chore(deps): Bump rand from 0.8.6 to 0.9.2

[dependabot]

Bumps rand from 0.8.6 to 0.9.2.

Changelog

Sourced from rand's changelog.

[0.9.2] - 2025-07-20

Deprecated

• Deprecate rand::rngs::mock module and StepRng generator (#1634)

Additions

• Enable WeightedIndex<usize> (de)serialization (#1646)

[0.9.1] - 2025-04-17

Security and unsafe

• Revise "not a crypto library" policy again (#1565)
• Remove zerocopy dependency from rand (#1579)

Fixes

• Fix feature simd_support for recent nightly rust (#1586)

Changes

• Allow fn rand::seq::index::sample_weighted and fn IndexedRandom::choose_multiple_weighted to return fewer than amount results (#1623), reverting an undocumented change (#1382) to the previous release.

Additions

• Add rand::distr::Alphabetic distribution. (#1587)
• Re-export rand_core (#1604)

#1565: rust-random/rand#1565 #1579: rust-random/rand#1579 #1586: rust-random/rand#1586 #1587: rust-random/rand#1587 #1604: rust-random/rand#1604 #1623: rust-random/rand#1623 #1634: rust-random/rand#1634 #1646: rust-random/rand#1646

[0.9.0] - 2025-01-27

Security and unsafe

• Policy: "rand is not a crypto library" (#1514)
• Remove fork-protection from ReseedingRng and ThreadRng. Instead, it is recommended to call ThreadRng::reseed on fork. (#1379)
• Use zerocopy to replace some unsafe code (#1349, #1393, #1446, #1502)

Dependencies

• Bump the MSRV to 1.63.0 (#1207, #1246, #1269, #1341, #1416, #1536); note that 1.60.0 may work for dependents when using --ignore-rust-version
• Update to rand_core v0.9.0 (#1558)

Features

• Support std feature without getrandom or rand_chacha (#1354)
• Enable feature small_rng by default (#1455)
• Remove implicit feature rand_chacha; use std_rng instead. (#1473)
• Rename feature serde1 to serde (#1477)
• Rename feature getrandom to os_rng (#1537)

... (truncated)

Commits

• d3dd415 Prepare rand_core 0.9.2 (#1605)
• 99fabd2 Prepare rand_core 0.9.2
• c7fe1c4 rand: re-export rand_core (#1604)
• db2b1e0 rand: re-export rand_core
• ee1d96f rand_core: implement reborrow for UnwrapMut (#1595)
• e0eb2ee rand_core: implement reborrow for UnwrapMut
• 975f602 fixup clippy 1.85 warnings
• 775b05b Relax Sized requirements for blanket impls (#1593)
• ec6d5c0 Prepare rand_core v0.9.1 (#1591)
• 6a06056 rand_core: introduce an UnwrapMut wrapper (#1589)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[tbraun96]

Holding this one: rand 0.8 -> 0.9 is a breaking major and the workspace does not compile after the bump (deprecated Rng::gen -> random, rand::distributions moved to rand::distr, ChaCha8Rng::seed_from_u64 signature change, StandardNormal::sample changes). dependabot only bumped the manifests, not the call sites. These usages live in the sampler RNG (spark-runtime) and KV/storage paths, so the migration is not purely mechanical: changing the RNG construction/stream can shift which tokens are drawn at temperature > 0. That deserves a deliberate migration PR with a determinism check, not an auto-merge. Leaving open until that is done; same applies to the rand_distr bump in #65 which depends on this.

[tbraun96]

Closing this one deliberately. With current main the resolver actually pulls rand 0.10, an even larger breaking jump than 0.9, and the breakage lands squarely in the sampler RNG (Rng::gen -> random, rand::distributions -> rand::distr, ChaCha8Rng::seed_from_u64, StandardNormal::sample) plus the storage path. A faithful migration is doable, but it is a deliberate change that needs a token-stream determinism check (temp>0 sampling must not silently shift), not an auto-bump, and the value here is only dependency freshness. Declining for now; dependabot will resurface it, and we will do it as a focused migration PR when it is worth the verification. Same reasoning closes #65.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.