chore(deps): update rust crate getrandom to 0.4 by cachekit-renovate-bot[bot] · Pull Request #13 · cachekit-io/cachekit-cli

Now, when the wasm_js feature is enabled, the wasm_js backend will be used
by default. Users of wasm32-unknown-unknown targeting JavaScript environments
like the Web and Node.js will no longer need to specify:

--cfg getrandom_backend="wasm_js"

in RUSTFLAGS for the crate to compile. They can now simple enable a feature.

Note: this should not affect non-JS users of the wasm32-unknown-unknown
target. Using --cfg getrandom_backend will still override the source of
randomness even if the wasm_js feature is enabled. This includes
--cfg getrandom_backend=custom and --cfg getrandom_backend=unsupported.

For more information, see the discussions in #671, #675, and #730.

Added

unsupported opt-in backend #667
windows_legacy opt-in backend #724

Changed

Implement Memory Sanitizer unpoisoning more precisely #678
Relax MSRV for the linux_raw opt-in backend on ARM targets #688
Use getrandom syscall on all RISC-V Linux targets #699
Replaced wasi dependency with wasip2 #721
Enable wasm_js backend by default if the wasm_js feature is enabled #730

Removed

Unstable rustc-dep-of-std crate feature #694

`v0.3.3`

Compare Source

Changed

Doc improvements #632 #634 #635
Add crate version to docs.rs links used in compile_error!s #639

Fixed

Error handling in WASI p1 #661

`v0.3.2`

Compare Source

Added

efi_rng opt-in backend #570
linux_raw opt-in backend #572
.cargo/config.toml example in the crate-level docs #591
getrandom_test_linux_without_fallback configuration flag to test that file fallback
is not triggered in the linux_android_with_fallback backend #605
Built-in support for *-linux-none targets #618
Cygwin support #626

Changed

Update wasi dependency to v0.14 #594
Add #[inline] attribute to the inner functions #596
Update WASI and Emscripten links in the crate-level docs #597
Do not use dlsym on MUSL targets in the linux_android_with_fallback backend #602
Remove linux_android.rs and use getrandom.rs instead #603
Always use RtlGenRandom on Windows targets when compiling with pre-1.78 Rust #610
Internal representation of the Error type #614
Remove windows-targets dependency and use raw-dylib directly #627

Removed

Error::INTERNAL_START and Error::CUSTOM_START associated constants #614

`v0.3.1`

Compare Source

Fixed

Build error on Android #588

`v0.3.0`

Compare Source

Breaking Changes

Changed

Bump MSRV to 1.63 #542
Rename getrandom and getrandom_uninit functions to fill and fill_uninit respectively #532

Removed

wasm32-wasi target support (use wasm32-wasip1 or wasm32-wasip2 instead) #499
linux_disable_fallback, rdrand, js, test-in-browser, and custom crate features
in favor of configuration flags #504
register_custom_getrandom! macro #504
Implementation of From<NonZeroU32> for Error and Error::code method #507
Internet Explorer 11 support #554
Target-specific associated Error constants #562

Changed

Use ProcessPrng on Windows 10 and up, and use RtlGenRandom on older Windows versions #415
Do not use locale-specific strerror_r for retrieving error code descriptions #440
Avoid assuming usize is the native word size in the rdrand backend #442
Do not read from errno when libc did not indicate error on Solaris #448
Switch from libpthread's mutex to futex on Linux and to nanosleep-based wait loop
on other targets in the use_file backend #490
Do not retry on EAGAIN while polling /dev/random on Linux #522
Remove separate codepath for Node.js in the wasm_js backend
(bumps minimum supported Node.js version to v19) #557
Use js_namespace in the wasm_js backend #559

Added

wasm32-wasip1 and wasm32-wasip2 support #499
getrandom_backend configuration flag for selection of opt-in backends #504
Error::new_custom method #507
rndr opt-in backend #512
Automatic MemorySanitizer support #521 #571
u32 and u64 functions for generating random values of the respective type #544
wasm32v1-none support in the wasm_js backend #560
wasm_js crate feature which allows users to enable the wasm_js opt-in backend #574

Fixed

NetBSD fallback code based on KERN_ARND #555

Configuration

📅 Schedule: (in timezone Australia/Sydney)

Branch creation
- "before 6am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

kodus-27b · 2026-10-03T18:07:24Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

Kody Code Review — 1 suggested fix.
Paste the prompt below to your agent and all review fixed at once!

