docs: [#443] document rand 0.8.5 risk assessment — no fix available in tera yet

Author: josecelano

docs/issues/443-rand-0.8.5-rustsec.md

@@ -52,24 +52,22 @@ a version using `rand >= 0.9.3`.
 
 ## Steps
 
-- [ ] Run `cargo audit` to confirm RUSTSEC-2026-0097 is still reported for rand 0.8.5
-- [ ] Run `cargo tree -i rand@0.8.5` to confirm `tera` is still the only consumer
-- [ ] Check whether `tera` has released a version with `rand >= 0.9.3`:
+- [x] Run `cargo audit` to confirm RUSTSEC-2026-0097 is still reported for rand 0.8.5
+- [x] Run `cargo tree -i rand@0.8.5` to confirm `tera` is still the only consumer
+- [x] Check whether `tera` has released a version with `rand >= 0.9.3`:
       <https://crates.io/crates/tera>
-- [ ] **If `tera` has not updated yet**:
-  - Post a comment on #443 with the risk assessment above and the cargo tree output
-  - Leave the issue open with a note to revisit on the next `tera` minor release
-- [ ] **If `tera` is updated**:
-  - Bump `tera` in `Cargo.toml`, run `cargo update tera`
-  - Run `cargo tree -p rand` to confirm `rand 0.8.5` is gone from `Cargo.lock`
-  - Run `cargo audit` to confirm the advisory is cleared
-  - Post a comment with the results and close #443
+- [x] **`tera` has not updated yet** — latest stable is `1.20.1` (released ~6 months
+      ago). A `2.0.0-alpha.2` pre-release exists (~1 month ago) but is not production
+      ready.
+  - [x] Post a comment on #443 with the risk assessment and cargo tree output
+  - Leave the issue open — revisit when `tera` releases a new stable version
 
 ## Outcome
 
-<!-- Fill in after doing the work -->
-
-- Date:
-- tera latest version:
-- Result:
-- Comment/PR:
+- Date: 2026-04-14
+- tera latest stable version: `1.20.1` (no fix available yet)
+- Result: **Cannot fix.** `rand 0.8.5` is pulled in solely by `tera 1.20.1`. No
+  stable `tera` release uses `rand >= 0.9.3`. Practical risk is low — the
+  unsoundness conditions are not met in this application (no custom logger calling
+  back into rand). Risk assessment posted as comment on #443; issue left open.
+- Comment/PR: https://github.com/torrust/torrust-tracker-deployer/issues/443#issuecomment-4246102278