fix(deps): update rust-crate-deps-bumps

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
base64	dependencies	minor	0.22 → 0.23
borsh (source)	dependencies	minor	1.6.1 → 1.8.0
bullet-ws-interface (source)	dependencies	minor	0.2 → 0.3
getrandom	dependencies	minor	0.2 → 0.4
prettyplease	build-dependencies	minor	0.2 → 0.3
rand (source)	dependencies	minor	0.8 → 0.10
schemars (source)	build-dependencies	minor	0.8 → 0.9
sha2	dependencies	minor	0.10 → 0.11
tokio (source)	dependencies	minor	1.52.3 → 1.53.1
tokio (source)	dev-dependencies	minor	=1.52.3 → =1.53.1

---

Release Notes

marshallpierce/rust-base64 (base64)

v0.23.0

Compare Source

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best
  instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar
  GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime
  detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

near/borsh-rs (borsh)

v1.8.0

Compare Source

Added

• merge multiple #[borsh(...)] attributes instead of rejecting them (#​373)

Changed

• merge multiple #[borsh(...)] attributes instead of rejecting them (#​373)

v1.7.0

Compare Source

Added

• impl BorshSerialize and BorshDeserialize for Uuid (#​366)

Fixed

• handle PhantomData in enum schema derive (#​369)

Other

• cover schema predicate bounds referencing filtered enum params (#​372)
• fix the build on current toolchains (#​368)

bulletxyz/bullet-ws-interface (bullet-ws-interface)

v0.3.0

Compare Source

Features

• add universal SUBMIT client message, deprecate ORDER.* methods (#​20)

rust-random/getrandom (getrandom)

v0.4.3

Compare Source

Added

• wasm64-unknown-unknown target support for wasm_js backend #​848

Changed

• Drop wasip2 and wasip3 dependencies in favor of manual bindings #​830

v0.4.2

Compare Source

Changed

• Bump r-efi dependency to v6 #​814

Fixed

• Read errno only when it is set #​810
• Check the return value of ProcessPrng on Windows #​811

v0.4.1

Compare Source

Fixed

• Documentation build on docs.rs #​801

v0.4.0

Compare Source

Added

• RawOsError type alias #​739
• SysRng behind new feature sys_rng #​751
• WASIp3 support #​779
• extern_impl opt-in backend #​786 #​794
• Motor OS support #​797

Changed

• Use Edition 2024 and MSRV 1.85 #​749

v0.3.4

Compare Source

Major change to wasm_js backend

Now, when the wasm_js feature is enabled, the wasm_js backend will be used
by default. Users of wasm32-unknown-unknown targeting JavaScript environments
like the Web and Node.js will no longer need to specify:

--cfg getrandom_backend="wasm_js"

in RUSTFLAGS for the crate to compile. They can now simple enable a feature.

Note: this should not affect non-JS users of the wasm32-unknown-unknown
target. Using --cfg getrandom_backend will still override the source of
randomness even if the wasm_js feature is enabled. This includes
--cfg getrandom_backend=custom and --cfg getrandom_backend=unsupported.

For more information, see the discussions in #​671, #​675, and #​730.

Added

• unsupported opt-in backend #​667
• windows_legacy opt-in backend #​724

Changed

• Implement Memory Sanitizer unpoisoning more precisely #​678
• Relax MSRV for the linux_raw opt-in backend on ARM targets #​688
• Use getrandom syscall on all RISC-V Linux targets #​699
• Replaced wasi dependency with wasip2 #​721
• Enable wasm_js backend by default if the wasm_js feature is enabled #​730

Removed

• Unstable rustc-dep-of-std crate feature #​694

v0.3.3

Compare Source

Changed

• Doc improvements #​632 #​634 #​635
• Add crate version to docs.rs links used in compile_error!s #​639

Fixed

• Error handling in WASI p1 #​661

v0.3.2

Compare Source

Added

• efi_rng opt-in backend #​570
• linux_raw opt-in backend #​572
• .cargo/config.toml example in the crate-level docs #​591
• getrandom_test_linux_without_fallback configuration flag to test that file fallback
  is not triggered in the linux_android_with_fallback backend #​605
• Built-in support for *-linux-none targets #​618
• Cygwin support #​626

