Skip to content

fix(deps): raise rustfft and rand version floors - #309

Open
bhavyajain0810 wants to merge 1 commit into
mohu-org:mainfrom
bhavyajain0810:fix/update-dependency-floors-273
Open

fix(deps): raise rustfft and rand version floors#309
bhavyajain0810 wants to merge 1 commit into
mohu-org:mainfrom
bhavyajain0810:fix/update-dependency-floors-273

Conversation

@bhavyajain0810

Copy link
Copy Markdown

What

  • Raises the minimum supported rustfft version from 6 to 6.4.1.
  • Raises the minimum supported rand version from 0.9 to 0.9.4.
  • Preserves the existing small_rng feature.
  • Keeps the change limited to the affected declarations in Cargo.toml.

Why

The existing Cargo requirements use compatible version ranges:

  • rustfft = "6" allows compatible 6.x releases.
  • rand = "0.9" allows compatible 0.9.x releases.

Although Cargo.lock already resolves rustfft 6.4.1 and rand 0.9.4, the manifest still permits resolution to older compatible versions.

Raising the version floors ensures that dependency resolution cannot fall below the currently validated releases while still allowing future semver-compatible updates.

Closes #273

How

  • Updated rustfft to 6.4.1.
  • Updated rand to 0.9.4.
  • Preserved the existing features and dependency configuration.
  • Confirmed that Cargo.lock requires no change because it already resolves both requested versions.
  • Rebased the branch onto the latest upstream/main.

The following checks passed:

  • cargo metadata --locked --format-version 1
  • cargo fmt --all -- --check
  • cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
  • cargo test --locked --workspace --all-features
  • RUSTDOCFLAGS="-D warnings" cargo doc --locked --workspace --no-deps --all-features
  • cargo bench --locked --workspace --no-run --all-features
  • cargo machete
  • git diff --check

cargo deny check currently fails on the existing upstream/main lockfile because of these pre-existing advisories:

  • RUSTSEC-2026-0204 for crossbeam-epoch 0.9.18
  • RUSTSEC-2026-0186 for memmap2 0.9.10

This PR does not modify Cargo.lock or either affected dependency.

Checklist

  • cargo test --workspace passes
  • cargo clippy --workspace -- -D warnings passes
  • cargo fmt --all applied
  • CHANGELOG.md updated (not required; this is not a user-facing change)
  • Benchmarks added or updated (not applicable; no performance-sensitive code was changed, and existing benchmarks compile successfully)

Signed-off-by: Bhavya Jain <jainbhavya0810@gmail.com>
@bhavyajain0810
bhavyajain0810 requested a review from Bbn08 as a code owner July 19, 2026 17:47
@github-actions

Copy link
Copy Markdown

PR Check Summary

Item Value
Branch fix/update-dependency-floors-273
Changed crates none
Files changed 1

CI will run: build, test, clippy, fmt, cargo-deny, DCO, semver.
Reviewer assigned from CODEOWNERS.

@coderabbitai

coderabbitai Bot commented Jul 19, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@bhavyajain0810, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 17 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9aafd4a9-72b3-4c9a-9875-7fc2e4ad189e

📥 Commits

Reviewing files that changed from the base of the PR and between 3c07775 and b396826.

📒 Files selected for processing (1)
  • Cargo.toml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

FFT and random crates using outdated versions causing compatibility and security issues

1 participant