Bump num-bigint from 0.4.6 to 0.5.1

[dependabot]

Bumps num-bigint from 0.4.6 to 0.5.1.

Changelog

Sourced from num-bigint's changelog.

Release 0.5.1 (2026-07-04)

• Fixed a regression in the B-Z division algorithm.

Contributors: @​cuviper

Release 0.5.0 (2026-07-02)

• Upgrade to rand v0.10 and/or v0.9, and split rand_core.
  • The former rand feature is now split into multiple features, rand_0_9, rand_core_0_9, rand_0_10, and rand_core_0_10, depending on the version and feature set you need.
  • The RandBigInt extension trait is now split into BigRng09 and BigRng010 for each version.
  • The gen_* methods are deprecated in favor of new random_* methods.
  • This is also a value-breaking release, as rand defines it.

Contributors: @​bionicles, @​cuviper, @​divergentdave

Release 0.4.8 (2026-07-04)

• Fixed a regression in the B-Z division algorithm.

Contributors: @​cuviper

Release 0.4.7 (2026-07-02)

• Inline single-digit values. This reduces heap allocations, and also enables const ONE, const NEG_ONE, and const fn new_const.
• Use divide and conquer in to_radix_digits, also implementing the Burnikel-Ziegler algorithm to speed up large divisions in general.
• Implement LowerBounded for BigUint.

Contributors: @​cp289, @​cuviper, @​hkalbasi, @​mikem8891, @​pRizz, @​tyilo, @​xtqqczze

Commits

• 33c59ba Merge pull request #348 from cuviper/bz-alg2-step3b
• 38b68f6 Release 0.5.1
• f4a43f5 Fix the missing part of the Burnikel-Ziegler algorithm
• ebfd89a Add failing tests for a bug in B-Z division
• 0ab95df Merge pull request #338 from cuviper/rand-0.10
• 33d6998 Release 0.5.0
• 84d05b7 Clean up manifests of ci crates
• f8daf56 Allow clippy::duplicate_mod where intended
• 022310a Rearrange the rand features to support both 0.9 and 0.10
• 537a036 ci: use the fallback resolver for deps
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Major-version bigint library used throughout CLVM casting, paths, and compiler logic; behavior changes (e.g. division fixes in 0.5.x) could affect numeric results even without code edits.

Overview
Dependabot upgrades the direct num-bigint dependency in Cargo.toml from 0.4.4/0.4.6 to 0.5.1, still with the serde feature.

Cargo.lock is updated so this crate resolves num-bigint 0.5.1 while other workspace/transitive crates (e.g. num, clvmr) keep num-bigint 0.4.8. There are no Rust source changes in the diff.

^{Reviewed by Cursor Bugbot for commit 55a584b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​num-bigint@​0.5.1

View full report