From 274a8209b3732971e2f2df80ffe296ec5fc37466 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 02:15:09 +0000
Subject: [PATCH] chore(deps): Bump rand from 0.8.6 to 0.9.5

Bumps [rand](https://github.com/rust-random/rand) from 0.8.6 to 0.9.5.
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.9.5/CHANGELOG.md)
- [Commits](https://github.com/rust-random/rand/compare/0.8.6...0.9.5)

---
updated-dependencies:
- dependency-name: rand
  dependency-version: 0.9.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock                          | 39 +++++++----------------------
 crates/bymax-auth-crypto/Cargo.toml |  2 +-
 2 files changed, 10 insertions(+), 31 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3582299..2367d3d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -310,7 +310,7 @@ dependencies = [
  "log",
  "num",
  "pin-project-lite",
- "rand 0.9.4",
+ "rand 0.9.5",
  "rustls",
  "rustls-native-certs",
  "rustls-pki-types",
@@ -461,7 +461,7 @@ dependencies = [
  "hmac",
  "password-hash",
  "proptest",
- "rand 0.8.6",
+ "rand 0.9.5",
  "scrypt",
  "sha1",
  "sha2",
@@ -1247,7 +1247,7 @@ dependencies = [
  "parking_lot",
  "portable-atomic",
  "quanta",
- "rand 0.9.4",
+ "rand 0.9.5",
  "smallvec",
  "spinning_top",
  "web-time",
@@ -2087,8 +2087,8 @@ dependencies = [
  "bit-vec",
  "bitflags",
  "num-traits",
- "rand 0.9.4",
- "rand_chacha 0.9.0",
+ "rand 0.9.5",
+ "rand_chacha",
  "rand_xorshift",
  "regex-syntax",
  "rusty-fork",
@@ -2172,22 +2172,11 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
-dependencies = [
- "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
- "rand_chacha 0.9.0",
+ "rand_chacha",
  "rand_core 0.9.5",
 ]
 
@@ -2202,16 +2191,6 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "rand_chacha"
 version = "0.9.0"
@@ -3278,7 +3257,7 @@ dependencies = [
  "http",
  "httparse",
  "log",
- "rand 0.9.4",
+ "rand 0.9.5",
  "sha1",
  "thiserror 2.0.18",
 ]
diff --git a/crates/bymax-auth-crypto/Cargo.toml b/crates/bymax-auth-crypto/Cargo.toml
index 5da2ec9..ff03648 100644
--- a/crates/bymax-auth-crypto/Cargo.toml
+++ b/crates/bymax-auth-crypto/Cargo.toml
@@ -21,7 +21,7 @@ description = "Cryptographic primitives for bymax-auth: password hashing, consta
 hmac = "0.12"
 sha2 = "0.10"
 subtle = "2.6"
-rand = "0.8"
+rand = "0.9"
 # `getrandom` is pinned to the major that `rand_core 0.6` (pulled by `password-hash
 # 0.5` for salt generation) depends on, so the production (non-dev) graph carries a
 # single `getrandom`. (Dev-only `proptest` pulls a newer `rand`/`getrandom`; those are