Skip to content

fix(deps): update rand to 0.8.6 - #478

Open
26Emily wants to merge 1 commit into
mainfrom
Emily/rand-security-fix
Open

fix(deps): update rand to 0.8.6#478
26Emily wants to merge 1 commit into
mainfrom
Emily/rand-security-fix

Conversation

@26Emily

@26Emily 26Emily commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Updates rand from 0.8.5 to 0.8.6 in Cargo.lock

@denjell-crabnebula

Copy link
Copy Markdown
Contributor

We don't modify the cargo.lock file like this, if you don't see it in the Cargo.toml, then it is a "transitive dependency".

@denjell-crabnebula denjell-crabnebula left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Find the responsible dep and update that.

@FabianLars-crabnebula

Copy link
Copy Markdown
Contributor

Hmm, i have to disagree with that, especially since cargo does not have a way to patch crates.io dependencies with crates.io dependencies. We can update all the rand dependents and it could still stay on 0.8.5 since virtually no library crates update the patch versions of their dependencies to keep wide compatibility.

Adding rand directly to the Cargo.toml dependencies may work but would be kinda ugly as well and against ecosystem standards.

We also have to keep in mind that this repo contains libraries (which should have lax min versions requirements) and bins (which should have secure lockfiles for installations via --locked and our prebuilt distributions).

@denjell-crabnebula

Copy link
Copy Markdown
Contributor

Sure - but you don't provide an answer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants