From 02e1f53fc73eb73c3564bd2be4412ab5bfb2656f Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Thu, 25 Sep 2025 11:23:27 +0200
Subject: [PATCH 01/16] wip: upgrade to rand@0.9

---
 Cargo.lock                 | 1107 +++++++++++++++++++++---------------
 Cargo.toml                 |    4 +
 iroh-base/Cargo.toml       |    8 +-
 iroh-base/src/key.rs       |    4 +-
 iroh-dns-server/Cargo.toml |    4 +-
 iroh-relay/Cargo.toml      |    4 +-
 iroh/Cargo.toml            |    6 +-
 iroh/bench/Cargo.toml      |    2 +-
 8 files changed, 676 insertions(+), 463 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 8c8d57c1a7e..2f17d4c6beb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -38,7 +38,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
  "bytes",
- "crypto-common",
+ "crypto-common 0.1.6",
  "generic-array",
 ]
 
@@ -70,12 +70,6 @@ version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
-[[package]]
-name = "android-tzdata"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
-
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -93,9 +87,9 @@ checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
 
 [[package]]
 name = "anstream"
-version = "0.6.19"
+version = "0.6.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933"
+checksum = "3ae563653d1938f79b1ab1b5e668c87c76a9930414574a6583a7b7e11a8e6192"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -123,29 +117,29 @@ dependencies = [
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8bdeb6047d8983be085bab0ba1472e6dc604e7041dbf6fcd5e71523014fae9"
+checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.9"
+version = "3.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "403f75924867bb1033c59fbf0797484329750cfbe3c4325cd33127941fabc882"
+checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.99"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 dependencies = [
  "backtrace",
 ]
@@ -198,7 +192,7 @@ checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
  "synstructure",
 ]
 
@@ -210,14 +204,14 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
 name = "async-compat"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bab94bde396a3f7b4962e396fdad640e241ed797d4d8d77fc8c237d14c58fc0"
+checksum = "a1ba85bc55464dcbf728b56d97e119d673f4cf9062be330a9a26f3acf504a590"
 dependencies = [
  "futures-core",
  "futures-io",
@@ -228,13 +222,13 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.88"
+version = "0.1.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -265,11 +259,12 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "attohttpc"
-version = "0.24.1"
+version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d9a9bf8b79a749ee0b911b91b671cc2b6c670bdbc7e3dfd537576ddc94bb2a2"
+checksum = "16e2cdb6d5ed835199484bb92bb8b3edd526effe995c61732580439c1a67e2e9"
 dependencies = [
- "http 0.2.12",
+ "base64",
+ "http 1.3.1",
  "log",
  "url",
 ]
@@ -343,7 +338,7 @@ checksum = "604fde5e028fea851ce1d8570bbdc034bec850d157f7569d10f347d06808c05c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -370,9 +365,9 @@ dependencies = [
 
 [[package]]
 name = "backon"
-version = "1.5.1"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "302eaff5357a264a2c42f127ecb8bac761cf99749fc3dc95677e2743991f99e7"
+checksum = "592277618714fbcecda9a02ba7a8781f319d26532a88553bbacc77ba5d2b3a8d"
 dependencies = [
  "fastrand",
  "gloo-timers 0.3.0",
@@ -453,9 +448,9 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "2.9.1"
+version = "2.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
+checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
 
 [[package]]
 name = "blake3"
@@ -479,6 +474,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.11.0-rc.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9ef36a6fcdb072aa548f3da057640ec10859eb4e91ddf526ee648d50c76a949"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "bounded-integer"
 version = "0.5.8"
@@ -517,10 +521,11 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.2.29"
+version = "1.2.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c1599538de2394445747c8cf7935946e3cc27e9625f889d979bfb2aaf569362"
+checksum = "80f41ae168f955c12fb8960b057d70d0ca153fb83182b57d86380443527be7e9"
 dependencies = [
+ "find-msvc-tools",
  "shlex",
 ]
 
@@ -532,9 +537,9 @@ checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
 
 [[package]]
 name = "cfg-if"
-version = "1.0.1"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
+checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
 
 [[package]]
 name = "cfg_aliases"
@@ -555,15 +560,14 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.41"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c469d952047f47f91b68d1cba3f10d63c11d73e4636f24f08daf0278abf01c4d"
+checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
 dependencies = [
- "android-tzdata",
  "iana-time-zone",
  "num-traits",
  "serde",
- "windows-link",
+ "windows-link 0.2.0",
 ]
 
 [[package]]
@@ -599,16 +603,16 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.6",
  "inout",
  "zeroize",
 ]
 
 [[package]]
 name = "clap"
-version = "4.5.41"
+version = "4.5.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be92d32e80243a54711e5d7ce823c35c41c9d929dc4ab58e1276f625841aadf9"
+checksum = "e2134bb3ea021b78629caa971416385309e0131b351b25e01dc16fb54e1b5fae"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -616,9 +620,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.41"
+version = "4.5.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707eab41e9622f9139419d573eca0900137718000c517d47da73045f54331c3d"
+checksum = "c2ba64afa3c0a6df7fa517765e31314e983f51dda798ffba27b988194fb65dc9"
 dependencies = [
  "anstream",
  "anstyle",
@@ -628,14 +632,14 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.41"
+version = "4.5.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef4f52386a59ca4c860f7393bcf8abd8dfd91ecccc0f774635ff68e92eeef491"
+checksum = "bbfd7eae0b0f1a6e63d4b13c9c478de77c2eb546fba158ad50b4203dc24b9f9c"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -650,14 +654,14 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
 dependencies = [
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
 ]
 
 [[package]]
 name = "color-backtrace"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2123a5984bd52ca861c66f66a9ab9883b27115c607f801f86c1bc2a84eb69f0f"
+checksum = "e49b1973af2a47b5b44f7dd0a344598da95c872e1556b045607888784e973b91"
 dependencies = [
  "backtrace",
  "btparse",
@@ -682,15 +686,15 @@ dependencies = [
 
 [[package]]
 name = "console"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e09ced7ebbccb63b4c65413d821f2e00ce54c5ca4514ddc6b3c892fdbcbc69d"
+checksum = "b430743a6eb14e9764d4260d4c0d8123087d504eeb9c48f2b2a5e810dd369df4"
 dependencies = [
  "encode_unicode",
  "libc",
  "once_cell",
  "unicode-width",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -709,6 +713,12 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-oid"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dabb6555f92fb9ee4140454eb5dcd14c7960e1225c6d1a6cc361f032947713e"
+
 [[package]]
 name = "constant_time_eq"
 version = "0.3.1"
@@ -868,6 +878,15 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.0-rc.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8235645834fbc6832939736ce2f2d08192652269e11010a6240f61b908a1c6"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "crypto_box"
 version = "0.9.1"
@@ -877,7 +896,7 @@ dependencies = [
  "aead",
  "chacha20",
  "crypto_secretbox",
- "curve25519-dalek",
+ "curve25519-dalek 4.1.3",
  "salsa20",
  "serdect",
  "subtle",
@@ -909,9 +928,25 @@ dependencies = [
  "cfg-if",
  "cpufeatures",
  "curve25519-dalek-derive",
- "digest",
- "fiat-crypto",
- "rand_core 0.6.4",
+ "digest 0.10.7",
+ "fiat-crypto 0.2.9",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "5.0.0-pre.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f9200d1d13637f15a6acb71e758f64624048d85b31a5fdbfd8eca1e2687d0b7"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest 0.11.0-rc.2",
+ "fiat-crypto 0.3.0",
+ "rand_core 0.9.3",
  "rustc_version",
  "serde",
  "subtle",
@@ -926,7 +961,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -955,8 +990,18 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "der_derive",
+ "zeroize",
+]
+
+[[package]]
+name = "der"
+version = "0.8.0-rc.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9d8dd2f26c86b27a2a8ea2767ec7f9df7a89516e4794e54ac01ee618dda3aa4"
+dependencies = [
+ "const-oid 0.10.1",
  "pem-rfc7468",
  "zeroize",
 ]
@@ -983,14 +1028,14 @@ checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
 name = "deranged"
-version = "0.4.0"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
+checksum = "a41953f86f8a05768a6cda24def994fd2f424b04ec5c719cf89989779f199071"
 dependencies = [
  "powerfmt",
 ]
@@ -1021,7 +1066,7 @@ checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
  "unicode-xid",
 ]
 
@@ -1033,7 +1078,7 @@ checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
  "unicode-xid",
 ]
 
@@ -1055,11 +1100,21 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer",
- "crypto-common",
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.6",
  "subtle",
 ]
 
+[[package]]
+name = "digest"
+version = "0.11.0-rc.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6749b668519cd7149ee3d11286a442a8a8bdc3a9d529605f579777bfccc5a4bc"
+dependencies = [
+ "block-buffer 0.11.0-rc.5",
+ "crypto-common 0.2.0-rc.4",
+]
+
 [[package]]
 name = "dirs-next"
 version = "2.0.0"
@@ -1089,7 +1144,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -1114,9 +1169,9 @@ dependencies = [
 
 [[package]]
 name = "dyn-clone"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c7a8fb8a9fbf66c1f703fe16184d10ca0ee9d23be5b4436400408ba54a95005"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "ed25519"
@@ -1124,9 +1179,19 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8",
+ "pkcs8 0.10.2",
+ "signature 2.2.0",
+]
+
+[[package]]
+name = "ed25519"
+version = "3.0.0-rc.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef49c0b20c0ad088893ad2a790a29c06a012b3f05bcfc66661fd22a94b32129"
+dependencies = [
+ "pkcs8 0.11.0-rc.7",
  "serde",
- "signature",
+ "signature 3.0.0-rc.4",
 ]
 
 [[package]]
@@ -1135,11 +1200,26 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
- "curve25519-dalek",
- "ed25519",
- "rand_core 0.6.4",
+ "curve25519-dalek 4.1.3",
+ "ed25519 2.2.3",
+ "serde",
+ "sha2 0.10.9",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "3.0.0-pre.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad207ed88a133091f83224265eac21109930db09bedcad05d5252f2af2de20a1"
+dependencies = [
+ "curve25519-dalek 5.0.0-pre.1",
+ "ed25519 3.0.0-rc.1",
+ "rand_core 0.9.3",
  "serde",
- "sha2",
+ "sha2 0.11.0-rc.2",
+ "signature 3.0.0-rc.4",
  "subtle",
  "zeroize",
 ]
@@ -1177,7 +1257,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -1197,7 +1277,7 @@ checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -1217,12 +1297,12 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.3.13"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -1243,6 +1323,18 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
+[[package]]
+name = "fiat-crypto"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ced73b1dacfc750a6db6c0a0c3a3853c8b41997e2e2c563dc90804ae6867959"
+
 [[package]]
 name = "flume"
 version = "0.11.1"
@@ -1251,7 +1343,7 @@ checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
 dependencies = [
  "futures-core",
  "futures-sink",
- "spin",
+ "spin 0.9.8",
 ]
 
 [[package]]
@@ -1268,9 +1360,9 @@ checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
 dependencies = [
  "percent-encoding",
 ]
@@ -1287,9 +1379,9 @@ dependencies = [
 
 [[package]]
 name = "fs-err"
-version = "3.1.1"
+version = "3.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88d7be93788013f265201256d58f04936a8079ad5dc898743aa20525f503b683"
+checksum = "44f150ffc8782f35521cec2b23727707cb4045706ba3c854e86bef66b3a8cdbd"
 dependencies = [
  "autocfg",
  "tokio",
@@ -1312,15 +1404,15 @@ dependencies = [
 
 [[package]]
 name = "futures-buffered"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe940397c8b744b9c2c974791c2c08bca2c3242ce0290393249e98f215a00472"
+checksum = "a8e0e1f38ec07ba4abbde21eed377082f17ccb988be9d988a5adbf4bafc118fd"
 dependencies = [
  "cordyceps",
  "diatomic-waker",
  "futures-core",
  "pin-project-lite",
- "spin",
+ "spin 0.10.0",
 ]
 
 [[package]]
@@ -1358,9 +1450,9 @@ checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
 
 [[package]]
 name = "futures-lite"
-version = "2.6.0"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5edaec856126859abb19ed65f39e90fea3a9574b9707f13539acf4abf7eb532"
+checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
 dependencies = [
  "fastrand",
  "futures-core",
@@ -1377,7 +1469,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -1418,9 +1510,9 @@ dependencies = [
 
 [[package]]
 name = "generator"
-version = "0.8.5"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d18470a76cb7f8ff746cf1f7470914f900252ec36bbc40b569d74b1258446827"
+checksum = "605183a538e3e2a9c1038635cc5c2d194e2ee8fd0d1b66b8349fad7dbacce5a2"
 dependencies = [
  "cc",
  "cfg-if",
@@ -1464,7 +1556,7 @@ dependencies = [
  "js-sys",
  "libc",
  "r-efi",
- "wasi 0.14.2+wasi-0.2.4",
+ "wasi 0.14.7+wasi-0.2.4",
  "wasm-bindgen",
 ]
 
@@ -1476,9 +1568,9 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
 name = "glob"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "gloo"
@@ -1675,7 +1767,7 @@ dependencies = [
  "parking_lot",
  "portable-atomic",
  "quanta",
- "rand 0.9.1",
+ "rand 0.9.2",
  "smallvec",
  "spinning_top",
  "web-time",
@@ -1683,9 +1775,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17da50a276f1e01e0ba6c029e47b7100754904ee8a278f886546e98575380785"
+checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1727,15 +1819,21 @@ checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
 [[package]]
 name = "hashbrown"
-version = "0.15.4"
+version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+
 [[package]]
 name = "hdrhistogram"
 version = "7.5.4"
@@ -1756,7 +1854,7 @@ dependencies = [
  "hash32",
  "rustc_version",
  "serde",
- "spin",
+ "spin 0.9.8",
  "stable_deref_trait",
 ]
 
