Skip to content

chore(deps): bump the rust-dependencies group across 1 directory with 2 updates - #38

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-aa7b5b2a20
Closed

chore(deps): bump the rust-dependencies group across 1 directory with 2 updates#38
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-aa7b5b2a20

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the rust-dependencies group with 2 updates in the / directory: rand and thiserror.

Updates rand from 0.9.4 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

  • Document panic behavior of make_rng and add #[track_caller] (#1761)
  • Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

... (truncated)

Commits

Updates thiserror from 2.0.18 to 2.0.19

Release notes

Sourced from thiserror's releases.

2.0.19

  • Update to syn 3
Commits
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • febcc03 Merge pull request #451 from vip892766gma/maint/20260521171412
  • c50e387 chore: improve thiserror maintenance path
  • d4a2507 Raise minimum tested compiler to rust 1.85
  • 99e8a6c Unpin CI miri toolchain
  • 9ac165c Pin CI miri to nightly-2026-02-11
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 28, 2026
@dependabot
dependabot Bot requested a review from lavs9 as a code owner July 28, 2026 19:25
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 28, 2026
@dependabot
chore(deps): bump the rust-dependencies group across 1 directory with…
6803ed1 
… 2 updates

Bumps the rust-dependencies group with 2 updates in the / directory: [rand](https://github.com/rust-random/rand) and [thiserror](https://github.com/dtolnay/thiserror).


Updates `rand` from 0.9.4 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.9.4...0.10.2)

Updates `thiserror` from 2.0.18 to 2.0.19
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.18...2.0.19)

---
updated-dependencies:
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: thiserror
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the rust-dependencies group with 2 updates chore(deps): bump the rust-dependencies group across 1 directory with 2 updates Aug 4, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/rust-dependencies-aa7b5b2a20 branch from 75bc1e2 to 6803ed1 Compare August 4, 2026 16:35
@lavs9 lavs9 mentioned this pull request Aug 11, 2026
Merged
3 tasks
@lavs9

lavs9 commented Aug 11, 2026

Copy link
Copy Markdown
Owner

Closing as superseded by #39.

Root cause of this PR's CI failure was staleness, not a live defect: the branch ran CI against an older main that still pinned rand = "0.8". The actual fix needed for the 0.9→0.10 bump is adding rand::RngExt imports in quantwave-backtest (the trait rand 0.10 split range/fill helpers into). That fix and the version bump must land in a single atomic commit — neither ordering compiles alone — so I opened a fresh PR (#39) with both squashed together rather than pushing onto this Dependabot-managed branch.

#39: #39

@lavs9 lavs9 closed this Aug 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/cargo/rust-dependencies-aa7b5b2a20 branch August 11, 2026 04:05
lavs9 added a commit that referenced this pull request Aug 11, 2026
@lavs9 @claude
chore(deps): bump rand to 0.10 with RngExt fix (quantwave-mm67)
bec55f6 
rand 0.10 splits the Rng trait: range/fill helper methods (random_range,
random, etc.) move from Rng into a new RngExt trait. quantwave-backtest
calls those helpers via tpe.rs and its test module in lib.rs, so the
crate no longer compiles against 0.10 without importing RngExt.

This bump and the RngExt import fix must land in a single commit: 0.9
does not have rand::RngExt, so a commit that adds the import before the
bump does not compile, and a commit that bumps before the import does
not compile either. Squashing avoids leaving a broken bisect point.

Supersedes Dependabot PR #38, whose CI failure (E0599 on
random_range/StdRng) was stale -- it ran against an older main that
still pinned rand 0.8 and used gen_range, and never picked up this
RngExt fix.

The diff is exactly two lines, both `use rand::Rng` -> `use rand::RngExt`.

Verified: cargo nextest run --workspace (1140 passed, 1 skipped, 0 failed).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
lavs9 added a commit that referenced this pull request Aug 12, 2026
@lavs9 @claude
chore(deps): bump rand to 0.10 with RngExt fix (quantwave-mm67) (#39)
c39507f 
rand 0.10 splits the Rng trait: range/fill helper methods (random_range,
random, etc.) move from Rng into a new RngExt trait. quantwave-backtest
calls those helpers via tpe.rs and its test module in lib.rs, so the
crate no longer compiles against 0.10 without importing RngExt.

This bump and the RngExt import fix must land in a single commit: 0.9
does not have rand::RngExt, so a commit that adds the import before the
bump does not compile, and a commit that bumps before the import does
not compile either. Squashing avoids leaving a broken bisect point.

Supersedes Dependabot PR #38, whose CI failure (E0599 on
random_range/StdRng) was stale -- it ran against an older main that
still pinned rand 0.8 and used gen_range, and never picked up this
RngExt fix.

The diff is exactly two lines, both `use rand::Rng` -> `use rand::RngExt`.

Verified: cargo nextest run --workspace (1140 passed, 1 skipped, 0 failed).

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lavs9 lavs9 Awaiting requested review from lavs9 lavs9 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lavs9