🛠️ Open Agent Prompt

A code review identified the following issues in this pull request.
Each section describes what was found and includes a reference implementation where available.

Files involved:
- Cargo.toml:33

---

### [1/1] Cargo.toml:33
Issue identified during code review:
Build break in Cargo.toml: bumping getrandom to 0.4 leaves src/keys.rs:115 calling `getrandom::getrandom(&mut secret)`, which was renamed to `getrandom::fill` in 0.3 and no longer exists in 0.4. Running `cargo build` fails with an unresolved function error in create_file_key, so the `ck` binary cannot be built. Fix: in src/keys.rs, change the call to `getrandom::fill(&mut secret)`, which returns the same `Result<(), getrandom::Error>`.
Reference implementation (from code review):

// Cargo.toml:33
getrandom = "0.4"
# and in src/keys.rs:
#     getrandom::fill(&mut secret)
#         .map_err(|e| Fatal(format!("cannot generate a file key: {e}")))?;

---

Review each issue in context, use the reference implementations as guidance, and apply fixes that are consistent with the surrounding codebase.

kodus-27b · 2026-10-23T15:17:32Z

 cachekit-core = { version = "0.7", default-features = false, features = ["encryption"] }
 cachekit-rs = { version = "0.11.1", default-features = false, features = ["cachekitio", "encryption", "file"] }
-getrandom = "0.2"
+getrandom = "0.4"


WHAT: The getrandom dependency jumps from 0.2 to 0.4, skipping 0.3. The diff includes no supply-chain or CVE evidence for this change.
WHY: getrandom is a security-critical crate because it is the OS entropy source used for encryption. A major version bump can change the public API (for example, getrandom::getrandom became getrandom::fill) and backend or feature selection. It can also add new transitive dependencies. Without audit evidence and a matching Cargo.lock update, these risks go unchecked.
HOW: Run cargo audit or query OSV for getrandom 0.4.x and attach the output to the PR description. Update and commit Cargo.lock. Then verify the following:

All call sites are migrated to the new API.

Any required backend features or cfgs are enabled for your targets.

cachekit-core and cachekit-rs don't pull a conflicting getrandom version.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml: Line 33: WHAT: The `getrandom` dependency jumps from 0.2 to 0.4, skipping 0.3. The diff includes no supply-chain or CVE evidence for this change. WHY: `getrandom` is a security-critical crate because it is the OS entropy source used for encryption. A major version bump can change the public API (for example, `getrandom::getrandom` became `getrandom::fill`) and backend or feature selection. It can also add new transitive dependencies. Without audit evidence and a matching Cargo.lock update, these risks go unchecked. HOW: Run `cargo audit` or query OSV for getrandom 0.4.x and attach the output to the PR description. Update and commit Cargo.lock. Then verify the following: - All call sites are migrated to the new API. - Any required backend features or cfgs are enabled for your targets. - `cachekit-core` and `cachekit-rs` don't pull a conflicting getrandom version.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

kodus-27b · 2026-10-23T15:17:36Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

kodus-27b · 2026-10-23T23:23:19Z

 cachekit-core = { version = "0.7", default-features = false, features = ["encryption"] }
 cachekit-rs = { version = "0.11.1", default-features = false, features = ["cachekitio", "encryption", "file"] }
-getrandom = "0.2"
+getrandom = "0.4"


Build break in Cargo.toml: bumping getrandom to 0.4 removes the getrandom::getrandom free function, which src/keys.rs:115 still calls to create the file key. The crate fails to compile with an unresolved-function error at getrandom::getrandom(&mut secret), because 0.3 renamed the function to getrandom::fill and 0.4 keeps that name. Fix: in the same PR, change src/keys.rs:115 to getrandom::fill(&mut secret).map_err(|e| Fatal(format!("cannot generate a file key: {e}")))?;.

getrandom = "0.4" # and in src/keys.rs: # getrandom::fill(&mut secret) # .map_err(|e| Fatal(format!("cannot generate a file key: {e}")))?;