@@ -1797,11 +1895,11 @@ dependencies = [
  "idna",
  "ipnet",
  "once_cell",
- "rand 0.9.1",
+ "rand 0.9.2",
  "ring",
  "rustls",
  "serde",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tinyvec",
  "tokio",
  "tokio-rustls",
@@ -1822,12 +1920,12 @@ dependencies = [
  "moka",
  "once_cell",
  "parking_lot",
- "rand 0.9.1",
+ "rand 0.9.2",
  "resolv-conf",
  "rustls",
  "serde",
  "smallvec",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tokio",
  "tokio-rustls",
  "tracing",
@@ -1853,7 +1951,7 @@ dependencies = [
  "prefix-trie",
  "rustls",
  "serde",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "time",
  "tokio",
  "tokio-rustls",
@@ -1867,7 +1965,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -1951,9 +2049,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b112acc8b3adf4b107a8ec20977da0273a8c386765a3ec0229bd500a1443f9f"
+checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
 [[package]]
 name = "humantime-serde"
@@ -1965,15 +2063,25 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bad028b20a90afcdb5e28a53392562f1db2bdfa238aa1a978b911461bfffb92"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hyper"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2b571658e38e0c01b1fdca3bbbe93c00d3d71693ff2770043f8c29bc7d6f80"
+checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "futures-channel",
- "futures-util",
+ "futures-core",
  "h2",
  "http 1.3.1",
  "http-body",
@@ -1981,6 +2089,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
+ "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -2000,14 +2109,14 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.1",
+ "webpki-roots 1.0.2",
 ]
 
 [[package]]
 name = "hyper-util"
-version = "0.1.15"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f66d5bd4c6f02bf0542fad85d626775bab9258cf795a4256dcaf3161114d1df"
+checksum = "3c6995591a8f1380fcb4ba966a252a4b29188d51d2b89e3a252f5305be65aea8"
 dependencies = [
  "base64",
  "bytes",
@@ -2021,7 +2130,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.0",
  "tokio",
  "tower-service",
  "tracing",
@@ -2029,9 +2138,9 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.63"
+version = "0.1.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
+checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -2039,7 +2148,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core",
+ "windows-core 0.62.0",
 ]
 
 [[package]]
@@ -2139,9 +2248,9 @@ dependencies = [
 
 [[package]]
 name = "idna"
-version = "1.0.3"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "686f825264d630750a544639377bae737628043f20d38bbc029e8f29ea968a7e"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
 dependencies = [
  "idna_adapter",
  "smallvec",
@@ -2160,9 +2269,9 @@ dependencies = [
 
 [[package]]
 name = "igd-next"
-version = "0.16.1"
+version = "0.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d06464e726471718db9ad3fefc020529fabcde03313a0fc3967510e2db5add12"
+checksum = "516893339c97f6011282d5825ac94fc1c7aad5cad26bdc2d0cee068c0bf97f97"
 dependencies = [
  "async-trait",
  "attohttpc",
@@ -2173,7 +2282,7 @@ dependencies = [
  "hyper",
  "hyper-util",
  "log",
- "rand 0.9.1",
+ "rand 0.9.2",
  "tokio",
  "url",
  "xmltree",
@@ -2181,12 +2290,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.10.0"
+version = "2.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
+checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.4",
+ "hashbrown 0.16.0",
 ]
 
 [[package]]
@@ -2226,9 +2335,9 @@ dependencies = [
 
 [[package]]
 name = "io-uring"
-version = "0.7.8"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b86e202f00093dcba4275d4636b93ef9dd75d025ae560d2521b45ea28ab49013"
+checksum = "046fa2d4d00aea763528b4950358d0ead425372445dc8ff86312b3c69ff7727b"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -2279,9 +2388,9 @@ dependencies = [
  "console_error_panic_hook",
  "crypto_box",
  "data-encoding",
- "der",
+ "der 0.7.10",
  "derive_more 2.0.1",
- "ed25519-dalek",
+ "ed25519-dalek 3.0.0-pre.1",
  "futures-buffered",
  "futures-util",
  "getrandom 0.3.3",
@@ -2308,8 +2417,8 @@ dependencies = [
  "portmapper",
  "postcard",
  "pretty_assertions",
- "rand 0.8.5",
- "rand_chacha 0.3.1",
+ "rand 0.9.2",
+ "rand_chacha 0.9.0",
  "reqwest",
  "ring",
  "rustls",
@@ -2319,8 +2428,8 @@ dependencies = [
  "serde_json",
  "smallvec",
  "snafu",
- "spki",
- "strum 0.27.1",
+ "spki 0.7.3",
+ "strum 0.27.2",
  "stun-rs",
  "surge-ping",
  "swarm-discovery",
@@ -2343,16 +2452,16 @@ dependencies = [
 name = "iroh-base"
 version = "0.92.0"
 dependencies = [
- "curve25519-dalek",
+ "curve25519-dalek 5.0.0-pre.1",
  "data-encoding",
  "derive_more 2.0.1",
- "ed25519-dalek",
+ "ed25519-dalek 3.0.0-pre.1",
  "n0-snafu",
  "nested_enum_utils",
  "postcard",
  "proptest",
- "rand 0.8.5",
- "rand_core 0.6.4",
+ "rand 0.9.2",
+ "rand_core 0.9.3",
  "serde",
  "serde_json",
  "serde_test",
@@ -2372,8 +2481,8 @@ dependencies = [
  "iroh-quinn",
  "n0-future",
  "n0-snafu",
- "rand 0.8.5",
- "rcgen 0.14.2",
+ "rand 0.9.2",
+ "rcgen 0.14.5",
  "rustls",
  "tokio",
  "tracing",
@@ -2406,8 +2515,8 @@ dependencies = [
  "n0-future",
  "n0-snafu",
  "pkarr",
- "rand 0.8.5",
- "rand_chacha 0.3.1",
+ "rand 0.9.2",
+ "rand_chacha 0.9.0",
  "rcgen 0.13.2",
  "redb",
  "regex",
@@ -2461,7 +2570,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -2478,7 +2587,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2 0.5.10",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tokio",
  "tracing",
  "web-time",
@@ -2499,7 +2608,7 @@ dependencies = [
  "rustls-pki-types",
  "rustls-platform-verifier",
  "slab",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tinyvec",
  "tracing",
  "web-time",
@@ -2553,9 +2662,9 @@ dependencies = [
  "pkarr",
  "postcard",
  "proptest",
- "rand 0.8.5",
- "rand_chacha 0.3.1",
- "rcgen 0.14.2",
+ "rand 0.9.2",
+ "rand_chacha 0.9.0",
+ "rcgen 0.14.5",
  "regex",
  "reloadable-state",
  "reqwest",
@@ -2571,7 +2680,7 @@ dependencies = [
  "sha1",
  "simdutf8",
  "snafu",
- "strum 0.27.1",
+ "strum 0.27.2",
  "time",
  "tokio",
  "tokio-rustls",
@@ -2644,9 +2753,9 @@ checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
 [[package]]
 name = "js-sys"
-version = "0.3.80"
+version = "0.3.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852f13bec5eba4ba9afbeb93fd7c13fe56147f055939ae21c43a29a0ecb2702e"
+checksum = "ec48937a97411dcb524a265206ccd4c90bb711fca92b2792c407f268825b9305"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -2660,15 +2769,15 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "libc"
-version = "0.2.174"
+version = "0.2.176"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
+checksum = "58f929b4d672ea937a23a1ab494143d968337a5f47e56d0815df1e0890ddf174"
 
 [[package]]
 name = "libredox"
-version = "0.1.4"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1580801010e535496706ba011c15f8532df6b42297d2e471fec38ceadd8c0638"
+checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb"
 dependencies = [
  "bitflags",
  "libc",
@@ -2682,9 +2791,9 @@ checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.9.4"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
 
 [[package]]
 name = "litemap"
@@ -2694,9 +2803,9 @@ checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
 
 [[package]]
 name = "litrs"
-version = "0.4.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ce301924b7887e9d637144fdade93f9dfff9b60981d4ac161db09720d39aa5"
+checksum = "f5e54036fe321fd421e10d732f155734c4e4afd610dd556d9a82833ab3ee0bed"
 
 [[package]]
 name = "lock_api"
@@ -2710,9 +2819,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.27"
+version = "0.4.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
 
 [[package]]
 name = "loom"
@@ -2733,7 +2842,7 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "227748d55f2f0ab4735d87fd623798cb6b664512fe979705f829c9f81c934465"
 dependencies = [
- "hashbrown 0.15.4",
+ "hashbrown 0.15.5",
 ]
 
 [[package]]
@@ -2751,7 +2860,7 @@ dependencies = [
  "crc",
  "document-features",
  "dyn-clone",
- "ed25519-dalek",
+ "ed25519-dalek 2.2.0",
  "flume",
  "futures-lite",
  "getrandom 0.2.16",
@@ -2760,7 +2869,7 @@ dependencies = [
  "serde_bencode",
  "serde_bytes",
  "sha1_smol",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tracing",
 ]
 
@@ -2835,20 +2944,19 @@ dependencies = [
 
 [[package]]
 name = "moka"
-version = "0.12.10"
+version = "0.12.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9321642ca94a4282428e6ea4af8cc2ca4eac48ac7a6a4ea8f33f76d0ce70926"
+checksum = "8261cd88c312e0004c1d51baad2980c66528dfdb2bee62003e643a4d8f86b077"
 dependencies = [
  "crossbeam-channel",
  "crossbeam-epoch",
  "crossbeam-utils",
- "loom",
+ "equivalent",
  "parking_lot",
  "portable-atomic",
  "rustc_version",
  "smallvec",
  "tagptr",
- "thiserror 1.0.69",
  "uuid",
 ]
 
@@ -3007,7 +3115,7 @@ dependencies = [
  "log",
  "netlink-packet-core",
  "netlink-sys",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
 ]
 
 [[package]]
@@ -3054,7 +3162,7 @@ dependencies = [
  "tracing",
  "web-sys",
  "windows",
- "windows-result",
+ "windows-result 0.3.4",
  "wmi",
 ]
 
@@ -3169,7 +3277,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -3286,35 +3394,35 @@ dependencies = [
 
 [[package]]
 name = "pem-rfc7468"
-version = "0.7.0"
+version = "1.0.0-rc.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+checksum = "a8e58fab693c712c0d4e88f8eb3087b6521d060bcaf76aeb20cb192d809115ba"
 dependencies = [
  "base64ct",
 ]
 
 [[package]]
 name = "percent-encoding"
-version = "2.3.1"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1db05f56d34358a8b1066f67cbb203ee3e7ed2ba674a6263a1d5ec6db2204323"
+checksum = "21e0a3a33733faeaf8651dfee72dd0f388f0c8e5ad496a3478fa5a922f49cfa8"
 dependencies = [
  "memchr",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "ucd-trie",
 ]
 
 [[package]]
 name = "pest_derive"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb056d9e8ea77922845ec74a1c4e8fb17e7c218cc4fc11a15c5d25e189aa40bc"
+checksum = "bc58706f770acb1dbd0973e6530a3cff4746fb721207feb3a8a6064cd0b6c663"
 dependencies = [
  "pest",
  "pest_generator",
@@ -3322,25 +3430,25 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87e404e638f781eb3202dc82db6760c8ae8a1eeef7fb3fa8264b2ef280504966"
+checksum = "6d4f36811dfe07f7b8573462465d5cb8965fffc2e71ae377a33aecf14c2c9a2f"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edd1101f170f5903fde0914f899bb503d9ff5271d7ba76bbb70bea63690cc0d5"
+checksum = "42919b05089acbd0a5dcd5405fb304d17d1053847b81163d09c4ad18ce8e8420"
 dependencies = [
  "pest",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -3370,7 +3478,7 @@ checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -3387,9 +3495,8 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkarr"
-version = "3.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41a50f65a2b97031863fbdff2f085ba832360b4bef3106d1fcff9ab5bf4063fe"
+version = "3.10.0"
+source = "git+https://github.com/dignifiedquire/pkarr?branch=feat-rand-09#906257d9301a153c40a80a693dd0a082e8cb1f12"
 dependencies = [
  "async-compat",
  "base32",
@@ -3397,10 +3504,10 @@ dependencies = [
  "cfg_aliases",
  "document-features",
  "dyn-clone",
- "ed25519-dalek",
+ "ed25519-dalek 3.0.0-pre.1",
  "futures-buffered",
  "futures-lite",
- "getrandom 0.2.16",
+ "getrandom 0.3.3",
  "log",
  "lru",
  "mainline",
@@ -3410,7 +3517,7 @@ dependencies = [
  "serde",
  "sha1_smol",
  "simple-dns",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tokio",
  "tracing",
  "url",
@@ -3423,8 +3530,18 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.11.0-rc.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93eac55f10aceed84769df670ea4a32d2ffad7399400d41ee1c13b1cd8e1b478"
+dependencies = [
+ "der 0.8.0-rc.9",
+ "spki 0.8.0-rc.4",
 ]
 
 [[package]]
@@ -3473,7 +3590,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -3532,7 +3649,7 @@ dependencies = [
  "nested_enum_utils",
  "netwatch",
  "num_enum",
- "rand 0.9.1",
+ "rand 0.9.2",
  "serde",
  "smallvec",
  "snafu",
@@ -3547,9 +3664,9 @@ dependencies = [
 
 [[package]]
 name = "postcard"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c1de96e20f51df24ca73cafcc4690e044854d803259db27a00a461cb3b9d17a"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
 dependencies = [
  "cobs",
  "embedded-io 0.4.0",
@@ -3561,20 +3678,20 @@ dependencies = [
 
