fix: upgrade rand to 0.8.6 (RUSTSEC-2026-0097)

[agentotto]

Summary

Upgrades rand from 0.8 to 0.8.6 to address RUSTSEC-2026-0097.

Advisory

RUSTSEC-2026-0097: unsoundness in rand < 0.10.0 when log + thread_rng features are enabled and a custom logger accesses rand::rng().

Changes

• Bumped rand from 0.8 to 0.10 in walletkit-cli/Cargo.toml and walletkit-core/Cargo.toml
• No API changes needed (OsRng usage is compatible)

---

Note

Medium Risk
Large lockfile churn touches Ethereum (alloy), TLS/HTTP, and crypto-adjacent crates; removing the rand advisory ignore increases the chance CI fails or a vulnerable rand version remains in the graph if remediation is incomplete.

Overview
Addresses RUSTSEC-2026-0097 by tightening the direct rand dependency and updating the dependency graph, rather than changing application RNG call sites.

Direct rand: walletkit-cli and walletkit-core now require rand = "0.8.6" (was "0.8") for both normal and dev dependencies. Usage such as OsRng / RngCore is unchanged.

Policy: The RUSTSEC-2026-0097 entry is removed from deny.toml, so cargo-deny will report that advisory again instead of ignoring it.

Lockfile: Cargo.lock is regenerated with a broad transitive refresh (e.g. alloy 2.0.4 → 2.1.1 including new alloy-ens, reqwest/hyper/TLS, quinn pulling rand 0.10.2, semaphore-rs 0.5.4, wasm-bindgen bumps, and many routine patch updates). No Rust source files change in this diff.

Note for reviewers: The PR description mentions upgrading direct rand to 0.10; the manifests in this diff still pin 0.8.6—worth confirming that matches the intended advisory remediation and that cargo deny passes.

^{Reviewed by Cursor Bugbot for commit 69efce5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo tokio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Cargo.lock → cargo/tokio@1.52.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.52.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: cargo webpki-root-certs under CDLA-Permissive-2.0 License: CDLA-Permissive-2.0 - The applicable license policy does not permit this license (5) (webpki-root-certs-1.0.8/Cargo.toml) License: CDLA-Permissive-2.0 - The applicable license policy does not permit this license (5) (webpki-root-certs-1.0.8/LICENSE) From: ? → cargo/world-id-proof@0.11.0 → cargo/alloy@2.1.1 → cargo/webpki-root-certs@1.0.8 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/webpki-root-certs@1.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: cargo webpki-roots under CDLA-Permissive-2.0 License: CDLA-Permissive-2.0 - The applicable license policy does not permit this license (5) (webpki-roots-1.0.8/Cargo.toml) License: CDLA-Permissive-2.0 - The applicable license policy does not permit this license (5) (webpki-roots-1.0.8/LICENSE) From: ? → cargo/reqwest@0.12.28 → cargo/world-id-core@0.11.0 → cargo/world-id-proof@0.11.0 → cargo/alloy@2.1.1 → cargo/webpki-roots@1.0.8 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/webpki-roots@1.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: cargo yoke under Unicode-3.0 License: Unicode-3.0 - The applicable license policy does not permit this license (5) (yoke-0.8.3/LICENSE) From: ? → cargo/reqwest@0.12.28 → cargo/world-id-core@0.11.0 → cargo/world-id-proof@0.11.0 → cargo/alloy@2.1.1 → cargo/yoke@0.8.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/yoke@0.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo zerocopy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/mockito@1.7.2 → cargo/rand@0.8.6 → cargo/taceo-oprf@0.13.0 → cargo/alloy-core@1.6.0 → cargo/world-id-core@0.11.0 → cargo/world-id-proof@0.11.0 → cargo/semaphore-rs@0.5.4 → cargo/ruint@1.19.0 → cargo/alloy@2.1.1 → cargo/ciborium@0.2.2 → cargo/zerocopy@0.8.54 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.54. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: cargo zerofrom under Unicode-3.0 License: Unicode-3.0 - The applicable license policy does not permit this license (5) (zerofrom-0.1.8/LICENSE) From: ? → cargo/reqwest@0.12.28 → cargo/world-id-core@0.11.0 → cargo/world-id-proof@0.11.0 → cargo/alloy@2.1.1 → cargo/zerofrom@0.1.8 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerofrom@0.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report