chore(deps): bump rand from 0.8.5 to 0.8.6 - #89
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [rand](https://github.com/rust-random/rand) from 0.8.5 to 0.8.6. - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/0.8.6/CHANGELOG.md) - [Commits](rust-random/rand@0.8.5...0.8.6) --- updated-dependencies: - dependency-name: rand dependency-version: 0.8.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This was referenced Aug 6, 2026
bdelanghe
added a commit
that referenced
this pull request
Aug 6, 2026
…hem (#111) Closes #108. Discharges #89, #91 and #109. Remainder tracked in #112. The deps lane had never scanned this repo. .gitignore listed the TRACKED Cargo.lock — inert for git, which exempts tracked files, but osv-scanner applies the pattern literally and skipped the only lockfile, so --allow-no-lockfiles turned "scanned nothing" into a pass. Removed from .gitignore and from both generator sites so gen-config cannot put it back. before: 0 Extract calls, "No package sources found", GREEN after: 1 Extract call, 446 packages scanned, RED on 11 real findings Cleared 42 advisories on the way. #91/#109 are discharged by DELETION, not by bump: nothing imports wasmtime — crates/xtask is the only member that declares it and only ever shells out to a wasmtime binary — so dropping two .workspace lines removes 90 packages. Bumping would not have terminated anywhere useful (24.0.7 still carries 7 advisories; 47.0.3 is the first clean release and needs Rust 1.94 against a 1.88 pin). A prediction in the original PR body was wrong and the scan is what caught it: clearing the known 35 did not leave the lane green, because only 5 of 446 packages had been queried. A third commit then cleared the 7 reachable by cargo update alone. Deliberately no osv-scanner.toml. The 7 unmaintained-crate findings are the documented case for [[IgnoredVulns]], but that is an accepted-risk judgement for a maintainer, not a rider on a scanner fix; the other 4 are fixable and suppressing those would recreate exactly what this ends. All in #112. Supersedes #110, which fixed the same issue 18 minutes earlier and was duplicated because #108 was never claimed before work started. Two findings from it carried here: the @Checksum header is a hardcoded literal copied verbatim rather than computed (recomputing gives c08f83bd; no offset yields e902a214), and `gen-config --overwrite` would DROP the Trunk, hooksmith events, .direnv and .config sections, which exist in the file but in neither generator — so regenerating is not a safe way to apply this fix. cargo check --workspace --locked --all-targets passes.
Collaborator
|
Superseded by #111, merged as Closing so it stops ranking as open work, not because anything here was wrong. Generated by Claude Code |
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps rand from 0.8.5 to 0.8.6.
Changelog
Sourced from rand's changelog.
Commits
5309f250.8.6 (#1772): update for recent nightly rustc and backport #17641126d03When testing rustc 1.36, use compatible dependencies.143b602Add Cargo.lock.msrv.9be86f2Fix cross build test.5e0d50dDrop simd_support.8ff02f0Upgrade cache action.4ad0cc3Don't test for unsupported target architecture.258e6d0Address warning.9f0e676Mark some internal traits as potentially unused.6f123c1Workaround never constructed and never used warning.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.