Changed

• Update wasi dependency to v0.14 #​594
• Add #[inline] attribute to the inner functions #​596
• Update WASI and Emscripten links in the crate-level docs #​597
• Do not use dlsym on MUSL targets in the linux_android_with_fallback backend #​602
• Remove linux_android.rs and use getrandom.rs instead #​603
• Always use RtlGenRandom on Windows targets when compiling with pre-1.78 Rust #​610
• Internal representation of the Error type #​614
• Remove windows-targets dependency and use raw-dylib directly #​627

Removed

• Error::INTERNAL_START and Error::CUSTOM_START associated constants #​614

v0.3.1

Compare Source

Fixed

• Build error on Android #​588

v0.3.0

Compare Source

Breaking Changes

Changed

• Bump MSRV to 1.63 #​542
• Rename getrandom and getrandom_uninit functions to fill and fill_uninit respectively #​532

Removed

• wasm32-wasi target support (use wasm32-wasip1 or wasm32-wasip2 instead) #​499
• linux_disable_fallback, rdrand, js, test-in-browser, and custom crate features
  in favor of configuration flags #​504
• register_custom_getrandom! macro #​504
• Implementation of From<NonZeroU32> for Error and Error::code method #​507
• Internet Explorer 11 support #​554
• Target-specific associated Error constants #​562

Changed

• Use ProcessPrng on Windows 10 and up, and use RtlGenRandom on older Windows versions #​415
• Do not use locale-specific strerror_r for retrieving error code descriptions #​440
• Avoid assuming usize is the native word size in the rdrand backend #​442
• Do not read from errno when libc did not indicate error on Solaris #​448
• Switch from libpthread's mutex to futex on Linux and to nanosleep-based wait loop
  on other targets in the use_file backend #​490
• Do not retry on EAGAIN while polling /dev/random on Linux #​522
• Remove separate codepath for Node.js in the wasm_js backend
  (bumps minimum supported Node.js version to v19) #​557
• Use js_namespace in the wasm_js backend #​559

Added

• wasm32-wasip1 and wasm32-wasip2 support #​499
• getrandom_backend configuration flag for selection of opt-in backends #​504
• Error::new_custom method #​507
• rndr opt-in backend #​512
• Automatic MemorySanitizer support #​521 #​571
• u32 and u64 functions for generating random values of the respective type #​544
• wasm32v1-none support in the wasm_js backend #​560
• wasm_js crate feature which allows users to enable the wasm_js opt-in backend #​574

Fixed

• NetBSD fallback code based on KERN_ARND #​555

dtolnay/prettyplease (prettyplease)

v0.3.0

Compare Source

• Update to syn 3 (release notes: https://github.com/dtolnay/syn/releases/tag/3.0.0)

rust-random/rand (rand)

v0.10.2

Compare Source

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#​1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#​1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#​1791)

v0.10.1

Compare Source

This release includes a fix for a soundness bug; see #​1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#​1761)
• Deprecate feature log (#​1763)

v0.10.0

Compare Source

Changes

• The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#​1642).
• Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#​1632)
• Use Edition 2024 and MSRV 1.85 (#​1653)
• Let Fill be implemented for element types, not sliceable types (#​1652)
• Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#​1665)
• Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#​1669)
• Remove fns SeedableRng::from_os_rng, try_from_os_rng (#​1674)
• Remove Clone support for StdRng, ReseedingRng (#​1677)
• Use postcard instead of bincode to test the serde feature (#​1693)
• Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#​1695)
• Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#​1697)
• Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#​1717)

Additions

• Add fns IndexedRandom::choose_iter, choose_weighted_iter (#​1632)
• Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#​1649)
• Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#​1659)
• Fn rand::make_rng() -> R where R: SeedableRng (#​1734)

Removals

• Removed ReseedingRng (#​1722)
• Removed unused feature "nightly" (#​1732)
• Removed feature small_rng (#​1732)

v0.9.5

Compare Source

What's Changed

• rand v0.9.5: backport #​1790 by @​dhardy in #​1803

Full Changelog: rust-random/rand@0.9.4...0.9.5

v0.9.4

Compare Source

Fixes

• Fix doc build (#​1766)

