From a531fcd81bc5d8b4842909584d88537bcb97dcec Mon Sep 17 00:00:00 2001
From: claude-bot-go <bot@claude-bot.local>
Date: Wed, 29 Jul 2026 19:50:58 +0800
Subject: [PATCH] chore: upgrade Rust crate dependencies to latest major
 versions

Bump crate versions in Cargo.toml and update Cargo.lock:

- sha2: 0.10 -> 0.11
- ed25519-dalek: 2 -> 3
- rand: 0.8 -> 0.10 (rand_core 0.10 required by ed25519-dalek 3)
- criterion: 0.5 -> 0.8 (workspace dep)

Code fix: rand 0.10 removed OsRng from rand::rngs; replace all
  DalekSigningKey::generate(&mut rand::rngs::OsRng)
with
  DalekSigningKey::generate(&mut rand::rng())
which uses ThreadRng (implements CryptoRng) as the CSPRNG.

All 20 unit tests pass locally.
---
 Cargo.toml                     |  2 +-
 crates/aep-core/Cargo.toml     |  6 +++---
 crates/aep-core/src/signing.rs | 12 ++++++------
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 28308fb..6fb23d4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,7 +7,7 @@ members = [
 resolver = "2"
 
 [workspace.dependencies]
-criterion = { version = "0.5", features = ["html_reports"] }
+criterion = { version = "0.8", features = ["html_reports"] }
 
 [workspace.package]
 version      = "0.1.0"
diff --git a/crates/aep-core/Cargo.toml b/crates/aep-core/Cargo.toml
index 5b2986d..4b2f84a 100644
--- a/crates/aep-core/Cargo.toml
+++ b/crates/aep-core/Cargo.toml
@@ -9,10 +9,10 @@ repository.workspace  = true
 [dependencies]
 serde        = { version = "1", features = ["derive"] }
 serde_json   = "1"
-sha2         = "0.10"
+sha2         = "0.11"
 hex          = "0.4"
-ed25519-dalek = { version = "2", features = ["rand_core"] }
-rand         = "0.8"
+ed25519-dalek = { version = "3", features = ["rand_core"] }
+rand         = "0.10"
 uuid         = { version = "1", features = ["v4"] }
 
 [dev-dependencies]
diff --git a/crates/aep-core/src/signing.rs b/crates/aep-core/src/signing.rs
index 0cabb70..9258086 100644
--- a/crates/aep-core/src/signing.rs
+++ b/crates/aep-core/src/signing.rs
@@ -72,7 +72,7 @@ mod tests {
     #[test]
     fn round_trip_sign_and_verify() {
         let mut record = test_record();
-        let key = DalekSigningKey::generate(&mut rand::rngs::OsRng);
+        let key = DalekSigningKey::generate(&mut rand::rng());
         let pubkey: VerifyingKey = key.verifying_key();
 
         sign_record(&mut record, &key, "key-1");
@@ -90,7 +90,7 @@ mod tests {
     #[test]
     fn tampered_payload_fails_verification() {
         let mut record = test_record();
-        let key = DalekSigningKey::generate(&mut rand::rngs::OsRng);
+        let key = DalekSigningKey::generate(&mut rand::rng());
         let pubkey: VerifyingKey = key.verifying_key();
 
         sign_record(&mut record, &key, "key-1");
@@ -104,7 +104,7 @@ mod tests {
     #[test]
     fn tampered_action_fails_verification() {
         let mut record = test_record();
-        let key = DalekSigningKey::generate(&mut rand::rngs::OsRng);
+        let key = DalekSigningKey::generate(&mut rand::rng());
         let pubkey: VerifyingKey = key.verifying_key();
 
         sign_record(&mut record, &key, "key-1");
@@ -118,8 +118,8 @@ mod tests {
     #[test]
     fn wrong_key_fails_verification() {
         let mut record = test_record();
-        let key = DalekSigningKey::generate(&mut rand::rngs::OsRng);
-        let other_key = DalekSigningKey::generate(&mut rand::rngs::OsRng);
+        let key = DalekSigningKey::generate(&mut rand::rng());
+        let other_key = DalekSigningKey::generate(&mut rand::rng());
         let wrong_pubkey: VerifyingKey = other_key.verifying_key();
 
         sign_record(&mut record, &key, "key-1");
@@ -130,7 +130,7 @@ mod tests {
     #[test]
     fn unsigned_record_fails_verification() {
         let record = test_record(); // signature is None
-        let key = DalekSigningKey::generate(&mut rand::rngs::OsRng);
+        let key = DalekSigningKey::generate(&mut rand::rng());
         let pubkey: VerifyingKey = key.verifying_key();
 
         assert!(!verify_record(&record, &pubkey));