chore: update dependencies

[dobby-coder]

Outdated dependencies

Scanned with cargo outdated and cargo audit.

Security advisories (direct)

• bincode 2.0.1 — unmaintained (RUSTSEC-2025-0141). Bumping to 3.0.0 (listed below) addresses this.

Direct dependency updates

Crate	Current	Latest	Kind
bincode	2.0.1	3.0.0	dev
criterion	0.5.1	0.8.2	dev
rand	0.8.6	0.10.1	dev
rand_core	0.6.4	0.10.1	normal
sha3	0.10.9	0.11.0	normal

Instructions

• Bump the listed crates. Each is a major bump and may require code changes.
• Run cargo build, cargo test, and cargo bench --no-run.
• Run cargo fmt.
• Open a draft PR titled chore: update dependencies. Link this issue.
• If CI passes, mark the PR ready and add reviewer rubenhensen.
• Skip bumps that cannot be cleanly applied — note them in the PR body.

[dobby-coder]

/dobby

[rubenhensen]

/dobby fix this issue

[dobby-coder]

Dobby is on it, sir! The bot will check the dependency situation against memory notes and post a plan shortly.

[dobby-coder]

Status

This issue overlaps with #15 — same dependency table, same blockers. The bot already investigated this on #15; situation is unchanged today (2026-05-13):

• criterion 0.5 → 0.8 — already landed in chore: bump criterion 0.5 -> 0.8 #16 (Cargo.toml is on criterion = "0.8").
• bincode 2 → 3 — bincode 3.0.0 on crates.io is a compile_error! tombstone, not a real release. Stay on 2.x. (A third-party bincode-next fork exists and was adopted in postguard#182, but ibs only uses bincode as a dev-dep for tests and the 2.x line is fine — no reason to swap to a forked crate here.)
• rand_core 0.6 → 0.10, sha3 0.10 → 0.11, rand 0.8 → 0.10 — all gated behind curve25519-dalek 5.0 stable. Latest stable on crates.io is still 4.1.3 (verified just now); the only 5.x release is 5.0.0-pre.6, not appropriate for a crypto lib's main branch. gg.rs propagates rand_core 0.6 and digest 0.10 through Scalar::random / Scalar::from_hash, so these have to move together with the curve dep.

No PR to open from this issue — nothing is safely landable beyond what already shipped in #16.

Suggest closing this in favour of #15 (which has the full table including the lockfile-level bumps), or vice-versa. The bot will revisit once curve25519-dalek 5.0 ships stable and land the RustCrypto + rand bumps in one cross-cutting PR then.

[rubenhensen]

Closing in favour of 15