 [[package]]
 name = "postcard-derive"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68f049d94cb6dda6938cc8a531d2898e7c08d71c6de63d8e67123cca6cdde2cc"
+checksum = "e0232bd009a197ceec9cc881ba46f727fcd8060a2d8d6a9dde7a69030a6fe2bb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
 name = "potential_utf"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5a7c30837279ca13e7c867e9e40053bc68740f988cb07f7ca6df43cc734b585"
+checksum = "84df19adbe5b5a0782edcab45899906947ab039ccf4573713735ee7de1e6b08a"
 dependencies = [
  "zerovec",
 ]
@@ -3650,34 +3767,34 @@ dependencies = [
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.3.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edce586971a4dfaa28950c6f18ed55e0406c1ab88bbce2c6f6293a7aaba73d35"
+checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
 dependencies = [
  "toml_edit",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.95"
+version = "1.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "proptest"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fcdab19deb5195a31cf7726a210015ff1496ba1464fd42cb4f537b8b01b471f"
+checksum = "2bb0be07becd10686a0bb407298fb425360a5c44a663774406340c59a22de4ce"
 dependencies = [
  "bit-set",
  "bit-vec",
  "bitflags",
  "lazy_static",
  "num-traits",
- "rand 0.9.1",
+ "rand 0.9.2",
  "rand_chacha 0.9.0",
  "rand_xorshift",
  "regex-syntax",
@@ -3709,9 +3826,9 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quinn"
-version = "0.11.8"
+version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
 dependencies = [
  "bytes",
  "cfg_aliases",
@@ -3720,8 +3837,8 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls",
- "socket2 0.5.10",
- "thiserror 2.0.12",
+ "socket2 0.6.0",
+ "thiserror 2.0.16",
  "tokio",
  "tracing",
  "web-time",
@@ -3729,20 +3846,20 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.12"
+version = "0.11.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
+checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
 dependencies = [
  "bytes",
  "getrandom 0.3.3",
  "lru-slab",
- "rand 0.9.1",
+ "rand 0.9.2",
  "ring",
  "rustc-hash",
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tinyvec",
  "tracing",
  "web-time",
@@ -3750,16 +3867,16 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.13"
+version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcebb1209ee276352ef14ff8732e24cc2b02bbac986cd74a4c81bcb2f9881970"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
 dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.0",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3800,9 +3917,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.1"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.3",
@@ -3857,18 +3974,18 @@ dependencies = [
 
 [[package]]
 name = "raw-cpuid"
-version = "11.5.0"
+version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6df7ab838ed27997ba19a4664507e6f82b41fe6e20be42929332156e5e85146"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
  "bitflags",
 ]
 
 [[package]]
 name = "rayon"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
+checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
 dependencies = [
  "either",
  "rayon-core",
@@ -3876,9 +3993,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.12.1"
+version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
@@ -3899,9 +4016,9 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.14.2"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49bc8ffa8a832eb1d7c8000337f8b0d2f4f2f5ec3cf4ddc26f125e3ad2451824"
+checksum = "5fae430c6b28f1ad601274e78b7dffa0546de0b73b4cd32f46723c0c2a16f7a5"
 dependencies = [
  "pem",
  "ring",
@@ -3912,18 +4029,18 @@ dependencies = [
 
 [[package]]
 name = "redb"
-version = "2.6.3"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eca1e9d98d5a7e9002d0013e18d5a9b000aee942eb134883a82f06ebffb6c01"
+checksum = "ea0a72cd7140de9fc3e318823b883abf819c20d478ec89ce880466dc2ef263c6"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.13"
+version = "0.5.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d04b7d0ee6b4a0207a0a7adb104d23ecb0b47d6beae7152d0fa34b692b29fd6"
+checksum = "5407465600fb0548f1442edf71dd20683c6ed326200ace4b1ef0763521bb3b77"
 dependencies = [
  "bitflags",
 ]
@@ -3941,9 +4058,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.11.1"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -3953,9 +4070,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -3964,15 +4081,15 @@ dependencies = [
 
 [[package]]
 name = "regex-lite"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53a49587ad06b26609c52e423de037e7f57f20d53535d66e08c695f347df952a"
+checksum = "943f41321c63ef1c92fd763bfe054d2668f7f225a5c29f0105903dc2fc04ba30"
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
 
 [[package]]
 name = "reloadable-core"
@@ -3993,9 +4110,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.12.22"
+version = "0.12.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbc931937e6ca3a06e3b6c0aa7841849b160a90351d6ab467a8b9b9959767531"
+checksum = "d429f34c8092b2d42c7c93cec323bb4adeb7c67698f70839adec842ec10c7ceb"
 dependencies = [
  "base64",
  "bytes",
@@ -4029,14 +4146,14 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots 1.0.1",
+ "webpki-roots 1.0.2",
 ]
 
 [[package]]
 name = "resolv-conf"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95325155c684b1c89f7765e30bc1c42e4a6da51ca513615660cb8a62ef9a88e3"
+checksum = "6b3789b30bd25ba102de4beabd95d21ac45b69b1be7d14522bab988c526d6799"
 
 [[package]]
 name = "ring"
@@ -4054,9 +4171,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.25"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
+checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
 
 [[package]]
 name = "rustc-hash"
@@ -4084,22 +4201,22 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.0.7"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
+checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
 dependencies = [
  "bitflags",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.29"
+version = "0.23.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2491382039b29b9b11ff08b76ff6c97cf287671dbb74f0be44bda389fffe9bd1"
+checksum = "cd3c25631629d034ce7cd9940adc9d45762d46de2b0f57193c4443b92c6d4d40"
 dependencies = [
  "log",
  "once_cell",
@@ -4119,7 +4236,7 @@ dependencies = [
  "rustls-cert-read",
  "rustls-pemfile",
  "rustls-pki-types",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tokio",
 ]
 
@@ -4142,7 +4259,7 @@ dependencies = [
  "reloadable-state",
  "rustls",
  "rustls-cert-read",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
 ]
 
 [[package]]
@@ -4205,9 +4322,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.4"
+version = "0.103.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc"
+checksum = "8572f3c2cb9934231157b45499fc41e1f58c589fdfb81a844ba873265e80f8eb"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -4216,9 +4333,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.21"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "rusty-fork"
@@ -4258,11 +4375,11 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.27"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f29ebaa345f945cec9fbbc532eb307f0fdad8161f281b6369539c8d84876b3d"
+checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -4279,9 +4396,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "security-framework"
-version = "3.2.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271720403f46ca04f7ba6f55d438f8bd878d6b8ca0a1046e8228c4145bcbb316"
+checksum = "cc198e42d9b7510827939c9a15f5062a0c913f3371d765977e586d2fe6c16f4a"
 dependencies = [
  "bitflags",
  "core-foundation 0.10.1",
@@ -4292,9 +4409,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.14.0"
+version = "2.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49db231d56a190491cb4aeda9527f1ad45345af50b0851622a7adb8c03b01c32"
+checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -4308,9 +4425,9 @@ checksum = "0f7d95a54511e0c7be3f51e8867aa8cf35148d7b9445d44de2f943e2b206e749"
 
 [[package]]
 name = "semver"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
 
 [[package]]
 name = "send_wrapper"
@@ -4320,10 +4437,11 @@ checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
 
 [[package]]
 name = "serde"
-version = "1.0.219"
+version = "1.0.226"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "0dca6411025b24b60bfa7ec1fe1f8e710ac09782dca409ee8237ba74b51295fd"
 dependencies = [
+ "serde_core",
  "serde_derive",
 ]
 
@@ -4350,53 +4468,65 @@ dependencies = [
 
 [[package]]
 name = "serde_bytes"
-version = "0.11.17"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
 dependencies = [
  "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.226"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba2ba63999edb9dac981fb34b3e5c0d111a69b0924e253ed29d83f7c99e966a4"
+dependencies = [
+ "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.226"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "8db53ae22f34573731bafa1db20f04027b2d25e02d8205921b569171699cdb33"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.140"
+version = "1.0.145"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
+checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
 dependencies = [
  "itoa",
  "memchr",
  "ryu",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "serde_path_to_error"
-version = "0.1.17"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59fab13f937fa393d08645bf3a84bdfe86e296747b506ada67bb15f10f218b2a"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
 dependencies = [
  "itoa",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40734c41988f7306bb04f0ecf60ec0f3f1caa34290e4e8ea471dcd3346483b83"
+checksum = "5417783452c2be558477e104686f7de5dae53dba813c28435e0e70f82d9b04ee"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -4438,7 +4568,7 @@ checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
  "cpufeatures",
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -4455,7 +4585,18 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures",
- "digest",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0-rc.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1e3878ab0f98e35b2df35fe53201d088299b41a6bb63e3e34dada2ac4abd924"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.11.0-rc.2",
 ]
 
 [[package]]
@@ -4475,9 +4616,9 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.5"
+version = "1.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410"
+checksum = "b2a4719bff48cee6b39d12c020eeb490953ad2443b7055bd0b21fca26bd8c28b"
 dependencies = [
  "libc",
 ]
@@ -4491,6 +4632,12 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "signature"
+version = "3.0.0-rc.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc280a6ff65c79fbd6622f64d7127f32b85563bca8c53cd2e9141d6744a9056d"
+
 [[package]]
 name = "simdutf8"
 version = "0.1.5"
@@ -4526,9 +4673,9 @@ checksum = "fad6c857cbab2627dcf01ec85a623ca4e7dcb5691cbaa3d7fb7653671f0d09c9"
 
 [[package]]
 name = "snafu"
-version = "0.8.6"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320b01e011bf8d5d7a4a4a4be966d9160968935849c83b918827f6a435e7f627"
+checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
 dependencies = [
  "backtrace",
  "snafu-derive",
@@ -4536,14 +4683,14 @@ dependencies = [
 
 [[package]]
 name = "snafu-derive"
-version = "0.8.6"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1961e2ef424c1424204d3a5d6975f934f56b6d50ff5732382d84ebf460e147f7"
+checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -4575,6 +4722,12 @@ dependencies = [
  "lock_api",
 ]
 
+[[package]]
+name = "spin"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+
 [[package]]
 name = "spinning_top"
 version = "0.3.0"
@@ -4591,7 +4744,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der",
+ "der 0.7.10",
+]
+
+[[package]]
+name = "spki"
+version = "0.8.0-rc.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8baeff88f34ed0691978ec34440140e1572b68c7dd4a495fd14a3dc1944daa80"
+dependencies = [
+ "base64ct",
+ "der 0.8.0-rc.9",
 ]
 
 [[package]]
@@ -4626,7 +4789,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "struct_iterable_internal",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -4646,11 +4809,11 @@ dependencies = [
 
 [[package]]
 name = "strum"
-version = "0.27.1"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f64def088c51c9510a8579e3c5d67c65349dcf755e5479ad3d010aa6454e2c32"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
 dependencies = [
- "strum_macros 0.27.1",
+ "strum_macros 0.27.2",
 ]
 
 [[package]]
@@ -4663,20 +4826,19 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.27.1"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c77a8c5abcaf0f9ce05d62342b7d298c346515365c36b673df4ebe3ced01fde8"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "rustversion",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -4700,7 +4862,7 @@ dependencies = [
  "precis-core",
  "precis-profiles",
  "quoted-string-parser",
- "rand 0.9.1",
+ "rand 0.9.2",
 ]
 
 [[package]]
@@ -4718,7 +4880,7 @@ dependencies = [
  "hex",
  "parking_lot",
  "pnet_packet",
- "rand 0.9.1",
+ "rand 0.9.2",
  "socket2 0.5.10",
  "thiserror 1.0.69",
  "tokio",
@@ -4733,9 +4895,9 @@ checksum = "4eae338a4551897c6a50fa2c041c4b75f578962d9fca8adb828cf81f7158740f"
 dependencies = [
  "acto",
  "hickory-proto",
- "rand 0.9.1",
+ "rand 0.9.2",
  "socket2 0.5.10",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tokio",
  "tracing",
 ]
@@ -4753,9 +4915,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.104"
+version = "2.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
+checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4779,7 +4941,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -4811,15 +4973,15 @@ checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
 
 [[package]]
 name = "tempfile"
-version = "3.20.0"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
+checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
 dependencies = [
  "fastrand",
  "getrandom 0.3.3",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -4842,11 +5004,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.12"
+version = "2.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+checksum = "3467d614147380f2e4e374161426ff399c91084acd2363eaf549172b3d5e60c0"
 dependencies = [
- "thiserror-impl 2.0.12",
+ "thiserror-impl 2.0.16",
 ]
 
 [[package]]
@@ -4857,18 +5019,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.12"
+version = "2.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+checksum = "6c5e1be1c48b9172ee610da68fd9cd2770e7a4056cb3fc98710ee6906f0c7960"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -4882,9 +5044,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.41"
+version = "0.3.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
+checksum = "91e7d9e3bb61134e77bde20dd4825b97c010155709965fedf0f49bb138e52a9d"
 dependencies = [
  "deranged",
  "itoa",
@@ -4900,15 +5062,15 @@ dependencies = [
 
 [[package]]
 name = "time-core"
-version = "0.1.4"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
+checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
 
 [[package]]
 name = "time-macros"
-version = "0.2.22"
+version = "0.2.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
+checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3"
 dependencies = [
  "num-conv",
  "time-core",
@@ -4936,9 +5098,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09b3661f17e86524eccd4371ab0429194e0d7c008abb45f7a7495b1719463c71"
+checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -4951,9 +5113,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.46.1"
+version = "1.47.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc3a2344dafbe23a245241fe8b09735b521110d30fcefbbd5feb1797ca35d17"
+checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
 dependencies = [
  "backtrace",
  "bytes",
@@ -4964,9 +5126,9 @@ dependencies = [
  "pin-project-lite",
  "signal-hook-registry",
  "slab",
- "socket2 0.5.10",
+ "socket2 0.6.0",
  "tokio-macros",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4977,14 +5139,14 @@ checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.2"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
+checksum = "05f63835928ca123f1bef57abbcd23bb2ba0ac9ae1235f1e65bda0d06e7786bd"
 dependencies = [
  "rustls",
  "tokio",
@@ -5011,7 +5173,7 @@ dependencies = [
  "rustls",
  "serde",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "time",
  "tokio",
  "tokio-rustls",
@@ -5033,24 +5195,23 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.15"
+version = "0.7.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66a539a9ad6d5d281510d5bd368c973d636c02dbf8a67300bfb6b950696ad7df"
+checksum = "14307c986784f72ef81c89db7d9e28d6ac26d16213b109ea501696195e6e3ce5"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
  "futures-util",
- "hashbrown 0.15.4",
  "pin-project-lite",
  "tokio",
 ]
 
