Patch RUSTSEC-2026-0097 for rand 0.8

[xtqqczze]

Some crates still depend on rand 0.8, e.g. num-bigint

Reference: https://lib.rs/crates/rand/rev

[jhpratt]

Yeah, 0.8 was around for so long that tons of crates still support it. Assuming this isn't too difficult (I haven't looked at the patch), it would be great to see this backported.

[dhardy]

A clean update supporting modern nightly rustc wouldn't be completely trivial (the 0.9 patch is already slightly hacky there). The change itself is quite simple: remove all logging during reseeding.

I elected to follow our policy in SECURITY.md: to patch anything which was at some point in the last year the latest release. I can recognise that some people would like longer term support but my compensation / hour on this project is absurdly low.

Note: the advisory concerns unsound code which, by itself, is not a security vulnerability (hence no CVE is reported).

[dhardy]

Do make a PR against the 0.8 tag if you wish.

[jhpratt]

I don't blame you for not wanting to given the lack of compensation. I'm the same way and don't promise any backports for my crates.

I only noticed the advisory due to a routine audit in CI failing. What makes you say that patch wouldn't be straightforward, given that you say the change it simple (in and of itself)?

[dhardy]

It shouldn't be too hard but would require some CI tweaking and/or stripping out the SIMD code. See the v0.9 backport PRs: #1764, #1766.

[jhpratt]

Thanks; I'll take a look in the coming days most likely.