Resolve RUSTSEC-2026-0097 ThreadRng unsoundness in rand (#274)

[MavenRain]

Description

Bump rand to 0.8.6 in the workspace and bump the transitive rand 0.10.0 (pulled in via quickcheck 1.1.0) to 0.10.1 across the root, jstprove_pyo3, and jstprove_zkvm lockfiles. Advisory fix is patch-level so no API surface changes.

Related Issue

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (fix/feature causing existing functionality to break)
• Refactor (non-functional changes)
• Documentation update

Checklist

• Code follows project patterns
• Tests added/updated (if applicable)
• Documentation updated (if applicable)
• Self-review of code
• All tests pass locally
• Linter passes locally

Deployment Notes

N/A

Additional Comments

N/A

Summary by CodeRabbit

• Chores
  • Updated internal dependencies to latest patch versions.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 46857ac5-f263-4189-8a15-72f4230f1dd2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Updated the workspace dependency rand from version 0.8.5 to 0.8.6 in the Cargo.toml manifest. No other dependencies, features, or workspace configuration entries were modified.

Changes

Cohort / File(s)	Summary
Dependency Update Cargo.toml	Bumped rand dependency version from 0.8.5 to 0.8.6.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~1 minutes

Poem

🐰 A tiny hop through Cargo's file,
Where rand jumps brightly, all the while,
From point-eight-five to point-eight-six,
Fresh randomness in the mix! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: updating the rand dependency to resolve RUSTSEC-2026-0097 ThreadRng unsoundness, which matches the PR's primary objective of bumping rand to version 0.8.6.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Cargo.toml`:
- Line 105: The root Cargo.lock still pins vulnerable rand 0.10.0 (and older
0.8.5) even though the workspace Cargo.toml now uses rand = "0.8.6"; regenerate
the root lockfile from the workspace root by running cargo update -p rand (or
cargo update -p rand --workspace) or performing a cargo build so Cargo.lock is
updated, then verify Cargo.lock no longer contains rand 0.10.0 and shows the
expected rand 0.8.6 (or the safe resolved version present in member lockfiles).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ecdde096-5ff6-4537-8e9e-9f004cd566e2

📥 Commits

Reviewing files that changed from the base of the PR and between 7c3cbbe and a1e91b8.

⛔ Files ignored due to path filters (2)

• rust/jstprove_pyo3/Cargo.lock is excluded by !**/*.lock
• rust/jstprove_zkvm/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• Cargo.toml