 [[package]]
 name = "tokio-websockets"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f29ba084eb43becc9864ba514b4a64f5f65b82f9a6ffbafa5436c1c80605f03"
+checksum = "5190767f03b86528ab9f4f6a9158072a6d0ef240d9a9591772eb411f315920f4"
 dependencies = [
  "base64",
  "bytes",
@@ -5059,7 +5220,7 @@ dependencies = [
  "getrandom 0.3.3",
  "http 1.3.1",
  "httparse",
- "rand 0.9.1",
+ "rand 0.9.2",
  "ring",
  "rustls-pki-types",
  "simdutf8",
@@ -5070,14 +5231,14 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.2"
+version = "0.9.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed0aee96c12fa71097902e0bb061a5e1ebd766a6636bb605ba401c45c1650eac"
+checksum = "00e5e5d9bf2475ac9d4f0d9edab68cc573dc2fd644b0dba36b0c30a92dd9eaa0"
 dependencies = [
  "indexmap",
- "serde",
+ "serde_core",
  "serde_spanned",
- "toml_datetime 0.7.0",
+ "toml_datetime",
  "toml_parser",
  "toml_writer",
  "winnow",
@@ -5085,44 +5246,39 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-
-[[package]]
-name = "toml_datetime"
-version = "0.7.0"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bade1c3e902f58d73d3f294cd7f20391c1cb2fbcb643b73566bc773971df91e3"
+checksum = "32f1085dec27c2b6632b04c80b3bb1b4300d6495d1e129693bdda7d91e72eec1"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.27"
+version = "0.23.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+checksum = "f3effe7c0e86fdff4f69cdd2ccc1b96f933e24811c5441d44904e8683e27184b"
 dependencies = [
  "indexmap",
- "toml_datetime 0.6.11",
+ "toml_datetime",
+ "toml_parser",
  "winnow",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.0.1"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97200572db069e74c512a14117b296ba0a80a30123fbbb5aa1f4a348f639ca30"
+checksum = "4cf893c33be71572e0e9aa6dd15e6677937abd686b066eac3f8cd3531688a627"
 dependencies = [
  "winnow",
 ]
 
 [[package]]
 name = "toml_writer"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcc842091f2def52017664b53082ecbbeb5c7731092bad69d2c63050401dfd64"
+checksum = "d163a63c116ce562a22cda521fcc4d79152e7aba014456fb5eb442f6d6a10109"
 
 [[package]]
 name = "tower"
@@ -5182,7 +5338,7 @@ dependencies = [
  "governor",
  "http 1.3.1",
  "pin-project",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "tower",
  "tracing",
 ]
@@ -5207,7 +5363,7 @@ checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -5289,7 +5445,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04659ddb06c87d233c566112c1c9c5b9e98256d9af50ec3bc9c8327f873a7568"
 dependencies = [
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -5336,9 +5492,9 @@ checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.18"
+version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
 
 [[package]]
 name = "unicode-normalization"
@@ -5373,7 +5529,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.6",
  "subtle",
 ]
 
@@ -5385,9 +5541,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.4"
+version = "2.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
+checksum = "08bc136a29a3d1758e07a9cca267be308aeebf5cfd5a10f3f67ab2097683ef5b"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -5409,9 +5565,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.17.0"
+version = "1.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
+checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
 dependencies = [
  "getrandom 0.3.3",
  "js-sys",
@@ -5466,18 +5622,27 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasi"
-version = "0.14.2+wasi-0.2.4"
+version = "0.14.7+wasi-0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
 dependencies = [
- "wit-bindgen-rt",
+ "wasip2",
+]
+
+[[package]]
+name = "wasip2"
+version = "1.0.1+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+dependencies = [
+ "wit-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.103"
+version = "0.2.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab10a69fbd0a177f5f649ad4d8d3305499c42bab9aef2f7ff592d0ec8f833819"
+checksum = "c1da10c01ae9f1ae40cbfac0bac3b1e724b320abfcf52229f80b547c0d250e2d"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -5488,23 +5653,23 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.103"
+version = "0.2.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bb702423545a6007bbc368fde243ba47ca275e549c8a28617f56f6ba53b1d1c"
+checksum = "671c9a5a66f49d8a47345ab942e2cb93c7d1d0339065d4f8139c486121b43b19"
 dependencies = [
  "bumpalo",
  "log",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.53"
+version = "0.4.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0b221ff421256839509adbb55998214a70d829d3a28c69b4a6672e9d2a42f67"
+checksum = "7e038d41e478cc73bae0ff9b36c60cff1c98b8f38f8d7e8061e79ee63608ac5c"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -5515,9 +5680,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.103"
+version = "0.2.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc65f4f411d91494355917b605e1480033152658d71f722a90647f56a70c88a0"
+checksum = "7ca60477e4c59f5f2986c50191cd972e3a50d8a95603bc9434501cf156a9a119"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -5525,31 +5690,31 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.103"
+version = "0.2.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffc003a991398a8ee604a401e194b6b3a39677b3173d6e74495eb51b82e99a32"
+checksum = "9f07d2f20d4da7b26400c9f4a0511e6e0345b040694e8a75bd41d578fa4421d7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.103"
+version = "0.2.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "293c37f4efa430ca14db3721dfbe48d8c33308096bd44d80ebaa775ab71ba1cf"
+checksum = "bad67dc8b2a1a6e5448428adec4c3e84c43e561d8c9ee8a9e5aabeb193ec41d1"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "wasm-bindgen-test"
-version = "0.3.53"
+version = "0.3.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aee0a0f5343de9221a0d233b04520ed8dc2e6728dce180b1dcd9288ec9d9fa3c"
+checksum = "4e381134e148c1062f965a42ed1f5ee933eef2927c3f70d1812158f711d39865"
 dependencies = [
  "js-sys",
  "minicov",
@@ -5560,13 +5725,13 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-test-macro"
-version = "0.3.53"
+version = "0.3.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a369369e4360c2884c3168d22bded735c43cccae97bbc147586d4b480edd138d"
+checksum = "b673bca3298fe582aeef8352330ecbad91849f85090805582400850f8270a2e8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -5584,9 +5749,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.80"
+version = "0.3.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbe734895e869dc429d78c4b433f8d17d95f8d05317440b4fad5ab2d33e596dc"
+checksum = "9367c417a924a74cae129e6a2ae3b47fabb1f8995595ab474029da749a8be120"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -5608,14 +5773,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
 dependencies = [
- "webpki-root-certs 1.0.1",
+ "webpki-root-certs 1.0.2",
 ]
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86138b15b2b7d561bc4469e77027b8dd005a43dc502e9031d1f5afc8ce1f280e"
+checksum = "4e4ffd8df1c57e87c325000a3d6ef93db75279dc3a231125aac571650f22b12a"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -5626,14 +5791,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
- "webpki-roots 1.0.1",
+ "webpki-roots 1.0.2",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8782dd5a41a24eed3a4f40b606249b3e236ca61adf1f25ea4d45c73de122b502"
+checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -5662,11 +5827,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.9"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -5682,9 +5847,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
 dependencies = [
  "windows-collections",
- "windows-core",
+ "windows-core 0.61.2",
  "windows-future",
- "windows-link",
+ "windows-link 0.1.3",
  "windows-numerics",
 ]
 
@@ -5694,7 +5859,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
 dependencies = [
- "windows-core",
+ "windows-core 0.61.2",
 ]
 
 [[package]]
@@ -5705,9 +5870,22 @@ checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
 dependencies = [
  "windows-implement",
  "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57fe7168f7de578d2d8a05b07fd61870d2e73b4020e9f49aa00da8471723497c"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.2.0",
+ "windows-result 0.4.0",
+ "windows-strings 0.5.0",
 ]
 
 [[package]]
@@ -5716,8 +5894,8 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
 dependencies = [
- "windows-core",
- "windows-link",
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
  "windows-threading",
 ]
 
@@ -5729,7 +5907,7 @@ checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -5740,7 +5918,7 @@ checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -5749,14 +5927,20 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
 
+[[package]]
+name = "windows-link"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45e46c0661abb7180e7b9c281db115305d49ca1709ab8242adf09666d2173c65"
+
 [[package]]
 name = "windows-numerics"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
 dependencies = [
- "windows-core",
- "windows-link",
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -5765,7 +5949,16 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
 dependencies = [
- "windows-link",
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7084dcc306f89883455a206237404d3eaf961e5bd7e0f312f7c91f57eb44167f"
+dependencies = [
+ "windows-link 0.2.0",
 ]
 
 [[package]]
@@ -5774,7 +5967,16 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
 dependencies = [
- "windows-link",
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7218c655a553b0bed4426cf54b20d7ba363ef543b52d515b3e48d7fd55318dda"
+dependencies = [
+ "windows-link 0.2.0",
 ]
 
 [[package]]
@@ -5819,7 +6021,16 @@ version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
 dependencies = [
- "windows-targets 0.53.2",
+ "windows-targets 0.53.3",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e201184e40b2ede64bc2ea34968b28e33622acdbbf37104f0e4a33f7abe657aa"
+dependencies = [
+ "windows-link 0.2.0",
 ]
 
 [[package]]
@@ -5870,10 +6081,11 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.53.2"
+version = "0.53.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef"
+checksum = "d5fe6031c4041849d7c496a8ded650796e7b6ecc19df1a431c1a363342e5dc91"
 dependencies = [
+ "windows-link 0.1.3",
  "windows_aarch64_gnullvm 0.53.0",
  "windows_aarch64_msvc 0.53.0",
  "windows_i686_gnu 0.53.0",
@@ -5890,7 +6102,7 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
 dependencies = [
- "windows-link",
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -6075,9 +6287,9 @@ checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
 
 [[package]]
 name = "winnow"
-version = "0.7.12"
+version = "0.7.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3edebf492c8125044983378ecb5766203ad3b4c2f7a922bd7dd207f6d443e95"
+checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
 dependencies = [
  "memchr",
 ]
@@ -6093,13 +6305,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "wit-bindgen-rt"
-version = "0.39.0"
+name = "wit-bindgen"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
-dependencies = [
- "bitflags",
-]
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 
 [[package]]
 name = "wmi"
@@ -6111,9 +6320,9 @@ dependencies = [
  "futures",
  "log",
  "serde",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "windows",
- "windows-core",
+ "windows-core 0.61.2",
 ]
 
 [[package]]
@@ -6135,7 +6344,7 @@ dependencies = [
  "pharos",
  "rustc_version",
  "send_wrapper",
- "thiserror 2.0.12",
+ "thiserror 2.0.16",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
@@ -6208,7 +6417,7 @@ checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
  "synstructure",
 ]
 
@@ -6220,22 +6429,22 @@ checksum = "2164e798d9e3d84ee2c91139ace54638059a3b23e361f5c11781c2c6459bde0f"
 
 [[package]]
 name = "zerocopy"
-version = "0.8.26"
+version = "0.8.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
+checksum = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.26"
+version = "0.8.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
+checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
 
 [[package]]
@@ -6255,7 +6464,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
  "synstructure",
 ]
 
@@ -6278,9 +6487,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.2"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a05eb080e015ba39cc9e23bbe5e7fb04d5fb040350f99f34e338d5fdd294428"
+checksum = "e7aa2bd55086f1ab526693ecbe444205da57e25f4489879da80635a46d90e73b"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -6295,5 +6504,5 @@ checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.106",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 593f1d0ec73..ecacaf319f1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -40,3 +40,7 @@ unexpected_cfgs = { level = "warn", check-cfg = ["cfg(iroh_docsrs)", "cfg(iroh_l
 
 [workspace.lints.clippy]
 unused-async = "warn"
+
+
+[patch.crates-io]
+pkarr = { git = "https://github.com/dignifiedquire/pkarr", branch = "feat-rand-09" }
diff --git a/iroh-base/Cargo.toml b/iroh-base/Cargo.toml
index d77ef678de0..3608da7712d 100644
--- a/iroh-base/Cargo.toml
+++ b/iroh-base/Cargo.toml
@@ -15,13 +15,13 @@ rust-version = "1.85"
 workspace = true
 
