release: v1.13.4

Migrates rand 0.9 → 0.10 (and fake 4.4 → 5, rand_chacha 0.9 → 0.10).
rand 0.10 splits convenience methods (random/random_range/random_bool)
out to a new RngExt extension trait, replaces RngCore with Rng as the
low-level dyn-safe trait, and removes StdRng::from_os_rng() in favor
of rand::make_rng(). fake had to be bumped in lockstep so its
internal Rng trait is sourced from rand 0.10.

Also bumps tempfile to 3.27, cargo-dist to 0.31.0, and configures
Dependabot to ignore actions/upload-artifact + actions/download-artifact
since cargo-dist generates release.yml and pins those itself (this was
the cause of the v1.13.2 release failure).

Closes PRs #35 (tempfile) and #37 (rand 0.10).

Author: HelgeSverre

.github/dependabot.yml

@@ -13,3 +13,10 @@ updates:
       interval: "weekly"
     commit-message:
       prefix: "ci"
+    # release.yml is generated by cargo-dist (see dist-workspace.toml); the
+    # action versions there are pinned by cargo-dist itself, so bumping them
+    # via Dependabot fails the cargo-dist plan step (workflow drift check).
+    # Bump them by upgrading cargo-dist instead.
+    ignore:
+      - dependency-name: "actions/upload-artifact"
+      - dependency-name: "actions/download-artifact"

.github/workflows/release.yml

@@ -64,7 +64,7 @@ jobs:
         # we specify bash to get pipefail; it guards against the `curl` command
         # failing. otherwise `sh` won't catch that `curl` returned non-0
         shell: bash
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.4/cargo-dist-installer.sh | sh"
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh"
       - name: Cache dist
         uses: actions/upload-artifact@v6
         with:

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.13.4] - 2026-05-04
+
+### Changed
+
+- **`rand` 0.9 → 0.10** (and `fake` 4.4 → 5, `rand_chacha` 0.9 → 0.10): rand 0.10 reorganizes its public surface — `RngCore` is replaced by `Rng` (low-level), and convenience methods like `random()` / `random_range()` are now on the new `RngExt` extension trait. `fake` had to be bumped in lockstep so its internal `Rng` trait is sourced from rand 0.10. Users see no behavior change.
+- **`tempfile` 3.25 → 3.27**
+- **`cargo-dist` 0.30.4 → 0.31.0** (release-workflow generator)
+
+### Fixed
+
+- **Dependabot: ignore `actions/upload-artifact` and `actions/download-artifact`** in `.github/dependabot.yml`. `release.yml` is generated by cargo-dist and pins those action versions; bumping them via Dependabot fails cargo-dist's plan-step drift check (this was the cause of the failed v1.13.2 release). The right way to bump is to upgrade cargo-dist itself.
+
 ## [1.13.3] - 2026-05-04
 
 ### Fixed