Full Changelog: rust-random/rand@0.9.3...0.9.4

v0.9.3

Compare Source

v0.9.2

Compare Source

Deprecated

• Deprecate rand::rngs::mock module and StepRng generator (#​1634)

Additions

• Enable WeightedIndex<usize> (de)serialization (#​1646)

v0.9.1

Compare Source

Security and unsafe

• Revise "not a crypto library" policy again (#​1565)
• Remove zerocopy dependency from rand (#​1579)

Fixes

• Fix feature simd_support for recent nightly rust (#​1586)

Changes

• Allow fn rand::seq::index::sample_weighted and fn IndexedRandom::choose_multiple_weighted to return fewer than amount results (#​1623), reverting an undocumented change (#​1382) to the previous release.

Additions

• Add rand::distr::Alphabetic distribution. (#​1587)
• Re-export rand_core (#​1604)

v0.9.0

Compare Source

Security and unsafe

• Policy: "rand is not a crypto library" (#​1514)
• Remove fork-protection from ReseedingRng and ThreadRng. Instead, it is recommended to call ThreadRng::reseed on fork. (#​1379)
• Use zerocopy to replace some unsafe code (#​1349, #​1393, #​1446, #​1502)

Dependencies

• Bump the MSRV to 1.63.0 (#​1207, #​1246, #​1269, #​1341, #​1416, #​1536); note that 1.60.0 may work for dependents when using --ignore-rust-version
• Update to rand_core v0.9.0 (#​1558)

Features

• Support std feature without getrandom or rand_chacha (#​1354)
• Enable feature small_rng by default (#​1455)
• Remove implicit feature rand_chacha; use std_rng instead. (#​1473)
• Rename feature serde1 to serde (#​1477)
• Rename feature getrandom to os_rng (#​1537)
• Add feature thread_rng (#​1547)

API changes: rand_core traits

• Add fn RngCore::read_adapter implementing std::io::Read (#​1267)
• Add trait CryptoBlockRng: BlockRngCore; make trait CryptoRng: RngCore (#​1273)
• Add traits TryRngCore, TryCryptoRng (#​1424, #​1499)
• Rename fn SeedableRng::from_rng -> try_from_rng and add infallible variant fn from_rng (#​1424)
• Rename fn SeedableRng::from_entropy -> from_os_rng and add fallible variant fn try_from_os_rng (#​1424)
• Add bounds Clone and AsRef to associated type SeedableRng::Seed (#​1491)

API changes: Rng trait and top-level fns

• Rename fn rand::thread_rng() to rand::rng() and remove from the prelude (#​1506)
• Remove fn rand::random() from the prelude (#​1506)
• Add top-level fns random_iter, random_range, random_bool, random_ratio, fill (#​1488)
• Re-introduce fn Rng::gen_iter as random_iter (#​1305, #​1500)
• Rename fn Rng::gen to random to avoid conflict with the new gen keyword in Rust 2024 (#​1438)
• Rename fns Rng::gen_range to random_range, gen_bool to random_bool, gen_ratio to random_ratio (#​1505)
• Annotate panicking methods with #[track_caller] (#​1442, #​1447)

API changes: RNGs

• Fix <SmallRng as SeedableRng>::Seed size to 256 bits (#​1455)
• Remove first parameter (rng) of ReseedingRng::new (#​1533)

API changes: Sequences

• Split trait SliceRandom into IndexedRandom, IndexedMutRandom, SliceRandom (#​1382)
• Add IndexedRandom::choose_multiple_array, index::sample_array (#​1453, #​1469)

API changes: Distributions: renames

• Rename module rand::distributions to rand::distr (#​1470)
• Rename distribution Standard to StandardUniform (#​1526)
• Move distr::Slice -> distr::slice::Choose, distr::EmptySlice -> distr::slice::Empty (#​1548)
• Rename trait distr::DistString -> distr::SampleString (#​1548)
• Rename distr::DistIter -> distr::Iter, distr::DistMap -> distr::Map (#​1548)