 [dependencies]
-curve25519-dalek = { version = "4.1.3", features = ["serde", "rand_core", "zeroize"], optional = true }
+curve25519-dalek = { version = "=5.0.0-pre.1", features = ["serde", "rand_core", "zeroize"], optional = true }
 data-encoding = { version = "2.3.3", optional = true }
-ed25519-dalek = { version = "2.1.1", features = ["serde", "rand_core", "zeroize"], optional = true }
+ed25519-dalek = { version = "=3.0.0-pre.1", features = ["serde", "rand_core", "zeroize"], optional = true }
 derive_more = { version = "2.0.1", features = ["display"], optional = true }
 url = { version = "2.5.3", features = ["serde"], optional = true }
 postcard = { version = "1", default-features = false, features = ["alloc", "use-std", "experimental-derive"], optional = true }
-rand_core = { version = "0.6.4", optional = true }
+rand_core = { version = "0.9", optional = true }
 serde = { version = "1", features = ["derive", "rc"] }
 snafu = { version = "0.8.5", features = ["rust_1_81"], optional = true }
 n0-snafu = "0.2.2"
@@ -30,7 +30,7 @@ nested_enum_utils = "0.2.0"
 [dev-dependencies]
 postcard = { version = "1", features = ["use-std"] }
 proptest = "1.0.0"
-rand = "0.8"
+rand = "0.9"
 serde_json = "1"
 serde_test = "1"
 
diff --git a/iroh-base/src/key.rs b/iroh-base/src/key.rs
index d468819743d..b5df73519e3 100644
--- a/iroh-base/src/key.rs
+++ b/iroh-base/src/key.rs
@@ -13,7 +13,7 @@ use curve25519_dalek::edwards::CompressedEdwardsY;
 pub use ed25519_dalek::{Signature, SignatureError};
 use ed25519_dalek::{SigningKey, VerifyingKey};
 use nested_enum_utils::common_fields;
-use rand_core::CryptoRngCore;
+use rand_core::CryptoRng;
 use serde::{Deserialize, Serialize};
 use snafu::{Backtrace, Snafu};
 
@@ -291,7 +291,7 @@ impl SecretKey {
     /// let mut rng = rand::rngs::OsRng;
     /// let _key = iroh_base::SecretKey::generate(&mut rng);
     /// ```
-    pub fn generate<R: CryptoRngCore>(mut csprng: R) -> Self {
+    pub fn generate<R: CryptoRng>(mut csprng: R) -> Self {
         let secret = SigningKey::generate(&mut csprng);
 
         Self { secret }
diff --git a/iroh-dns-server/Cargo.toml b/iroh-dns-server/Cargo.toml
index 66748166cbb..4b92c368c52 100644
--- a/iroh-dns-server/Cargo.toml
+++ b/iroh-dns-server/Cargo.toml
@@ -64,8 +64,8 @@ criterion = "0.5.1"
 data-encoding = "2.3.3"
 hickory-resolver = "0.25.0"
 iroh = { path = "../iroh" }
-rand = "0.8"
-rand_chacha = "0.3.1"
+rand = "0.9"
+rand_chacha = "0.9"
 tracing-test = "0.2.5"
 
 [[bench]]
diff --git a/iroh-relay/Cargo.toml b/iroh-relay/Cargo.toml
index 27194188875..2b80cca5b23 100644
--- a/iroh-relay/Cargo.toml
+++ b/iroh-relay/Cargo.toml
@@ -44,7 +44,7 @@ postcard = { version = "1", default-features = false, features = [
 ] }
 quinn = { package = "iroh-quinn", version = "0.14.0", default-features = false, features = ["rustls-ring"] }
 quinn-proto = { package = "iroh-quinn-proto", version = "0.13.0" }
-rand = "0.8"
+rand = "0.9"
 reqwest = { version = "0.12", default-features = false, features = [
     "rustls-tls",
 ] }
@@ -123,7 +123,7 @@ getrandom = { version = "0.3.2", features = ["wasm_js"] }
 clap = { version = "4", features = ["derive"] }
 crypto_box = { version = "0.9.1", features = ["serde", "chacha20"] }
 proptest = "1.2.0"
-rand_chacha = "0.3.1"
+rand_chacha = "0.9"
 tokio = { version = "1", features = [
     "io-util",
     "sync",
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index 0b185e7229c..8d362a00b91 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -35,7 +35,7 @@ derive_more = { version = "2.0.1", features = [
     "deref",
     "from_str"
 ] }
-ed25519-dalek = { version = "2.1.1", features = ["serde", "rand_core", "zeroize", "pkcs8", "pem"] }
+ed25519-dalek = { version = "3.0.0-pre.1", features = ["serde", "rand_core", "zeroize", "pkcs8", "pem"] }
 http = "1"
 iroh-base = { version = "0.92.0", default-features = false, features = ["key", "relay"], path = "../iroh-base" }
 iroh-relay = { version = "0.92", path = "../iroh-relay", default-features = false }
@@ -51,7 +51,7 @@ pkarr = { version = "3.7", default-features = false, features = [
 quinn = { package = "iroh-quinn", version = "0.14.0", default-features = false, features = ["rustls-ring"] }
 quinn-proto = { package = "iroh-quinn-proto", version = "0.13.0" }
 quinn-udp = { package = "iroh-quinn-udp", version = "0.5.7" }
-rand = "0.8"
+rand = "0.9"
 reqwest = { version = "0.12", default-features = false, features = [
     "rustls-tls",
     "stream",
@@ -141,7 +141,7 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 axum = { version = "0.8" }
 clap = { version = "4", features = ["derive"] }
 pretty_assertions = "1.4"
-rand_chacha = "0.3.1"
+rand_chacha = "0.9"
 tokio = { version = "1", features = [
     "io-util",
     "sync",
diff --git a/iroh/bench/Cargo.toml b/iroh/bench/Cargo.toml
index 144ef361ec5..4bda4e2f2af 100644
--- a/iroh/bench/Cargo.toml
+++ b/iroh/bench/Cargo.toml
@@ -13,7 +13,7 @@ iroh-metrics = "0.35"
 n0-future = "0.1.1"
 n0-snafu = "0.2.0"
 quinn = { package = "iroh-quinn", version = "0.14" }
-rand = "0.8"
+rand = "0.9"
 rcgen = "0.14"
 rustls = { version = "0.23", default-features = false, features = ["ring"] }
 clap = { version = "4", features = ["derive"] }

From 97e5bb157bea2b968205d55407025f9e0fe04f94 Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Thu, 25 Sep 2025 13:11:09 +0200
Subject: [PATCH 02/16] fixup for basic compile

---
 Cargo.lock                                |  68 +-
 Cargo.toml                                |   1 +
 iroh-base/src/key.rs                      |   2 +-
 iroh-base/src/ticket/node.rs              |   2 +-
 iroh-dns-server/examples/publish.rs       |   3 +-
 iroh-dns-server/src/lib.rs                |   6 +-
 iroh-relay/src/protos/handshake.rs        |  44 +-
 iroh-relay/src/server.rs                  |  14 +-
 iroh-relay/src/server/client.rs           |   8 +-
 iroh-relay/src/server/clients.rs          |   4 +-
 iroh-relay/src/server/http_server.rs      |  19 +-
 iroh/Cargo.toml                           |   2 +-
 iroh/examples/0rtt.rs                     |   3 +-
 iroh/examples/connect-unreliable.rs       |   3 +-
 iroh/examples/connect.rs                  |   3 +-
 iroh/examples/dht_discovery.rs            |   5 +-
 iroh/examples/listen-unreliable.rs        |   3 +-
 iroh/examples/listen.rs                   |   3 +-
 iroh/examples/transfer.rs                 |   3 +-
 iroh/src/disco.rs                         |   4 +-
 iroh/src/discovery.rs                     |  28 +-
 iroh/src/discovery/mdns.rs                |   6 +-
 iroh/src/endpoint.rs                      | 845 +---------------------
 iroh/src/key.rs                           |  18 +-
 iroh/src/magicsock.rs                     |  20 +-
 iroh/src/magicsock/node_map.rs            |   8 +-
 iroh/src/magicsock/node_map/node_state.rs |  10 +-
 iroh/src/net_report/reportgen.rs          |   4 +-
 iroh/src/tls/name.rs                      |   2 +-
 29 files changed, 151 insertions(+), 990 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2f17d4c6beb..1ed81202892 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -33,13 +33,13 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aead"
-version = "0.5.2"
+version = "0.6.0-rc.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+checksum = "ac8202ab55fcbf46ca829833f347a82a2a4ce0596f0304ac322c2d100030cd56"
 dependencies = [
  "bytes",
- "crypto-common 0.1.6",
- "generic-array",
+ "crypto-common 0.2.0-rc.4",
+ "inout",
 ]
 
 [[package]]
@@ -481,6 +481,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9ef36a6fcdb072aa548f3da057640ec10859eb4e91ddf526ee648d50c76a949"
 dependencies = [
  "hybrid-array",
+ "zeroize",
 ]
 
 [[package]]
@@ -549,13 +550,14 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chacha20"
-version = "0.9.1"
+version = "0.10.0-rc.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+checksum = "9bd162f2b8af3e0639d83f28a637e4e55657b7a74508dba5a9bf4da523d5c9e9"
 dependencies = [
  "cfg-if",
  "cipher",
  "cpufeatures",
+ "zeroize",
 ]
 
 [[package]]
@@ -599,11 +601,12 @@ dependencies = [
 
 [[package]]
 name = "cipher"
-version = "0.4.4"
+version = "0.5.0-rc.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+checksum = "1e12a13eb01ded5d32ee9658d94f553a19e804204f2dc811df69ab4d9e0cb8c7"
 dependencies = [
- "crypto-common 0.1.6",
+ "block-buffer 0.11.0-rc.5",
+ "crypto-common 0.2.0-rc.4",
  "inout",
  "zeroize",
 ]
@@ -874,7 +877,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -885,18 +887,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8235645834fbc6832939736ce2f2d08192652269e11010a6240f61b908a1c6"
 dependencies = [
  "hybrid-array",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
 name = "crypto_box"
 version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16182b4f39a82ec8a6851155cc4c0cda3065bb1db33651726a29e1951de0f009"
+source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#4a3ebc3dd6ebad2b1a2919bc292e415427033b4e"
 dependencies = [
  "aead",
  "chacha20",
  "crypto_secretbox",
- "curve25519-dalek 4.1.3",
+ "curve25519-dalek 5.0.0-pre.1",
  "salsa20",
  "serdect",
  "subtle",
@@ -906,13 +908,11 @@ dependencies = [
 [[package]]
 name = "crypto_secretbox"
 version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d6cf87adf719ddf43a805e92c6870a531aedda35ff640442cbaf8674e141e1"
+source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#4a3ebc3dd6ebad2b1a2919bc292e415427033b4e"
 dependencies = [
  "aead",
  "chacha20",
  "cipher",
- "generic-array",
  "poly1305",
  "salsa20",
  "subtle",
@@ -1530,7 +1530,6 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
- "zeroize",
 ]
 
 [[package]]
@@ -2070,6 +2069,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bad028b20a90afcdb5e28a53392562f1db2bdfa238aa1a978b911461bfffb92"
 dependencies = [
  "typenum",
+ "zeroize",
 ]
 
 [[package]]
@@ -2314,11 +2314,11 @@ dependencies = [
 
 [[package]]
 name = "inout"
-version = "0.1.4"
+version = "0.2.0-rc.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+checksum = "1603f76010ff924b616c8f44815a42eb10fb0b93d308b41deaa8da6d4251fd4b"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -3329,12 +3329,6 @@ version = "11.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
 
-[[package]]
-name = "opaque-debug"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
-
 [[package]]
 name = "openssl-probe"
 version = "0.1.6"
@@ -3496,7 +3490,7 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 [[package]]
 name = "pkarr"
 version = "3.10.0"
-source = "git+https://github.com/dignifiedquire/pkarr?branch=feat-rand-09#906257d9301a153c40a80a693dd0a082e8cb1f12"
+source = "git+https://github.com/dignifiedquire/pkarr?branch=feat-rand-09#8d605f12d7d5ef90a599a1e68f94b356b469a80a"
 dependencies = [
  "async-compat",
  "base32",
@@ -3616,12 +3610,11 @@ dependencies = [
 
 [[package]]
 name = "poly1305"
-version = "0.8.0"
+version = "0.9.0-rc.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+checksum = "fb78a635f75d76d856374961deecf61031c0b6f928c83dc9c0924ab6c019c298"
 dependencies = [
  "cpufeatures",
- "opaque-debug",
  "universal-hash",
 ]
 
@@ -4029,9 +4022,9 @@ dependencies = [
 
 [[package]]
 name = "redb"
-version = "2.4.0"
+version = "2.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea0a72cd7140de9fc3e318823b883abf819c20d478ec89ce880466dc2ef263c6"
+checksum = "8eca1e9d98d5a7e9002d0013e18d5a9b000aee942eb134883a82f06ebffb6c01"
 dependencies = [
  "libc",
 ]
@@ -4357,10 +4350,11 @@ checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "salsa20"
-version = "0.10.2"
+version = "0.11.0-rc.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
+checksum = "d3ff3b81c8a6e381bc1673768141383f9328048a60edddcfc752a8291a138443"
 dependencies = [
+ "cfg-if",
  "cipher",
 ]
 
@@ -5525,11 +5519,11 @@ checksum = "323402cff2dd658f39ca17c789b502021b3f18707c91cdf22e3838e1b4023817"
 
 [[package]]
 name = "universal-hash"
-version = "0.5.1"
+version = "0.6.0-rc.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+checksum = "a55be643b40a21558f44806b53ee9319595bc7ca6896372e4e08e5d7d83c9cd6"
 dependencies = [
- "crypto-common 0.1.6",
+ "crypto-common 0.2.0-rc.4",
  "subtle",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index ecacaf319f1..e335fe0e6ab 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,3 +44,4 @@ unused-async = "warn"
 
 [patch.crates-io]
 pkarr = { git = "https://github.com/dignifiedquire/pkarr", branch = "feat-rand-09" }
+crypto_box = { git = "https://github.com/dignifiedquire/nacl-compat", branch = "rand-09" }
diff --git a/iroh-base/src/key.rs b/iroh-base/src/key.rs
index b5df73519e3..e89316217ea 100644
--- a/iroh-base/src/key.rs
+++ b/iroh-base/src/key.rs
@@ -405,7 +405,7 @@ mod tests {
 
