chore(deps): bump rand from 0.10.0 to 0.10.1 in /packages/daemon-rs

[dependabot]

Bumps rand from 0.10.0 to 0.10.1.

Changelog

Sourced from rand's changelog.

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#1761)
• Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

Commits

• 27ff4cb Prepare v0.10.1: deprecate feature log (#1763)
• 98d0638 make_rng: document panic and add #[track_caller] (#1761)
• 54e5eaa Fix doc error (#1758)
• 1ce4c08 Bump itoa from 1.0.17 to 1.0.18 in the all-deps group (#1756)
• ccb734b docs: fix typo in doc comment (#1754)
• 357eb7d Bump libc from 0.2.182 to 0.2.183 in the all-deps group (#1753)
• 5e77fe5 Fix trait references in documentation (#1752)
• da89185 Bump the all-deps group with 3 updates (#1751)
• 50516ff Bump the all-deps group with 2 updates (#1749)
• fd71de9 Bump the all-deps group with 2 updates (#1747)
• Additional commits viewable in compare view

[PR-Reviewer-Ant]

Hi @dependabot[bot] - I'm an automated code reviewer powered by pr-reviewer. I'm taking a look at the refactor and cleanup work in chore(deps): bump rand from 0.10.0 to 0.10.1 in /packages/daemon-rs (commit 2e89d3c9) now and I'll follow up shortly with feedback.

[PR-Reviewer-Ant]

Automated review by pr-reviewer | model: claude-sonnet-4-6 | commit: 2e89d3c9

[Automated Review — pr-reviewer bot] Routine patch bump of rand 0.10.0→0.10.1 in the Rust daemon-rs shadow runtime. One non-obvious transitive dependency change in the lockfile is worth a human check.

Confidence: Medium [sufficient_diff_evidence, missing_cross_module_context] - The rand version bump and its new checksum are verifiable from the diff. The getrandom transitive change (0.4.2→0.3.4 for a second unnamed package) is visible in the lockfile diff but the owning package name is not exposed in the provided context window — the surrounding Cargo.lock lines show a stable checksum for that package but do not show its name = stanza. Whether that package's version range allows getrandom 0.3 is not provable without the full lockfile.

[PR-Reviewer-Ant]

A second package (whose name is not visible in this diff window, but has checksum 32497e9a...) silently switched its getrandom dependency from 0.4.2 to 0.3.4. This is a minor-version downgrade of a crypto-adjacent crate. Both getrandom 0.3 and 0.4 are actively maintained and secure, so this is unlikely to be a problem, but it's worth verifying: (1) which crate owns this entry (cargo tree -i getrandom in the daemon-rs workspace); (2) that the crate's published version range actually allows getrandom 0.3.x (a mismatch would mean the lockfile diverged from the crate's declared bounds, which shouldn't happen but is worth confirming). This change is a side-effect of the rand bump altering resolver graph, not a direct edit by dependabot.

[PR-Reviewer-Ant]

Review post failed; fallback summary posted.

Error: GitHub create review failed (500 Internal Server Error):

Automated review by pr-reviewer | model: gpt-5.3-codex | commit: e4308363

[Automated Review by pr-reviewer] I found scope/intent drift and a transitive lockfile change that should be clarified before human merge review.

Confidence: High [sufficient_diff_evidence, targeted_context_included] - The diff explicitly shows changes beyond the PR description (packages/forge/Cargo.lock rand 0.9.2->0.9.4) and a transitive dependency shift in packages/daemon-rs/Cargo.lock (getrandom 0.4.2->0.3.4) at changed lines.

Unmapped findings (not on changed lines):

• packages/forge/Cargo.lock:2517 - PR description claims only /packages/daemon-rs rand bump, but this PR also changes /packages/forge/Cargo.lock (rand 0.9.2 -> 0.9.4). Please either update the PR description/scope or split this into a separate dependency bump for traceability and review accuracy.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.