API changes: Distributions

• Relax Sized bound on Distribution<T> for &D (#​1278)
• Remove impl of Distribution<Option<T>> for StandardUniform (#​1526)
• Let distribution StandardUniform support all NonZero* types (#​1332)
• Fns {Uniform, UniformSampler}::{new, new_inclusive} return a Result (instead of potentially panicking) (#​1229)
• Distribution Uniform implements TryFrom instead of From for ranges (#​1229)
• Add UniformUsize (#​1487)
• Remove support for generating isize and usize values with StandardUniform, Uniform (except via UniformUsize) and Fill and usage as a WeightedAliasIndex weight (#​1487)
• Add impl DistString for distributions Slice<char> and Uniform<char> (#​1315)
• Add fn Slice::num_choices (#​1402)
• Add fn p() for distribution Bernoulli to access probability (#​1481)

API changes: Weighted distributions

• Add pub module rand::distr::weighted, moving WeightedIndex there (#​1548)
• Add trait weighted::Weight, allowing WeightedIndex to trap overflow (#​1353)
• Add fns weight, weights, total_weight to distribution WeightedIndex (#​1420)
• Rename enum WeightedError to weighted::Error, revising variants (#​1382) and mark as #[non_exhaustive] (#​1480)

API changes: SIMD

• Switch to std::simd, expand SIMD & docs (#​1239)

Reproducibility-breaking changes

• Make ReseedingRng::reseed discard remaining data from the last block generated (#​1379)
• Change fn SmallRng::seed_from_u64 implementation (#​1203)
• Allow UniformFloat::new samples and UniformFloat::sample_single to yield high (#​1462)
• Fix portability of distribution Slice (#​1469)
• Make Uniform for usize portable via UniformUsize (#​1487)
• Fix IndexdRandom::choose_multiple_weighted for very small seeds and optimize for large input length / low memory (#​1530)

Reproducibility-breaking optimisations

• Optimize fn sample_floyd, affecting output of rand::seq::index::sample and rand::seq::SliceRandom::choose_multiple (#​1277)
• New, faster algorithms for IteratorRandom::choose and choose_stable (#​1268)
• New, faster algorithms for SliceRandom::shuffle and partial_shuffle (#​1272)
• Optimize distribution Uniform: use Canon's method (single sampling) / Lemire's method (distribution sampling) for faster sampling (breaks value stability; #​1287)
• Optimize fn sample_single_inclusive for floats (+~20% perf) (#​1289)

Other optimisations

• Improve SmallRng initialization performance (#​1482)
• Optimise SIMD widening multiply (#​1247)

Other

• Add Cargo.lock.msrv file (#​1275)
• Reformat with rustfmt and enforce (#​1448)
• Apply Clippy suggestions and enforce (#​1448, #​1474)
• Move all benchmarks to new benches crate (#​1329, #​1439) and migrate to Criterion (#​1490)

Documentation

• Improve ThreadRng related docs (#​1257)
• Docs: enable experimental --generate-link-to-definition feature (#​1327)
• Better doc of crate features, use doc_auto_cfg (#​1411, #​1450)

v0.8.7

Compare Source

What's Changed

• rand v0.8.7: backport #​1790 by @​dhardy in #​1804

Full Changelog: rust-random/rand@0.8.6...0.8.7

GREsau/schemars (schemars)

v0.9.0

Compare Source

This version is identical to 1.0.0-alpha.18, but is available for those who are unable to unwilling to use a pre-release version.

Those upgrading from Schemars 0.8 may want to consult the migration guide, which also applies when migrating from 0.8 to 0.9.

RustCrypto/hashes (sha2)

v0.11.0

Compare Source

tokio-rs/tokio (tokio)

v1.53.1: Tokio v1.53.1

Compare Source

1.53.1 (July 20th, 2026)

Fixed

• signal: restore MSRV by removing OnceLock::wait from the Windows handler (#​8300)

Fixed (unstable)

• time: fix alt timer cancellation and insertion race (#​8252)

Documented

• runtime: remove dead link definition in Runtime::block_on (#​8301)

v1.53.0: Tokio v1.53.0

Compare Source

1.53.0 (July 17th, 2026)

Added

• fs: implement From<OwnedFd> and From<OwnedHandle> for File (#​8266)
• metrics: add task schedule latency metric (#​7986)
• net: add SocketAddr methods to Unix sockets (#​8144)