     #[test]
     fn test_from_str() {
-        let key = SecretKey::generate(&mut rand::thread_rng());
+        let key = SecretKey::generate(rand::rng());
         assert_eq!(
             SecretKey::from_str(&HEXLOWER.encode(&key.to_bytes()))
                 .unwrap()
diff --git a/iroh-base/src/ticket/node.rs b/iroh-base/src/ticket/node.rs
index e3d9c17fa5f..4476f7d39b5 100644
--- a/iroh-base/src/ticket/node.rs
+++ b/iroh-base/src/ticket/node.rs
@@ -141,7 +141,7 @@ mod tests {
     use crate::key::{PublicKey, SecretKey};
 
     fn make_ticket() -> NodeTicket {
-        let peer = SecretKey::generate(&mut rand::thread_rng()).public();
+        let peer = SecretKey::generate(rand::rng()).public();
         let addr = SocketAddr::from((Ipv4Addr::LOCALHOST, 1234));
         let relay_url = None;
         NodeTicket {
diff --git a/iroh-dns-server/examples/publish.rs b/iroh-dns-server/examples/publish.rs
index 27553b66e3e..56d8873d8d9 100644
--- a/iroh-dns-server/examples/publish.rs
+++ b/iroh-dns-server/examples/publish.rs
@@ -11,6 +11,7 @@ use iroh::{
     node_info::{IROH_TXT_NAME, NodeIdExt, NodeInfo},
 };
 use n0_snafu::{Result, ResultExt};
+use rand::TryRngCore;
 use url::Url;
 
 const DEV_PKARR_RELAY_URL: &str = "http://localhost:8080/pkarr";
@@ -63,7 +64,7 @@ async fn main() -> Result<()> {
         Ok(s) => SecretKey::from_str(&s)
             .context("failed to parse IROH_SECRET environment variable as iroh secret key")?,
         Err(_) => {
-            let s = SecretKey::generate(rand::rngs::OsRng);
+            let s = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
             println!("Generated a new node secret. To reuse, set");
             println!(
                 "\tIROH_SECRET={}",
diff --git a/iroh-dns-server/src/lib.rs b/iroh-dns-server/src/lib.rs
index dad3ad93a32..947ec3986f0 100644
--- a/iroh-dns-server/src/lib.rs
+++ b/iroh-dns-server/src/lib.rs
@@ -167,7 +167,7 @@ mod tests {
 
         let origin = "irohdns.example.";
 
-        let secret_key = SecretKey::generate(rand::thread_rng());
+        let secret_key = SecretKey::generate(rand::rng());
         let node_id = secret_key.public();
         let pkarr = PkarrRelayClient::new(pkarr_relay);
         let relay_url: RelayUrl = "https://relay.example.".parse()?;
@@ -231,7 +231,7 @@ mod tests {
         let origin = "irohdns.example.";
 
         // create a signed packet
-        let secret_key = SecretKey::generate(rand::thread_rng());
+        let secret_key = SecretKey::generate(rand::rng());
         let node_id = secret_key.public();
         let relay_url: RelayUrl = "https://relay.example.".parse()?;
         let node_info = NodeInfo::new(node_id).with_relay_url(Some(relay_url.clone()));
@@ -261,7 +261,7 @@ mod tests {
     }
 
     fn random_signed_packet() -> Result<SignedPacket> {
-        let secret_key = SecretKey::generate(rand::thread_rng());
+        let secret_key = SecretKey::generate(rand::rng());
         let node_id = secret_key.public();
         let relay_url: RelayUrl = "https://relay.example.".parse()?;
         let node_info = NodeInfo::new(node_id).with_relay_url(Some(relay_url.clone()));
diff --git a/iroh-relay/src/protos/handshake.rs b/iroh-relay/src/protos/handshake.rs
index e5bbdede1c8..ebb8077f9bc 100644
--- a/iroh-relay/src/protos/handshake.rs
+++ b/iroh-relay/src/protos/handshake.rs
@@ -34,7 +34,7 @@ use iroh_base::{PublicKey, SecretKey};
 use n0_future::{SinkExt, TryStreamExt};
 use nested_enum_utils::common_fields;
 #[cfg(feature = "server")]
-use rand::{CryptoRng, RngCore};
+use rand::CryptoRng;
 use snafu::{Backtrace, ResultExt, Snafu};
 use tracing::trace;
 
@@ -196,7 +196,7 @@ pub(crate) enum VerificationError {
 impl ServerChallenge {
     /// Generates a new challenge.
     #[cfg(feature = "server")]
-    pub(crate) fn new(mut rng: impl RngCore + CryptoRng) -> Self {
+    pub(crate) fn new(mut rng: impl CryptoRng) -> Self {
         let mut challenge = [0u8; 16];
         rng.fill_bytes(&mut challenge);
         Self { challenge }
@@ -402,7 +402,6 @@ pub(crate) enum Mechanism {
 pub(crate) async fn serverside(
     io: &mut (impl BytesStreamSink + ExportKeyingMaterial),
     client_auth_header: Option<HeaderValue>,
-    rng: impl RngCore + CryptoRng,
 ) -> Result<SuccessfulAuthentication, Error> {
     if let Some(client_auth_header) = client_auth_header {
         let client_auth_bytes = data_encoding::BASE64URL_NOPAD
@@ -433,7 +432,7 @@ pub(crate) async fn serverside(
         // We'll fall back to verification that takes another round trip more time.
     }
 
-    let challenge = ServerChallenge::new(rng);
+    let challenge = ServerChallenge::new(rand::rng());
     write_frame(io, &challenge).await?;
 
     let (_, frame) = read_frame(io, &[ClientAuth::TAG]).await?;
@@ -647,10 +646,9 @@ mod tests {
             }
             .instrument(info_span!("clientside")),
             async {
-                let auth_n =
-                    super::serverside(&mut server_io, client_auth_header, rand::rngs::OsRng)
-                        .await
-                        .context("serverside")?;
+                let auth_n = super::serverside(&mut server_io, client_auth_header)
+                    .await
+                    .context("serverside")?;
                 let mechanism = auth_n.mechanism;
                 let is_authorized = restricted_to.is_none_or(|key| key == auth_n.client_key);
                 let key = auth_n.authorize_if(is_authorized, &mut server_io).await?;
@@ -664,7 +662,7 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_via_shared_secrets() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
         let (client, server) = simulate_handshake(&secret_key, Some(42), Some(42), None).await;
         client?;
         let (public_key, auth) = server?;
@@ -676,7 +674,7 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_via_challenge() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
         let (client, server) = simulate_handshake(&secret_key, None, None, None).await;
         client?;
         let (public_key, auth) = server?;
@@ -688,7 +686,7 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_mismatching_shared_secrets() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
         // mismatching shared secrets *might* happen with HTTPS proxies that don't also middle-man the shared secret
         let (client, server) = simulate_handshake(&secret_key, Some(10), Some(99), None).await;
         client?;
@@ -701,7 +699,7 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_challenge_fallback() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
         // clients might not have access to shared secrets
         let (client, server) = simulate_handshake(&secret_key, None, Some(99), None).await;
         client?;
@@ -714,7 +712,7 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_with_auth_positive() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
         let public_key = secret_key.public();
         let (client, server) = simulate_handshake(&secret_key, None, None, Some(public_key)).await;
         client?;
@@ -726,9 +724,9 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_with_auth_negative() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
         let public_key = secret_key.public();
-        let wrong_secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let wrong_secret_key = SecretKey::generate(rand::rng());
         let (client, server) =
             simulate_handshake(&wrong_secret_key, None, None, Some(public_key)).await;
         assert!(client.is_err());
@@ -739,9 +737,9 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_via_shared_secret_with_auth_negative() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
         let public_key = secret_key.public();
-        let wrong_secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let wrong_secret_key = SecretKey::generate(rand::rng());
         let (client, server) =
             simulate_handshake(&wrong_secret_key, Some(42), Some(42), Some(public_key)).await;
         assert!(client.is_err());
@@ -751,8 +749,8 @@ mod tests {
 
     #[test]
     fn test_client_auth_roundtrip() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
-        let challenge = ServerChallenge::new(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
+        let challenge = ServerChallenge::new(rand::rng());
         let client_auth = ClientAuth::new(&secret_key, &challenge);
 
         let bytes = postcard::to_allocvec(&client_auth).e()?;
@@ -766,7 +764,7 @@ mod tests {
 
     #[test]
     fn test_km_client_auth_roundtrip() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
         let client_auth = KeyMaterialClientAuth::new(
             &secret_key,
             &TestKeyingMaterial {
@@ -787,8 +785,8 @@ mod tests {
 
     #[test]
     fn test_challenge_verification() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
-        let challenge = ServerChallenge::new(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
+        let challenge = ServerChallenge::new(rand::rng());
         let client_auth = ClientAuth::new(&secret_key, &challenge);
         assert!(client_auth.verify(&challenge).is_ok());
 
@@ -797,7 +795,7 @@ mod tests {
 
     #[test]
     fn test_key_material_verification() -> Result {
-        let secret_key = SecretKey::generate(rand::rngs::OsRng);
+        let secret_key = SecretKey::generate(rand::rng());
         let io = TestKeyingMaterial {
             inner: (),
             shared_secret: Some(42),
diff --git a/iroh-relay/src/server.rs b/iroh-relay/src/server.rs
index b793c22484a..6cf9554e53b 100644
--- a/iroh-relay/src/server.rs
+++ b/iroh-relay/src/server.rs
@@ -893,7 +893,7 @@ mod tests {
         let relay_url: RelayUrl = relay_url.parse()?;
 
         // set up client a
-        let a_secret_key = SecretKey::generate(rand::thread_rng());
+        let a_secret_key = SecretKey::generate(rand::rng());
         let a_key = a_secret_key.public();
         let resolver = dns_resolver();
         info!("client a build & connect");
@@ -902,7 +902,7 @@ mod tests {
             .await?;
 
         // set up client b
-        let b_secret_key = SecretKey::generate(rand::thread_rng());
+        let b_secret_key = SecretKey::generate(rand::rng());
         let b_key = b_secret_key.public();
         info!("client b build & connect");
         let mut client_b = ClientBuilder::new(relay_url.clone(), b_secret_key, resolver.clone())
@@ -950,7 +950,7 @@ mod tests {
         let current_span = tracing::info_span!("this is a test");
         let _guard = current_span.enter();
 
-        let a_secret_key = SecretKey::generate(rand::thread_rng());
+        let a_secret_key = SecretKey::generate(rand::rng());
         let a_key = a_secret_key.public();
 
         let server = Server::spawn(ServerConfig::<(), ()> {
@@ -993,7 +993,7 @@ mod tests {
         // test that another client has access
 
         // set up client b
-        let b_secret_key = SecretKey::generate(rand::thread_rng());
+        let b_secret_key = SecretKey::generate(rand::rng());
         let b_key = b_secret_key.public();
 
         let resolver = dns_resolver();
@@ -1002,7 +1002,7 @@ mod tests {
             .await?;
 
         // set up client c
-        let c_secret_key = SecretKey::generate(rand::thread_rng());
+        let c_secret_key = SecretKey::generate(rand::rng());
         let c_key = c_secret_key.public();
 
         let resolver = dns_resolver();
@@ -1036,14 +1036,14 @@ mod tests {
         let relay_url: RelayUrl = relay_url.parse().unwrap();
 
         // set up client a
-        let a_secret_key = SecretKey::generate(rand::thread_rng());
+        let a_secret_key = SecretKey::generate(rand::rng());
         let resolver = dns_resolver();
         let mut client_a = ClientBuilder::new(relay_url.clone(), a_secret_key, resolver.clone())
             .connect()
             .await?;
 
         // set up client b
-        let b_secret_key = SecretKey::generate(rand::thread_rng());
+        let b_secret_key = SecretKey::generate(rand::rng());
         let b_key = b_secret_key.public();
         let _client_b = ClientBuilder::new(relay_url.clone(), b_secret_key, resolver.clone())
             .connect()
diff --git a/iroh-relay/src/server/client.rs b/iroh-relay/src/server/client.rs
index 2b0bb824a57..085278763b3 100644
--- a/iroh-relay/src/server/client.rs
+++ b/iroh-relay/src/server/client.rs
@@ -330,7 +330,7 @@ impl Actor {
 
         // Add some jitter to ping pong interactions, to avoid all pings being sent at the same time
         let next_interval = || {
-            let random_secs = rand::rngs::OsRng.gen_range(1..=5);
+            let random_secs = rand::rng().random_range(1..=5);
             Duration::from_secs(random_secs) + PING_INTERVAL
         };
 
@@ -603,7 +603,7 @@ mod tests {
         let (disco_send_queue_s, disco_send_queue_r) = mpsc::channel(10);
         let (peer_gone_s, peer_gone_r) = mpsc::channel(10);
 
-        let node_id = SecretKey::generate(rand::thread_rng()).public();
+        let node_id = SecretKey::generate(rand::rng()).public();
         let (io, io_rw) = tokio::io::duplex(1024);
         let mut io_rw = Conn::test(io_rw);
         let stream = RelayedStream::test(io);
@@ -685,7 +685,7 @@ mod tests {
         let frame = recv_frame(FrameType::Pong, &mut io_rw).await?;
         assert_eq!(frame, RelayToClientMsg::Pong(*data));
 
-        let target = SecretKey::generate(rand::thread_rng()).public();
+        let target = SecretKey::generate(rand::rng()).public();
 
         // send packet
         println!("  send packet");
@@ -731,7 +731,7 @@ mod tests {
 
         // Prepare a frame to send, assert its size.
         let data = Datagrams::from(b"hello world!!!!!");
-        let target = SecretKey::generate(rand::thread_rng()).public();
+        let target = SecretKey::generate(rand::rng()).public();
         let frame = ClientToRelayMsg::Datagrams {
             dst_node_id: target,
             datagrams: data.clone(),
diff --git a/iroh-relay/src/server/clients.rs b/iroh-relay/src/server/clients.rs
index 348883bdf32..8190d2321ec 100644
--- a/iroh-relay/src/server/clients.rs
+++ b/iroh-relay/src/server/clients.rs
@@ -242,8 +242,8 @@ mod tests {
 
