chore(deps): Bump getrandom from 0.3.4 to 0.4.2 in /bpk-lib

[dependabot]

Bumps getrandom from 0.3.4 to 0.4.2.

Changelog

Sourced from getrandom's changelog.

0.4.2 - 2026-03-03

Changed

• Bump r-efi dependency to v6 #814

Fixed

• Read errno only when it is set #810
• Check the return value of ProcessPrng on Windows #811

#810: rust-random/getrandom#810 #811: rust-random/getrandom#811 #814: rust-random/getrandom#814

0.4.1 - 2026-02-03

Fixed

• Documentation build on docs.rs #801

#801: rust-random/getrandom#801

0.4.0 - 2026-02-02

Added

• RawOsError type alias #739
• SysRng behind new feature sys_rng #751
• WASIp3 support #779
• extern_impl opt-in backend #786 #794
• Motor OS support #797

Changed

• Use Edition 2024 and MSRV 1.85 #749

#739: rust-random/getrandom#739 #749: rust-random/getrandom#749 #751: rust-random/getrandom#751 #779: rust-random/getrandom#779 #786: rust-random/getrandom#786 #794: rust-random/getrandom#794 #797: rust-random/getrandom#797

Commits

• 4d82673 Release v0.4.2 (#821)
• 158fdd4 build(deps): bump the all-deps group with 3 updates (#818)
• 5b0adcc changelog: fix Motor OS PR link (#816)
• f19d321 changelog: move version links to relevant sections (#815)
• b83c779 Avoid accessing errno on unexpected return values. (#810)
• 3d1b151 Update r-efi to v6 (#814)
• 73c17f7 windows: check return value of ProcessPrng (#811)
• 7589557 Update Cargo.lock (#809)
• 6dfd5cb Unify lazy types (#804)
• 5e6b022 Update Cargo.lock (#806)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Greptile Summary

This PR upgrades the optional random-number dependency used by payload encryption.

• Bumps getrandom from 0.3 to 0.4.
• Updates the lockfile to getrandom 0.4.2.
• Adds the new target-specific transitive dependencies.

Confidence Score: 4/5

Payload encryption on wasm32-unknown-unknown can lose access to its random-number backend.

Native targets retain a compatible getrandom::fill API. The workspace Rust version satisfies the dependency's new minimum.

The WebAssembly feature remains enabled on getrandom 0.3 instead of the selected 0.4 package.

T-Rex Logs

What T-Rex did

• The Wasm RNG backend verification was attempted and blocked when the execution budget was exhausted and Cargo required a lockfile update.
• An isolated online build showed getrandom 0.3.4 with wasm_js and getrandom 0.4.2 with no features, followed by an unrelated build-script lint panic that caused exit 101.
• The plan remains to compile and run the saved minimal getrandom 0.4 WASM harness under Node to capture the direct Error::UNSUPPORTED return.
• The validation harness confirmed that exit 101 persisted at the same build.rs invariant and showed that getrandom 0.4.2 was invoked by rustc for the x86_64-unknown-linux-gnu target, while keeping dependency files unchanged.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
bpk-lib/crates/core/Cargo.toml	Upgrades getrandom to 0.4, but leaves its WebAssembly backend feature attached to the 0.3 target-specific declaration.
bpk-lib/Cargo.lock	Records getrandom 0.4.2 and its updated transitive dependencies.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
bpk-lib/crates/core/Cargo.toml:121
**Wasm RNG Backend Stays On 0.3**

On `wasm32-unknown-unknown` with `payload-encryption`, this selects getrandom 0.4 while the target-specific declaration still enables `wasm_js` on getrandom 0.3. The direct `getrandom::fill` calls can therefore use 0.4 without a supported backend and return `Error::UNSUPPORTED`, preventing payload keys and nonces from being generated.

```suggestion
getrandom = { version = "0.4", optional = true, features = ["wasm_js"] }
```

_{Reviews (1): Last reviewed commit: "chore(deps): Bump getrandom from 0.3.4 t..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[greptile-apps]

Wasm RNG Backend Stays On 0.3

On wasm32-unknown-unknown with payload-encryption, this selects getrandom 0.4 while the target-specific declaration still enables wasm_js on getrandom 0.3. The direct getrandom::fill calls can therefore use 0.4 without a supported backend and return Error::UNSUPPORTED, preventing payload keys and nonces from being generated.

Suggested change

	getrandom = { version = "0.4", optional = true }
	getrandom = { version = "0.4", optional = true, features = ["wasm_js"] }

Prompt To Fix With AI

This is a comment left during a code review.
Path: bpk-lib/crates/core/Cargo.toml
Line: 121

Comment:
**Wasm RNG Backend Stays On 0.3**

On `wasm32-unknown-unknown` with `payload-encryption`, this selects getrandom 0.4 while the target-specific declaration still enables `wasm_js` on getrandom 0.3. The direct `getrandom::fill` calls can therefore use 0.4 without a supported backend and return `Error::UNSUPPORTED`, preventing payload keys and nonces from being generated.

```suggestion
getrandom = { version = "0.4", optional = true, features = ["wasm_js"] }
```

How can I resolve this? If you propose a fix, please make it concise.

[heyoub]

Closed by architect ruling (F4 closure, 2026-07-19): these PRs target the legacy main source cut (/bpk-lib + legacy workflow actions), not the cleanroom architecture. The legacy lineage is preserved as-is; Dependabot re-enters deliberately when the Phase 6 workspace and its dependency graph are authoritative, and then only as a candidate generator feeding the qualification law (never auto-merge; Action updates must end as exact 40-hex pins passing the workflow-pinning audit).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.