Changed

• io: add #[inline] to IO trait impls for in-memory types (#​8242)
• net: implement UCred::pid on FreeBSD (#​8086)
• net: support Nuttx target os (#​8259)
• signal: refactor global variables on Windows (#​8231)
• sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#​8095)
• taskdump: support taskdumps on s390x (#​8192)
• time: add #[track_caller] to timeout_at() (#​8077)
• time: consolidate mutex locks on spurious poll (#​8124)
• time: defer waker clone on spurious poll (#​8107)
• time: move lazy-registration state into Sleep (#​8132)
• tracing: remove unnecessary span clone (#​8126)

Fixed

• io: do not treat zero-length reads as EOF in Chain (#​8251)
• net: use getpeereid for QNX peer credentials (#​8270)
• runtime: avoid illegal state in FastRand (#​8078)
• sync: wake mpsc receiver when a queued reserve[_many] returns permits (#​8260)
• taskdump: skip double wake on Trace::capture/Trace::trace_with (#​8043)
• time: avoid stack overflow in runtime constructor (#​8093)
• time (alt timer): ensure timers stay in the same runtime after .reset() (#​8169)

IO uring (unstable)

• fs: use io-uring for fs::try_exists (#​8080)
• fs: use io-uring for renaming files (#​7800)
• rt: flush io-uring CQE in case of CQE overflow (#​8277)

Documented

• docs: clarify cancel safety wording (#​8181)
• fs: clarify create_dir_all succeeds if path exists (#​8149)
• io: add warning about stdout reordering with multiple handles (#​8276)
• net: document pipe try_read*/try_write* readiness behavior (#​8032)
• runtime: document interaction with fork() (#​8202)
• sync: clarify broadcast lagging semantics (#​8239)
• sync: document memory ordering guarantees for Semaphore (#​8119)
• task: explain why yield_now defers its waker (#​8254)
• time: add panic docs to timeout_at() (#​8077)
• time: fix reversed poll order in timeout doc (#​8214)

v1.52.4: Tokio v1.52.4

Compare Source

1.52.4 (July 16th, 2026)

Fixed

• runtime: don't skip the driver when before_park schedules work (#​8222)

Fixed (unstable)

• taskdump: remove crate disambiguators from output (#​8264)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path rust/Cargo.toml --package borsh@1.6.1 --precise 1.8.0
    Updating crates.io index
error: failed to select a version for the requirement `borsh = "=1.6.1"`
candidate versions found which didn't match: 1.8.0
location searched: crates.io index
required by package `sov-universal-wallet v0.4.1`
    ... which satisfies dependency `sov-universal-wallet = "^0.4.1"` of package `bullet-exchange-interface v0.14.0`
    ... which satisfies dependency `bullet-exchange-interface = "^0.14"` of package `bullet-rust-sdk-wasm v0.0.34 (/tmp/renovate/repos/github/bulletxyz/bullet-rust-sdk/wasm)`

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path wasm/Cargo.toml --workspace
    Updating crates.io index
error: failed to select a version for `getrandom`.
    ... required by package `bullet-rust-sdk v0.0.34 (/tmp/renovate/repos/github/bulletxyz/bullet-rust-sdk/rust)`
    ... which satisfies path dependency `bullet-rust-sdk` (locked to 0.0.34) of package `bullet-rust-sdk-wasm v0.0.34 (/tmp/renovate/repos/github/bulletxyz/bullet-rust-sdk/wasm)`
versions that meet the requirements `^0.4` are: 0.4.3, 0.4.2, 0.4.1, 0.4.0

package `bullet-rust-sdk` depends on `getrandom` with feature `js` but `getrandom` does not have that feature.
help: there is a feature `std` with a similar name


failed to select a version for `getrandom` which could resolve this conflict

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 81761fa. Configure here.}

[cursor]

Stale getrandom WASM feature name

High Severity

The bump to getrandom 0.4 still enables the js feature from 0.2, but 0.4 only defines wasm_js (plus std and sys_rng). Cargo rejects the unknown feature or fails to enable the WASM backend, so wasm32 builds and CI steps like just build-wasm break once the lockfile picks up 0.4.

Additional Locations (1)

• wasm/Cargo.toml#L31-L32

 

^{Reviewed by Cursor Bugbot for commit 81761fa. Configure here.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.