     #[tokio::test]
     async fn test_clients() -> Result {
-        let a_key = SecretKey::generate(rand::thread_rng()).public();
-        let b_key = SecretKey::generate(rand::thread_rng()).public();
+        let a_key = SecretKey::generate(rand::rng()).public();
+        let b_key = SecretKey::generate(rand::rng()).public();
 
         let (builder_a, mut a_rw) = test_client_builder(a_key);
 
diff --git a/iroh-relay/src/server/http_server.rs b/iroh-relay/src/server/http_server.rs
index 4cd4dbdafa5..8622da5cdcb 100644
--- a/iroh-relay/src/server/http_server.rs
+++ b/iroh-relay/src/server/http_server.rs
@@ -673,8 +673,7 @@ impl Inner {
 
         let mut io = WsBytesFramed { io: websocket };
 
-        let authentication =
-            handshake::serverside(&mut io, client_auth_header, rand::rngs::OsRng).await?;
+        let authentication = handshake::serverside(&mut io, client_auth_header).await?;
 
         trace!(?authentication.mechanism, "accept: verified authentication");
 
@@ -909,8 +908,8 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_http_clients_and_server() -> Result {
-        let a_key = SecretKey::generate(rand::thread_rng());
-        let b_key = SecretKey::generate(rand::thread_rng());
+        let a_key = SecretKey::generate(rand::rng());
+        let b_key = SecretKey::generate(rand::rng());
 
         // start server
         let server = ServerBuilder::new("127.0.0.1:0".parse().unwrap())
@@ -1024,8 +1023,8 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_https_clients_and_server() -> Result {
-        let a_key = SecretKey::generate(rand::thread_rng());
-        let b_key = SecretKey::generate(rand::thread_rng());
+        let a_key = SecretKey::generate(rand::rng());
+        let b_key = SecretKey::generate(rand::rng());
 
         // create tls_config
         let tls_config = make_tls_config();
@@ -1125,7 +1124,7 @@ mod tests {
         );
 
         info!("Create client A and connect it to the server.");
-        let key_a = SecretKey::generate(rand::thread_rng());
+        let key_a = SecretKey::generate(rand::rng());
         let public_key_a = key_a.public();
         let (client_a, rw_a) = tokio::io::duplex(10);
         let s = service.clone();
@@ -1135,7 +1134,7 @@ mod tests {
         handler_task.await.context("join")??;
 
         info!("Create client B and connect it to the server.");
-        let key_b = SecretKey::generate(rand::thread_rng());
+        let key_b = SecretKey::generate(rand::rng());
         let public_key_b = key_b.public();
         let (client_b, rw_b) = tokio::io::duplex(10);
         let s = service.clone();
@@ -1223,7 +1222,7 @@ mod tests {
         );
 
         info!("Create client A and connect it to the server.");
-        let key_a = SecretKey::generate(rand::thread_rng());
+        let key_a = SecretKey::generate(rand::rng());
         let public_key_a = key_a.public();
         let (client_a, rw_a) = tokio::io::duplex(10);
         let s = service.clone();
@@ -1233,7 +1232,7 @@ mod tests {
         handler_task.await.context("join")??;
 
         info!("Create client B and connect it to the server.");
-        let key_b = SecretKey::generate(rand::thread_rng());
+        let key_b = SecretKey::generate(rand::rng());
         let public_key_b = key_b.public();
         let (client_b, rw_b) = tokio::io::duplex(10);
         let s = service.clone();
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index 8d362a00b91..6d8aebc9f5d 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -21,7 +21,7 @@ crate-type = ["lib", "cdylib"]
 workspace = true
 
 [dependencies]
-aead = { version = "0.5.2", features = ["bytes", "std"] }
+aead = { version = "=0.6.0-rc.2", features = ["bytes"] }
 backon = { version = "1.4" }
 bytes = "1.7"
 crypto_box = { version = "0.9.1", features = ["serde", "chacha20"] }
diff --git a/iroh/examples/0rtt.rs b/iroh/examples/0rtt.rs
index b072f8497da..2061674c113 100644
--- a/iroh/examples/0rtt.rs
+++ b/iroh/examples/0rtt.rs
@@ -10,7 +10,6 @@ use iroh_base::ticket::NodeTicket;
 use n0_future::{StreamExt, future};
 use n0_snafu::ResultExt;
 use n0_watcher::Watcher;
-use rand::thread_rng;
 use tracing::{info, trace};
 
 const PINGPONG_ALPN: &[u8] = b"0rtt-pingpong";
@@ -35,7 +34,7 @@ pub fn get_or_generate_secret_key() -> n0_snafu::Result<SecretKey> {
         SecretKey::from_str(&secret).context("Invalid secret key format")
     } else {
         // Generate a new random key
-        let secret_key = SecretKey::generate(&mut thread_rng());
+        let secret_key = SecretKey::generate(rand::rng());
         println!(
             "Generated new secret key: {}",
             HEXLOWER.encode(&secret_key.to_bytes())
diff --git a/iroh/examples/connect-unreliable.rs b/iroh/examples/connect-unreliable.rs
index 0786cfd2c78..448e7cefe5b 100644
--- a/iroh/examples/connect-unreliable.rs
+++ b/iroh/examples/connect-unreliable.rs
@@ -10,6 +10,7 @@ use std::net::SocketAddr;
 use clap::Parser;
 use iroh::{Endpoint, NodeAddr, RelayMode, RelayUrl, SecretKey};
 use n0_snafu::ResultExt;
+use rand::TryRngCore;
 use tracing::info;
 
 // An example ALPN that we are using to communicate over the `Endpoint`
@@ -33,7 +34,7 @@ async fn main() -> n0_snafu::Result<()> {
     tracing_subscriber::fmt::init();
     println!("\nconnect (unreliable) example!\n");
     let args = Cli::parse();
-    let secret_key = SecretKey::generate(rand::rngs::OsRng);
+    let secret_key = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
     println!("public key: {}", secret_key.public());
 
     // Build a `Endpoint`, which uses PublicKeys as node identifiers, uses QUIC for directly connecting to other nodes, and uses the relay protocol and relay servers to holepunch direct connections between nodes when there are NATs or firewalls preventing direct connections. If no direct connection can be made, packets are relayed over the relay servers.
diff --git a/iroh/examples/connect.rs b/iroh/examples/connect.rs
index 9a3878b263d..955f36c7d35 100644
--- a/iroh/examples/connect.rs
+++ b/iroh/examples/connect.rs
@@ -10,6 +10,7 @@ use std::net::SocketAddr;
 use clap::Parser;
 use iroh::{Endpoint, NodeAddr, RelayMode, RelayUrl, SecretKey};
 use n0_snafu::{Result, ResultExt};
+use rand::TryRngCore;
 use tracing::info;
 
 // An example ALPN that we are using to communicate over the `Endpoint`
@@ -33,7 +34,7 @@ async fn main() -> Result<()> {
     tracing_subscriber::fmt::init();
     println!("\nconnect example!\n");
     let args = Cli::parse();
-    let secret_key = SecretKey::generate(rand::rngs::OsRng);
+    let secret_key = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
     println!("public key: {}", secret_key.public());
 
     // Build a `Endpoint`, which uses PublicKeys as node identifiers, uses QUIC for directly connecting to other nodes, and uses the relay protocol and relay servers to holepunch direct connections between nodes when there are NATs or firewalls preventing direct connections. If no direct connection can be made, packets are relayed over the relay servers.
diff --git a/iroh/examples/dht_discovery.rs b/iroh/examples/dht_discovery.rs
index 730baf0265c..dcacbbf8bc2 100644
--- a/iroh/examples/dht_discovery.rs
+++ b/iroh/examples/dht_discovery.rs
@@ -13,6 +13,7 @@ use std::str::FromStr;
 use clap::Parser;
 use iroh::{Endpoint, NodeId};
 use n0_snafu::ResultExt;
+use rand::TryRngCore;
 use tracing::warn;
 use url::Url;
 
@@ -62,7 +63,7 @@ fn build_discovery(args: Args) -> iroh::discovery::pkarr::dht::Builder {
 }
 
 async fn chat_server(args: Args) -> n0_snafu::Result<()> {
-    let secret_key = iroh::SecretKey::generate(rand::rngs::OsRng);
+    let secret_key = iroh::SecretKey::generate(rand::rngs::OsRng.unwrap_err());
     let node_id = secret_key.public();
     let discovery = build_discovery(args);
     let endpoint = Endpoint::builder()
@@ -106,7 +107,7 @@ async fn chat_server(args: Args) -> n0_snafu::Result<()> {
 
 async fn chat_client(args: Args) -> n0_snafu::Result<()> {
     let remote_node_id = args.node_id.unwrap();
-    let secret_key = iroh::SecretKey::generate(rand::rngs::OsRng);
+    let secret_key = iroh::SecretKey::generate(rand::rngs::OsRng.unwrap_err());
     let node_id = secret_key.public();
     // note: we don't pass a secret key here, because we don't need to publish our address, don't spam the DHT
     let discovery = build_discovery(args).no_publish();
diff --git a/iroh/examples/listen-unreliable.rs b/iroh/examples/listen-unreliable.rs
index 8cd1bfddc1d..e988128c812 100644
--- a/iroh/examples/listen-unreliable.rs
+++ b/iroh/examples/listen-unreliable.rs
@@ -5,6 +5,7 @@
 //!     $ cargo run --example listen-unreliable
 use iroh::{Endpoint, RelayMode, SecretKey};
 use n0_snafu::{Error, Result, ResultExt};
+use rand::TryRngCore;
 use tracing::{info, warn};
 
 // An example ALPN that we are using to communicate over the `Endpoint`
@@ -14,7 +15,7 @@ const EXAMPLE_ALPN: &[u8] = b"n0/iroh/examples/magic/0";
 async fn main() -> Result<()> {
     tracing_subscriber::fmt::init();
     println!("\nlisten (unreliable) example!\n");
-    let secret_key = SecretKey::generate(rand::rngs::OsRng);
+    let secret_key = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
     println!("public key: {}", secret_key.public());
 
     // Build a `Endpoint`, which uses PublicKeys as node identifiers, uses QUIC for directly connecting to other nodes, and uses the relay servers to holepunch direct connections between nodes when there are NATs or firewalls preventing direct connections. If no direct connection can be made, packets are relayed over the relay servers.
diff --git a/iroh/examples/listen.rs b/iroh/examples/listen.rs
index 5de62755101..6f34eb5e50c 100644
--- a/iroh/examples/listen.rs
+++ b/iroh/examples/listen.rs
@@ -7,6 +7,7 @@ use std::time::Duration;
 
 use iroh::{Endpoint, RelayMode, SecretKey, endpoint::ConnectionError};
 use n0_snafu::ResultExt;
+use rand::TryRngCore;
 use tracing::{debug, info, warn};
 
 // An example ALPN that we are using to communicate over the `Endpoint`
@@ -16,7 +17,7 @@ const EXAMPLE_ALPN: &[u8] = b"n0/iroh/examples/magic/0";
 async fn main() -> n0_snafu::Result<()> {
     tracing_subscriber::fmt::init();
     println!("\nlisten example!\n");
-    let secret_key = SecretKey::generate(rand::rngs::OsRng);
+    let secret_key = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
     println!("public key: {}", secret_key.public());
 
     // Build a `Endpoint`, which uses PublicKeys as node identifiers, uses QUIC for directly connecting to other nodes, and uses the relay protocol and relay servers to holepunch direct connections between nodes when there are NATs or firewalls preventing direct connections. If no direct connection can be made, packets are relayed over the relay servers.
diff --git a/iroh/examples/transfer.rs b/iroh/examples/transfer.rs
index de748672146..7e80af9d649 100644
--- a/iroh/examples/transfer.rs
+++ b/iroh/examples/transfer.rs
@@ -20,6 +20,7 @@ use iroh_base::ticket::NodeTicket;
 use n0_future::task::AbortOnDropHandle;
 use n0_snafu::{Result, ResultExt};
 use n0_watcher::Watcher as _;
+use rand::TryRngCore;
 use tokio_stream::StreamExt;
 use tracing::{info, warn};
 use url::Url;
@@ -186,7 +187,7 @@ impl EndpointArgs {
             Ok(s) => SecretKey::from_str(&s)
                 .context("Failed to parse IROH_SECRET environment variable as iroh secret key")?,
             Err(_) => {
-                let s = SecretKey::generate(rand::rngs::OsRng);
+                let s = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
                 println!("Generated a new node secret. To reuse, set");
                 println!("\tIROH_SECRET={}", HEXLOWER.encode(&s.to_bytes()));
                 s
diff --git a/iroh/src/disco.rs b/iroh/src/disco.rs
index e2fc2d26c21..f9041ff891f 100644
--- a/iroh/src/disco.rs
+++ b/iroh/src/disco.rs
@@ -511,8 +511,8 @@ mod tests {
 
