chore: release 1.0.1

cargo update -p rand@0.9.2 and cargo update -p rand@0.8.5 take the two pinned rand versions past the RUSTSEC-2026-0097 fix windows:


* rand 0.9.2 -> 0.9.4 (fix >= 0.9.3).

* rand 0.8.5 -> 0.8.6 (fix >= 0.8.6).


The advisory is reachable only with a custom logger that calls rand::rng() at trace/warn level and hits the 64 KB reseed path. We are not known to do that, but unblocking CI is reason enough.

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [1.0.1] - 2026-04-22
+
+### Security
+
+- Bump both pinned `rand` versions past [RUSTSEC-2026-0097][adv] (`rand`
+  is unsound with a custom `log::Log` impl that calls `rand::rng()` at
+  trace/warn level and hits the 64 KB reseed path):
+  - `rand 0.9.2` → `0.9.4` (fix `>= 0.9.3`).
+  - `rand 0.8.5` → `0.8.6` (fix `>= 0.8.6`).
+
+  The advisory is only reachable under a very narrow set of conditions
+  (custom logger invoking `rand::rng()` during a reseed while emitting
+  trace-level logs, or warn-level with a failed `getrandom`). We are
+  not known to do that, but shipping the upgrade is the right call.
+
+[adv]: https://rustsec.org/advisories/RUSTSEC-2026-0097
+
 ## [1.0.0] - 2026-04-22
 
 ### Breaking

Cargo.lock

@@ -906,7 +906,7 @@ dependencies = [
 
 [[package]]
 name = "donglora-bridge"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "anyhow",
  "blake3",
@@ -922,7 +922,7 @@ dependencies = [
  "jiff",
  "mainline",
  "proptest",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ratatui",
  "serde",
  "sha2 0.10.9",
@@ -943,7 +943,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2d2eb852b012cd692ab270397cdc81ac52c95a7b6543e8d8f6ee1e98537c461"
 dependencies = [
  "donglora-protocol",
- "rand 0.9.2",
+ "rand 0.9.4",
  "thiserror 2.0.18",
  "tokio",
  "tokio-serial",
@@ -1078,7 +1078,7 @@ checksum = "4e7f34442dbe69c60fe8eaf58a8cafff81a1f278816d8ab4db255b3bef4ac3c4"
 dependencies = [
  "getrandom 0.3.4",
  "libm",
- "rand 0.9.2",
+ "rand 0.9.4",
  "siphasher",
 ]
 
@@ -1495,7 +1495,7 @@ dependencies = [
  "idna",
  "ipnet",
  "once_cell",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ring",
  "rustls",
  "thiserror 2.0.18",
@@ -1519,7 +1519,7 @@ dependencies = [
  "moka",
  "once_cell",
  "parking_lot",
- "rand 0.9.2",
+ "rand 0.9.4",
  "resolv-conf",
  "rustls",
  "smallvec",
@@ -1805,7 +1805,7 @@ dependencies = [
  "hyper",
  "hyper-util",
  "log",
- "rand 0.9.2",
+ "rand 0.9.4",
  "tokio",
  "url",
  "xmltree",
@@ -1926,7 +1926,7 @@ dependencies = [
  "pkcs8",
  "portable-atomic",
  "portmapper",
- "rand 0.9.2",
+ "rand 0.9.4",
  "reqwest",
  "rustc-hash",
  "rustls",
@@ -1989,7 +1989,7 @@ dependencies = [
  "n0-error",
  "n0-future",
  "postcard",
- "rand 0.9.2",
+ "rand 0.9.4",
  "serde",
  "tokio",
  "tokio-util",
@@ -2052,7 +2052,7 @@ dependencies = [
  "pin-project",
  "pkarr",
  "postcard",
- "rand 0.9.2",
+ "rand 0.9.4",
  "reqwest",
  "rustls",
  "rustls-pki-types",
@@ -2646,7 +2646,7 @@ dependencies = [
  "getrandom 0.3.4",
  "identity-hash",
  "lru-slab",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ring",
  "rustc-hash",
  "rustls",
@@ -2983,7 +2983,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -3124,7 +3124,7 @@ dependencies = [
  "n0-error",
  "netwatch",
  "num_enum",
- "rand 0.9.2",
+ "rand 0.9.4",
  "serde",
  "smallvec",
  "socket2",
@@ -3223,7 +3223,7 @@ dependencies = [
  "bit-vec 0.8.0",
  "bitflags 2.11.0",
  "num-traits",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rand_chacha",
  "rand_xorshift",
  "regex-syntax",
@@ -3276,7 +3276,7 @@ dependencies = [
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ring",
  "rustc-hash",
  "rustls",
@@ -3325,18 +3325,18 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "rand_core 0.6.4",
 ]
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha",
  "rand_core 0.9.5",
@@ -4355,7 +4355,7 @@ dependencies = [
  "getrandom 0.3.4",
  "http",
  "httparse",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ring",
  "rustls-pki-types",
  "simdutf8",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "donglora-bridge"
-version = "1.0.0"
+version = "1.0.1"
 edition = "2024"
 authors = ["Stephen Waits <steve@waits.net>"]
 license = "MIT"