (#​1442, #​1447)

API changes: RNGs

• Fix <SmallRng as SeedableRng>::Seed size to 256 bits (#​1455)
• Remove first parameter (rng) of ReseedingRng::new (#​1533)

API changes: Sequences

• Split trait SliceRandom into IndexedRandom, IndexedMutRandom, SliceRandom (#​1382)
• Add IndexedRandom::choose_multiple_array, index::sample_array (#​1453, #​1469)

API changes: Distributions: renames

• Rename module rand::distributions to rand::distr (#​1470)
• Rename distribution Standard to StandardUniform (#​1526)
• Move distr::Slice -> distr::slice::Choose, distr::EmptySlice -> distr::slice::Empty (#​1548)
• Rename trait distr::DistString -> distr::SampleString (#​1548)
• Rename distr::DistIter -> distr::Iter, distr::DistMap -> distr::Map (#​1548)

API changes: Distributions

• Relax Sized bound on Distribution<T> for &D (#​1278)
• Remove impl of Distribution<Option<T>> for StandardUniform (#​1526)
• Let distribution StandardUniform support all NonZero* types (#​1332)
• Fns {Uniform, UniformSampler}::{new, new_inclusive} return a Result (instead of potentially panicking) (#​1229)
• Distribution Uniform implements TryFrom instead of From for ranges (#​1229)
• Add UniformUsize (#​1487)
• Remove support for generating isize and usize values with StandardUniform, Uniform (except via UniformUsize) and Fill and usage as a WeightedAliasIndex weight (#​1487)
• Add impl DistString for distributions Slice<char> and Uniform<char> (#​1315)
• Add fn Slice::num_choices (#​1402)
• Add fn p() for distribution Bernoulli to access probability (#​1481)

API changes: Weighted distributions

• Add pub module rand::distr::weighted, moving WeightedIndex there (#​1548)
• Add trait weighted::Weight, allowing WeightedIndex to trap overflow (#​1353)
• Add fns weight, weights, total_weight to distribution WeightedIndex (#​1420)
• Rename enum WeightedError to weighted::Error, revising variants (#​1382) and mark as #[non_exhaustive] (#​1480)

API changes: SIMD

• Switch to std::simd, expand SIMD & docs (#​1239)

Reproducibility-breaking changes

• Make ReseedingRng::reseed discard remaining data from the last block generated (#​1379)
• Change fn SmallRng::seed_from_u64 implementation (#​1203)
• Allow UniformFloat::new samples and UniformFloat::sample_single to yield high (#​1462)
• Fix portability of distribution Slice (#​1469)
• Make Uniform for usize portable via UniformUsize (#​1487)
• Fix IndexdRandom::choose_multiple_weighted for very small seeds and optimize for large input length / low memory (#​1530)

Reproducibility-breaking optimisations

• Optimize fn sample_floyd, affecting output of rand::seq::index::sample and rand::seq::SliceRandom::choose_multiple (#​1277)
• New, faster algorithms for IteratorRandom::choose and choose_stable (#​1268)
• New, faster algorithms for SliceRandom::shuffle and partial_shuffle (#​1272)
• Optimize distribution Uniform: use Canon's method (single sampling) / Lemire's method (distribution sampling) for faster sampling (breaks value stability; #​1287)
• Optimize fn sample_single_inclusive for floats (+~20% perf) (#​1289)

Other optimisations

• Improve SmallRng initialization performance (#​1482)
• Optimise SIMD widening multiply (#​1247)

Other

• Add Cargo.lock.msrv file (#​1275)
• Reformat with rustfmt and enforce (#​1448)
• Apply Clippy suggestions and enforce (#​1448, #​1474)
• Move all benchmarks to new benches crate (#​1329, #​1439) and migrate to Criterion (#​1490)

Documentation

• Improve ThreadRng related docs (#​1257)
• Docs: enable experimental --generate-link-to-definition feature (#​1327)
• Better doc of crate features, use doc_auto_cfg (#​1411, #​1450)

v0.8.8

Compare Source

What's Changed

• v0.8: fix no-std + serde1 build by @​dhardy in #​1825

Full Changelog: rust-random/rand@0.8.7...0.8.8

v0.8.7

Compare Source

What's Changed

• rand v0.8.7: backport #​1790 by @​dhardy in #​1804

Full Changelog: rust-random/rand@0.8.6...0.8.7

v0.8.6

Compare Source

What's Changed

This release back-ports a fix from v0.10. See also #​1763.

