From 91b043bf8b09e330285eec9c3725a28ec5a0ff63 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 14 May 2026 07:16:55 +0100
Subject: [PATCH] =?UTF-8?q?fix(security):=20bump=20rand=200.9.2=20?=
 =?UTF-8?q?=E2=86=92=200.9.3=20in=20opsm-tui=20(GHSA-cq8v-f236-94qc)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses Dependabot alert #50.

`rand` versions ≥ 0.9.0, < 0.9.3 are unsound when a custom logger calls
`rand::rng()` and triggers a reseed mid-log; the unsafe cast to a mutable
reference becomes aliased, violating Stacked Borrows. Severity: low —
the unsoundness only manifests under a narrow combination of features
(`log` + `thread_rng`, custom `Logger` impl, trace/warn-level logging
with getrandom failing on reseed). opsm-tui doesn't ship a custom logger
today, but the lockfile is the source of truth for what we actually
build, and the patched 0.9.3 is a drop-in.

Other workspace crates already had rand ≥ 0.9.4 in their lockfiles; this
PR only touches `opsm-ui/tui/Cargo.lock`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 opsm-ui/tui/Cargo.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/opsm-ui/tui/Cargo.lock b/opsm-ui/tui/Cargo.lock
index d60ce189..1150d0ea 100644
--- a/opsm-ui/tui/Cargo.lock
+++ b/opsm-ui/tui/Cargo.lock
@@ -1036,7 +1036,7 @@ dependencies = [
  "bit-vec 0.8.0",
  "bitflags 2.11.0",
  "num-traits",
- "rand 0.9.2",
+ "rand 0.9.3",
  "rand_chacha",
  "rand_xorshift",
  "regex-syntax",
@@ -1083,9 +1083,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "7ec095654a25171c2124e9e3393a930bddbffdc939556c914957a4c3e0a87166"
 dependencies = [
  "rand_chacha",
  "rand_core 0.9.5",