deps: Bump rand from 0.10.1 to 0.10.2

[dependabot]

Bumps rand from 0.10.1 to 0.10.2.

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

Commits

• 1540ea3 Prepare rand 0.10.2 (#1800)
• a29964a Bump chacha20 from 0.10.0 to 0.10.1 in the all-deps group (#1801)
• ced9491 Tweak docs for RngExt::random_range and SampleRange (#1798)
• db14664 Check UniformChar validity on deser (#1790)
• bea8620 Bump the all-deps group with 2 updates (#1796)
• 4f44932 Bump actions/cache from 5 to 6 (#1795)
• b999a13 Bump actions/checkout from 6 to 7 (#1794)
• aeab810 Avoid unsafe where safety depends on non-local values (#1791)
• 1896d7c Add typos CI job (#1789)
• 43eddee Bump the all-deps group with 2 updates (#1788)
• Additional commits viewable in compare view

[eduralph]

@dependabot recreate

The bump itself is good (rand 0.10.2 is a memory-safety patch — UniformChar deserialization, rust-random/rand#1790), but the current lockfile diff also carries an unrelated, non-minimal change: tempfile's getrandom is downgraded 0.4.3 → 0.3.4, which isn't a consequence of the rand bump (a clean cargo update -p rand --precise 0.10.2 leaves tempfile on 0.4.3). Recreating should regenerate a minimal diff touching only rand.

[eduralph]

Correction to my earlier comment: the tempfile getrandom 0.4.3 → 0.3.4 change is not unrelated churn — I misread a cargo update dry-run whose summary line only listed rand. Running the update for real reproduces this lock byte-for-byte, so it's a deterministic resolver outcome of the bump (which is why recreate regenerated the identical commit). It's inert: all three getrandom majors already coexist on main, none added or removed, and the advisory wall passes. Merging as-is.