Changes

• Deprecate feature log (#​1772)

• Drop the experimental simd_support feature.

New Contributors

• @​nwalfield made their first contribution in #​1772

Full Changelog: rust-random/rand@0.8.5...0.8.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 98065dc0-5623-4f95-ae43-75aab475a1fb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d79f3dea-c141-4cb2-b93b-da699659a003

📥 Commits

Reviewing files that changed from the base of the PR and between 2864216 and 1d36fa3.

⛔ Files ignored due to path filters (3)

• doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/beekem/Cargo.lock is excluded by !**/*.lock
• pkgs/dht/Cargo.lock is excluded by !**/*.lock
• pkgs/web-gen/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/beekem/Cargo.toml
• doc/2026-10-11T11-08-42Z_design_remaining_work/research-round2/toolchain/dl/p2panda-p2panda-core/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Three Cargo manifests update their declared rand dependency versions. Two change from 0.8.5 to 0.9.0. The third changes from 0.8.5 to 0.9.3.

Changes: rand dependency updates

Layer / File(s)	Summary
Update rand dependency pkgs/web-gen/Cargo.toml, doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/beekem/Cargo.toml, doc/2026-10-11T11-08-42Z_design_remaining_work/research-round2/toolchain/dl/p2panda-p2panda-core/Cargo.toml	The manifests update rand from 0.8.5 to 0.9.0 or 0.9.3. The enabled features in the beekem manifest remain unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 1d36f

The dependency updates do not establish a reachable advisory exposure in the inspected packages, so no concrete merge-blocking risk remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 1d36f

The reviewed Beekem lockfile selects a fixed rand release, but its manifest still permits affected earlier releases. That permissive-version condition predates this PR. The inspected consumer is a local simulation using a seeded RNG, and the advisory’s runtime trigger was not established.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated consumer scope is the local Beekem simulation and its process state. No remote attacker-controlled input, tenant-wide authority, or downstream production security control was established for this path. External deployment and consumer exposure remain unverified.

Security Findings and Attack Paths

• observed — The retained reportable finding concerns Beekem’s manifest permitting rand 0.9.0–0.9.2 despite the advisory fix at 0.9.3. The reviewed lock selects 0.9.5, and runtime attack-path reachability remains unknown. This is a permitted-resolution condition, not evidence that the reviewed operation-selection execution triggers the advisory.
• inferred — The permissive-version condition predates this PR: the base requirement also admitted an affected release, rand 0.8.5, while its lock selected fixed 0.8.8. With unchanged scoped consumers and explicit features, the comparison does not establish introduced or materially increased exposure.

Trust Boundaries and Controls

• inferred — The advisory requires log and thread_rng features plus a custom logger invoking ThreadRng during reseeding. Scoped inspection found seeded StdRng usage and did not establish that logger path. These are strong reachability counterevidence, not a guarantee about uninspected external consumers or runtime configuration.

Hardening Proposals

• proposed — Raise Beekem’s rand requirement to at least 0.9.3 and retain a fixed locked resolution so future dependency resolution cannot select the advisory-affected 0.9 releases.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the Rust rand dependency update to v0.9.3 and its security purpose. It accurately represents the main change, although it does not mention the separate update from v0.8.5 …
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

error: failed to parse manifest at `/tmp/renovate/repos/github/developing-today/code/doc/2026-10-11T11-08-42Z_design_remaining_work/research-round2/toolchain/dl/p2panda-p2panda-core/Cargo.toml`

Caused by:
  error inheriting `blake3` from workspace root manifest's `workspace.dependencies.blake3`

Caused by:
  failed to find a workspace root

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.