Prompt for LLM

File Cargo.toml: Line 33: Build break in Cargo.toml: bumping `getrandom` to 0.4 removes the `getrandom::getrandom` free function, which src/keys.rs:115 still calls to create the file key. The crate fails to compile with an unresolved-function error at `getrandom::getrandom(&mut secret)`, because 0.3 renamed the function to `getrandom::fill` and 0.4 keeps that name. Fix: in the same PR, change src/keys.rs:115 to `getrandom::fill(&mut secret).map_err(|e| Fatal(format!("cannot generate a file key: {e}")))?;`. Suggested Code: getrandom = "0.4" # and in src/keys.rs: # getrandom::fill(&mut secret) # .map_err(|e| Fatal(format!("cannot generate a file key: {e}")))?;

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

kodus-27b · 2026-10-23T23:23:22Z

 cachekit-core = { version = "0.7", default-features = false, features = ["encryption"] }
 cachekit-rs = { version = "0.11.1", default-features = false, features = ["cachekitio", "encryption", "file"] }
-getrandom = "0.2"
+getrandom = "0.4"


WHAT: The dependency getrandom jumps two major versions, from 0.2 to 0.4. WHY: The PR includes no CVE/SCA evidence and no confirmation that Cargo.lock was updated. The 0.3+ releases also changed the API (e.g., getrandom::getrandom was renamed to fill, and custom backend configuration changed), so call sites may break. HOW: Run cargo audit or an OSV query and attach the output to the PR. Commit the updated Cargo.lock. Verify that all getrandom call sites compile against the new API.

Kody rule violation: Validate new/updated dependencies for CVEs and supply-chain risk

Prompt for LLM

File Cargo.toml: Line 33: WHAT: The dependency getrandom jumps two major versions, from 0.2 to 0.4. WHY: The PR includes no CVE/SCA evidence and no confirmation that Cargo.lock was updated. The 0.3+ releases also changed the API (e.g., getrandom::getrandom was renamed to fill, and custom backend configuration changed), so call sites may break. HOW: Run cargo audit or an OSV query and attach the output to the PR. Commit the updated Cargo.lock. Verify that all getrandom call sites compile against the new API.

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

kodus-27b · 2026-10-23T23:23:25Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

cachekit-renovate-bot Bot added the dependencies label Oct 3, 2026

cachekit-renovate-bot Bot assigned 27Bslash6 Oct 3, 2026

kodus-27b Bot reviewed Oct 3, 2026

View reviewed changes

Comment thread Cargo.toml

cachekit-renovate-bot Bot force-pushed the renovate/getrandom-0.x branch from 46cc6d5 to 73d01a6 Compare October 23, 2026 15:16

kodus-27b Bot reviewed Oct 23, 2026

View reviewed changes

Comment thread Cargo.toml

kodus-27b Bot reviewed Oct 23, 2026

View reviewed changes

chore(deps): update rust crate getrandom to 0.4

85fcf31

cachekit-renovate-bot Bot force-pushed the renovate/getrandom-0.x branch from 73d01a6 to 85fcf31 Compare October 23, 2026 23:21

kodus-27b Bot reviewed Oct 23, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore(deps): update rust crate getrandom to 0.4 - #13

chore(deps): update rust crate getrandom to 0.4#13
cachekit-renovate-bot[bot] wants to merge 1 commit into
mainfrom
renovate/getrandom-0.x

cachekit-renovate-bot Bot commented Oct 3, 2026

Uh oh!

kodus-27b Bot commented Oct 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

kodus-27b Bot Oct 23, 2026

Uh oh!

kodus-27b Bot commented Oct 23, 2026

Uh oh!

kodus-27b Bot Oct 23, 2026

Uh oh!

kodus-27b Bot Oct 23, 2026

Uh oh!

kodus-27b Bot commented Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

cachekit-renovate-bot Bot commented Oct 3, 2026

Release Notes

Added

Changed

Changed

Fixed

Fixed

Added

Changed

Major change to wasm_js backend

Added

Changed

Removed

Changed

Fixed

Added

Changed

Removed

Fixed

Breaking Changes

Changed

Removed

Changed

Added

Fixed

Configuration

Uh oh!

kodus-27b Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

Uh oh!

Uh oh!

kodus-27b Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

kodus-27b Bot commented Oct 23, 2026

Code Review Completed! 🔥

Uh oh!

kodus-27b Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

kodus-27b Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

kodus-27b Bot commented Oct 23, 2026

Code Review Completed! 🔥

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Major change to `wasm_js` backend

kodus-27b Bot commented Oct 3, 2026 •

edited

Loading