chore: update dependencies

[dobby-coder]

This repo has outdated dependencies. Workers should update them.

Outdated packages

Major (consider deferring if breaking changes are intrusive)

• rand 0.8.4 → 0.10.1

Note: cargo-audit was not available during scan — no security scan run. Run locally if practical.

Instructions

• Update the listed dependency. rand 0.10 may have API changes; review carefully.
• Run cargo fmt --all -- --check, cargo clippy, cargo test before pushing.
• Create a draft PR. Flip to ready once CI is green AND the diff looks safe.
• Assign @rubenhensen as reviewer.

[dobby-coder]

/dobby

[dobby-coder]

Dobby sees the request! Dobby will check whether the bot can update rand 0.8 → 0.10 in this crate, or whether the BLS curve stack still blocks it. Reporting back shortly.

[dobby-coder]

Plan

This is a duplicate of the already-attempted dep bump in #25 / #26 (2026-05-07). The only dep listed (rand 0.8.4 → 0.10.1) was tried and rejected then; the block is still in place and is actually slightly worse now upstream. No PR will be opened.

Verification (just-run)

• cargo update --dry-run -p rand --precise 0.10.1 would jump rand 0.8.6 → 0.10.1, but Cargo.lock still pins rand_core 0.6.4, group 0.13.0, ff 0.13.1, pairing 0.23.0, pg-curve 0.2.0.
• rand 0.10 ships rand_core 0.10, an incompatible separate type. Every Group::random(&mut rng) / Scalar::random(...) call site in ibe wants &mut R: RngCore + CryptoRng from rand_core 0.6. Bumping breaks all of them at compile time.
• The wasm32 getrandom 0.2 features=["js"] direct dep only exists to enable js on the getrandom 0.2 pulled in via rand_core 0.6. Bumping to 0.4 in isolation just adds a parallel copy. Coupled to the rand bump.

Upstream status

• pg-curve newest on crates.io: 0.2.0 (no new release since this was first triaged).
• group newest: 0.14.0-pre.0, which depends on rand_core ^0.9 — still not 0.10.
• ff newest: 0.14.0-pre.0; pairing newest: 0.24.0-pre.0 (both pre-release).
• So even when the BLS stack does cut its next stable, the intermediate hop is rand_core 0.9, not 0.10. The two-version migration matters.

Action

• Comment explaining the block (this comment).
• Close this issue as not-planned. It will re-open itself naturally once the upstream curve stack ships a release that supports rand_core 0.9+ AND pg-curve cuts a release built against it.
• No code change, no PR.

Reviewer: @rubenhensen (FYI — same conclusion as on #25, no new path forward).

[dobby-coder]

Closing as not-planned. Same conclusion as #25/#26 (2026-05-07): the only listed bump (rand 0.8 → 0.10) is blocked by the BLS curve stack (pg-curve 0.2, pairing 0.23, group 0.13, ff 0.13 all on rand_core 0.6). Crates.io still shows no stable release with rand_core 0.9+ on those crates, and pg-curve itself is unchanged. Will re-open naturally once the upstream stack ships a compatible release. No code changes were made.