chore(deps): bump rand + rand_chacha to 0.10 (RngExt migration) - #52
Conversation
Combined bump of the rand + rand_chacha dev-deps (test/bench corpora only) to 0.10 — a version-locked pair, so Dependabot's separate #46 (rand) and #44 (rand_chacha) can't resolve independently. This does both bumps + the API migration in one PR. rand 0.9 renamed gen_range->random_range and gen()->random(); rand 0.10 then moved those off the Rng trait onto RngExt. Migrated all 51 call-sites (49 gen_range + 2 gen) and the 10 'use rand::{Rng, SeedableRng}' imports -> RngExt across src/ tests/ examples/. Verified: fmt, clippy --all-targets --all-features -D warnings, cargo test (default + experimental), MSRV 1.89 compile (rand 0.10.1 + rand_chacha 0.10.0 declare rust-version 1.85). Seeded ChaCha8Rng tests pass — they assert retrieval properties (self-retrieval, scalar/SIMD parity), robust to 0.10's changed range sampling. Supersedes #44 + #46.
Review Summary by QodoBump rand and rand_chacha to 0.10 with RngExt trait migration
WalkthroughsDescription• Migrate rand crate from 0.8→0.10 and rand_chacha from 0.3→0.10 • Update all RNG method calls: gen_range() → random_range() (49 sites) • Update all RNG method calls: .gen() → .random() (2 sites) • Replace use rand::Rng with use rand::RngExt across 10 files Diagramflowchart LR
A["rand 0.8 + rand_chacha 0.3"] -->|"API break: methods moved to RngExt"| B["rand 0.10 + rand_chacha 0.10"]
B -->|"Update imports: Rng → RngExt"| C["10 files updated"]
B -->|"Rename methods: gen_range → random_range"| D["49 call sites"]
B -->|"Rename methods: gen → random"| E["2 call sites"]
C --> F["All tests pass + MSRV 1.89 verified"]
D --> F
E --> F
File Changes2. examples/bench_rank.rs
|
Code Review by Qodo🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)
Great, no issues found!Qodo reviewed your code and found no material issues that require review |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the rand and rand_chacha dependencies to version 0.10 and refactors the codebase to use the updated API, including random_range and random methods. However, the reviewer identified several critical security risks, specifically pointing out that the Cargo.lock file contains non-existent versions of crates like anyhow, getrandom, and serde_json, as well as a suspicious new dependency named zmij. Furthermore, the migration to the RngExt trait was flagged as incorrect for the official rand library, reinforcing concerns about a potential supply chain attack.
random_range is longer than the old gen_range, pushing several .map(|_| rng.random_range(..)).collect() chains over the line width. rustfmt wraps them across lines. No behaviour change; fixes the cargo fmt --check gate (rustfmt under cargo 1.95.0).
2 participants
Remediates the two breaking Dependabot PRs #46 (rand 0.8→0.10) and #44 (rand_chacha 0.3→0.10), which were red because rand 0.10 is an API break. They are a version-locked pair, so neither resolves alone — this does both bumps + the migration in one PR.
Migration (mechanical, all dev-deps — test/bench corpora only)
gen_range→random_range(49 sites) and.gen()→.random()(2 sites).Rngtrait ontoRngExt→use rand::{Rng, SeedableRng}→use rand::{RngExt, SeedableRng}in all 10 files. (SeedableRng/ChaCha8Rng::seed_from_u64unchanged.)Verified locally (strict)
cargo fmt --check,clippy --all-targets --all-features -D warningscargo test(default and--features experimental) — all greenrust-version = 1.85;cargo +1.89.0 test --no-runcompiles cleanChaCha8Rngtests pass: they assert retrieval properties (self-retrieval at top-1, scalar↔SIMD parity), not specific RNG outputs, so 0.10s changed range-sampling doesnt perturb them.Supersedes #44 + #46 — theyll auto-close when this merges (rand/rand_chacha reach their targets). Merges under strict protection (CI + 1 non-self code-owner approval).