chore(deps): bump rand 0.10.0 to 0.10.1 and 0.9.2 to 0.9.4

[thomasqueirozb]

Summary

Bumps rand 0.10.0 to 0.10.1, rand 0.9.2 to 0.9.4, and adds RUSTSEC-2026-0097 ignore for rand 0.8.5 (transitive dependency from upstream crates not yet updated to rand 0.9+).

Technically possible to upgrade to remove rand 0.8 dependency:

• apache-avro 0.16.0 -> 0.21.0
• hickory-proto/resolver 0.24.4 -> 0.25.2
• mongodb 3.3.0 -> 3.5.2
• num-bigint-dig 0.8.6 -> 0.9.1
• tokio-retry 0.3.0 -> 0.3.1
• tokio-websockets 0.10.1 -> 0.13.2
• tower 0.4.13 -> 0.5.3
• tungstenite 0.20.1 -> 0.29.0

Blockers (no upstream fix available):

• async-nats 0.46.0 (0.47.0 still uses rand 0.8)
• nkeys 0.4.5
• oauth2 5.0.0
• openidconnect 4.0.1
• pulsar 6.7.1
• sqlx-mysql/sqlx-postgres 0.8.6
• domain 0.11.0 (used by vrl)

Vector configuration

NA

How did you test this PR?

cargo deny --log-level error --all-features check all passes.

Change Type

• Bug fix
• New feature
• Dependencies
• Non-functional (chore, refactoring, docs)
• Performance

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

References

• Related: https://rustsec.org/advisories/RUSTSEC-2026-0097