     #[test]
     fn test_extraction() {
-        let sender_key = SecretKey::generate(rand::thread_rng());
-        let recv_key = SecretKey::generate(rand::thread_rng());
+        let sender_key = SecretKey::generate(rand::rng());
+        let recv_key = SecretKey::generate(rand::rng());
 
         let msg = Message::Ping(Ping {
             tx_id: stun_rs::TransactionId::default(),
diff --git a/iroh/src/discovery.rs b/iroh/src/discovery.rs
index e33e86a16c9..751e7b3a774 100644
--- a/iroh/src/discovery.rs
+++ b/iroh/src/discovery.rs
@@ -707,7 +707,7 @@ mod tests {
         ) -> Option<BoxStream<Result<DiscoveryItem, DiscoveryError>>> {
             let addr_info = if self.resolve_wrong {
                 let ts = system_time_now() - 100_000;
-                let port: u16 = rand::thread_rng().gen_range(10_000..20_000);
+                let port: u16 = rand::rng().random_range(10_000..20_000);
                 // "240.0.0.0/4" is reserved and unreachable
                 let addr: SocketAddr = format!("240.0.0.1:{port}").parse().unwrap();
                 let data = NodeData::new(None, BTreeSet::from([addr]));
@@ -758,12 +758,12 @@ mod tests {
     async fn endpoint_discovery_simple_shared() -> Result {
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
@@ -805,12 +805,12 @@ mod tests {
     async fn endpoint_discovery_combined_with_empty() -> Result {
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco1 = EmptyDiscovery;
             let disco2 = disco_shared.create_discovery(secret.public());
             let disco = ConcurrentDiscovery::empty();
@@ -836,12 +836,12 @@ mod tests {
     async fn endpoint_discovery_combined_with_empty_and_wrong() -> Result {
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco1 = EmptyDiscovery;
             let disco2 = disco_shared.create_lying_discovery(secret.public());
             let disco3 = disco_shared.create_discovery(secret.public());
@@ -863,12 +863,12 @@ mod tests {
     async fn endpoint_discovery_combined_wrong_only() -> Result {
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco1 = disco_shared.create_lying_discovery(secret.public());
             let disco = ConcurrentDiscovery::from_services(vec![Box::new(disco1)]);
             new_endpoint(secret, disco).await
@@ -897,12 +897,12 @@ mod tests {
     async fn endpoint_discovery_with_wrong_existing_addr() -> Result {
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(rand::rng());
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
@@ -991,7 +991,7 @@ mod test_dns_pkarr {
             .await
             .context("Running DNS server")?;
 
-        let secret_key = SecretKey::generate(rand::thread_rng());
+        let secret_key = SecretKey::generate(rand::rng());
         let node_info = NodeInfo::new(secret_key.public())
             .with_relay_url(Some("https://relay.example".parse().unwrap()));
         let signed_packet = node_info.to_pkarr_signed_packet(&secret_key, 30)?;
@@ -1018,7 +1018,7 @@ mod test_dns_pkarr {
             .await
             .context("DnsPkarrServer")?;
 
-        let secret_key = SecretKey::generate(rand::thread_rng());
+        let secret_key = SecretKey::generate(rand::rng());
         let node_id = secret_key.public();
 
         let relay_url = Some("https://relay.example".parse().unwrap());
@@ -1076,7 +1076,7 @@ mod test_dns_pkarr {
         relay_map: &RelayMap,
         dns_pkarr_server: &DnsPkarrServer,
     ) -> Result<(Endpoint, AbortOnDropHandle<Result<()>>)> {
-        let secret_key = SecretKey::generate(rand::thread_rng());
+        let secret_key = SecretKey::generate(rand::rng());
         let ep = Endpoint::builder()
             .relay_mode(RelayMode::Custom(relay_map.clone()))
             .insecure_skip_relay_cert_verify(true)
diff --git a/iroh/src/discovery/mdns.rs b/iroh/src/discovery/mdns.rs
index eb1de2f986e..91140b63755 100644
--- a/iroh/src/discovery/mdns.rs
+++ b/iroh/src/discovery/mdns.rs
@@ -734,19 +734,19 @@ mod tests {
         async fn test_service_names() -> Result {
             // Create a discovery service using the default
             // service name
-            let id_a = SecretKey::generate(rand::thread_rng()).public();
+            let id_a = SecretKey::generate(rand::rng()).public();
             let discovery_a = MdnsDiscovery::builder().build(id_a)?;
 
             // Create a discovery service using a custom
             // service name
-            let id_b = SecretKey::generate(rand::thread_rng()).public();
+            let id_b = SecretKey::generate(rand::rng()).public();
             let discovery_b = MdnsDiscovery::builder()
                 .service_name("different.name")
                 .build(id_b)?;
 
             // Create a discovery service using the same
             // custom service name
-            let id_c = SecretKey::generate(rand::thread_rng()).public();
+            let id_c = SecretKey::generate(rand::rng()).public();
             let discovery_c = MdnsDiscovery::builder()
                 .service_name("different.name")
                 .build(id_c)?;
diff --git a/iroh/src/endpoint.rs b/iroh/src/endpoint.rs
index 47b37cb3d14..5c962795e38 100644
--- a/iroh/src/endpoint.rs
+++ b/iroh/src/endpoint.rs
@@ -154,7 +154,7 @@ impl Builder {
         let relay_map = self.relay_mode.relay_map();
         let secret_key = self
             .secret_key
-            .unwrap_or_else(|| SecretKey::generate(rand::rngs::OsRng));
+            .unwrap_or_else(|| SecretKey::generate(rand::rng()));
         let static_config = StaticConfig {
             transport_config: Arc::new(self.transport_config),
             tls_config: tls::TlsConfig::new(secret_key.clone(), self.max_tls_tickets),
@@ -2262,7 +2262,7 @@ mod tests {
     #[traced_test]
     async fn endpoint_connect_close() -> Result {
         let (relay_map, relay_url, _guard) = run_relay_server().await?;
-        let server_secret_key = SecretKey::generate(rand::thread_rng());
+        let server_secret_key = SecretKey::generate(rand::rng());
         let server_peer_id = server_secret_key.public();
 
         // Wait for the endpoint to be started to make sure it's up before clients try to connect
@@ -2352,845 +2352,4 @@ mod tests {
         client.e()??;
         Ok(())
     }
-
-    #[tokio::test]
-    #[traced_test]
-    async fn endpoint_relay_connect_loop() -> Result {
-        let test_start = Instant::now();
-        let n_clients = 5;
-        let n_chunks_per_client = 2;
-        let chunk_size = 10;
-        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(42);
-        let (relay_map, relay_url, _relay_guard) = run_relay_server().await.unwrap();
-        let server_secret_key = SecretKey::generate(&mut rng);
-        let server_node_id = server_secret_key.public();
-
-        // Make sure the server is bound before having clients connect to it:
-        let ep = Endpoint::builder()
-            .insecure_skip_relay_cert_verify(true)
-            .secret_key(server_secret_key)
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .relay_mode(RelayMode::Custom(relay_map.clone()))
-            .bind()
-            .await?;
-        // Also make sure the server has a working relay connection
-
-        ep.online().await;
-
-        info!(time = ?test_start.elapsed(), "test setup done");
-
-        // The server accepts the connections of the clients sequentially.
-        let server = tokio::spawn(
-            async move {
-                let eps = ep.bound_sockets();
-
-                info!(me = %ep.node_id().fmt_short(), eps = ?eps, "server listening on");
-                for i in 0..n_clients {
-                    let round_start = Instant::now();
-                    info!("[server] round {i}");
-                    let incoming = ep.accept().await.e()?;
-                    let conn = incoming.await.e()?;
-                    let node_id = conn.remote_node_id()?;
-                    info!(%i, peer = %node_id.fmt_short(), "accepted connection");
-                    let (mut send, mut recv) = conn.accept_bi().await.e()?;
-                    let mut buf = vec![0u8; chunk_size];
-                    for _i in 0..n_chunks_per_client {
-                        recv.read_exact(&mut buf).await.e()?;
-                        send.write_all(&buf).await.e()?;
-                    }
-                    send.finish().e()?;
-                    conn.closed().await; // we're the last to send data, so we wait for the other side to close
-                    info!(%i, peer = %node_id.fmt_short(), "finished");
-                    info!("[server] round {i} done in {:?}", round_start.elapsed());
-                }
-                Ok::<_, Error>(())
-            }
-            .instrument(error_span!("server")),
-        );
-
-        let start = Instant::now();
-
-        for i in 0..n_clients {
-            let round_start = Instant::now();
-            info!("[client] round {i}");
-            let client_secret_key = SecretKey::generate(&mut rng);
-            async {
-                info!("client binding");
-                let ep = Endpoint::builder()
-                    .alpns(vec![TEST_ALPN.to_vec()])
-                    .insecure_skip_relay_cert_verify(true)
-                    .relay_mode(RelayMode::Custom(relay_map.clone()))
-                    .secret_key(client_secret_key)
-                    .bind()
-                    .await?;
-                let eps = ep.bound_sockets();
-
-                info!(me = %ep.node_id().fmt_short(), eps=?eps, "client bound");
-                let node_addr = NodeAddr::new(server_node_id).with_relay_url(relay_url.clone());
-                info!(to = ?node_addr, "client connecting");
-                let conn = ep.connect(node_addr, TEST_ALPN).await.e()?;
-                info!("client connected");
-                let (mut send, mut recv) = conn.open_bi().await.e()?;
-
-                for i in 0..n_chunks_per_client {
-                    let mut buf = vec![i; chunk_size];
-                    send.write_all(&buf).await.e()?;
-                    recv.read_exact(&mut buf).await.e()?;
-                    assert_eq!(buf, vec![i; chunk_size]);
-                }
-                // we're the last to receive data, so we close
-                conn.close(0u32.into(), b"bye!");
-                info!("client finished");
-                ep.close().await;
-                info!("client closed");
-                Ok::<_, Error>(())
-            }
-            .instrument(error_span!("client", %i))
-            .await?;
-            info!("[client] round {i} done in {:?}", round_start.elapsed());
-        }
-
-        server.await.e()??;
-
-        // We appear to have seen this being very slow at times.  So ensure we fail if this
-        // test is too slow.  We're only making two connections transferring very little
-        // data, this really shouldn't take long.
-        if start.elapsed() > Duration::from_secs(15) {
-            panic!("Test too slow, something went wrong");
-        }
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    #[traced_test]
-    async fn endpoint_send_relay() -> Result {
-        let (relay_map, _relay_url, _guard) = run_relay_server().await?;
-        let client = Endpoint::builder()
-            .insecure_skip_relay_cert_verify(true)
-            .relay_mode(RelayMode::Custom(relay_map.clone()))
-            .bind()
-            .await?;
-        let server = Endpoint::builder()
-            .insecure_skip_relay_cert_verify(true)
-            .relay_mode(RelayMode::Custom(relay_map))
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .bind()
-            .await?;
-
-        let task = tokio::spawn({
-            let server = server.clone();
-            async move {
-                let Some(conn) = server.accept().await else {
-                    snafu::whatever!("Expected an incoming connection");
-                };
-                let conn = conn.await.e()?;
-                let (mut send, mut recv) = conn.accept_bi().await.e()?;
-                let data = recv.read_to_end(1000).await.e()?;
-                send.write_all(&data).await.e()?;
-                send.finish().e()?;
-                conn.closed().await;
-
-                Ok::<_, Error>(())
-            }
-        });
-
-        let addr = server.watch_node_addr().initialized().await;
-        let conn = client.connect(addr, TEST_ALPN).await?;
-        let (mut send, mut recv) = conn.open_bi().await.e()?;
-        send.write_all(b"Hello, world!").await.e()?;
-        send.finish().e()?;
-        let data = recv.read_to_end(1000).await.e()?;
-        conn.close(0u32.into(), b"bye!");
-
-        task.await.e()??;
-
-        client.close().await;
-        server.close().await;
-
-        assert_eq!(&data, b"Hello, world!");
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    #[traced_test]
-    async fn endpoint_bidi_send_recv() -> Result {
-        let ep1 = Endpoint::builder()
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .relay_mode(RelayMode::Disabled);
-
-        let ep1 = ep1.bind().await?;
-        let ep2 = Endpoint::builder()
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .relay_mode(RelayMode::Disabled);
-
-        let ep2 = ep2.bind().await?;
-
-        let ep1_nodeaddr = ep1.watch_node_addr().initialized().await;
-        let ep2_nodeaddr = ep2.watch_node_addr().initialized().await;
-        ep1.add_node_addr(ep2_nodeaddr.clone())?;
-        ep2.add_node_addr(ep1_nodeaddr.clone())?;
-        let ep1_nodeid = ep1.node_id();
-        let ep2_nodeid = ep2.node_id();
-        eprintln!("node id 1 {ep1_nodeid}");
-        eprintln!("node id 2 {ep2_nodeid}");
-
-        async fn connect_hello(ep: Endpoint, dst: NodeAddr) -> Result {
-            let conn = ep.connect(dst, TEST_ALPN).await?;
-            let (mut send, mut recv) = conn.open_bi().await.e()?;
-            info!("sending hello");
-            send.write_all(b"hello").await.e()?;
-            send.finish().e()?;
-            info!("receiving world");
-            let m = recv.read_to_end(100).await.e()?;
-            assert_eq!(m, b"world");
-            conn.close(1u8.into(), b"done");
-            Ok(())
-        }
-
-        async fn accept_world(ep: Endpoint, src: NodeId) -> Result {
-            let incoming = ep.accept().await.e()?;
-            let mut iconn = incoming.accept().e()?;
-            let alpn = iconn.alpn().await?;
-            let conn = iconn.await.e()?;
-            let node_id = conn.remote_node_id()?;
-            assert_eq!(node_id, src);
-            assert_eq!(alpn, TEST_ALPN);
-            let (mut send, mut recv) = conn.accept_bi().await.e()?;
-            info!("receiving hello");
-            let m = recv.read_to_end(100).await.e()?;
-            assert_eq!(m, b"hello");
-            info!("sending hello");
-            send.write_all(b"world").await.e()?;
-            send.finish().e()?;
-            match conn.closed().await {
-                ConnectionError::ApplicationClosed(closed) => {
-                    assert_eq!(closed.error_code, 1u8.into());
-                    Ok(())
-                }
-                _ => panic!("wrong close error"),
-            }
-        }
-
-        let p1_accept = tokio::spawn(accept_world(ep1.clone(), ep2_nodeid).instrument(info_span!(
-            "p1_accept",
-            ep1 = %ep1.node_id().fmt_short(),
-            dst = %ep2_nodeid.fmt_short(),
-        )));
-        let p2_accept = tokio::spawn(accept_world(ep2.clone(), ep1_nodeid).instrument(info_span!(
-            "p2_accept",
-            ep2 = %ep2.node_id().fmt_short(),
-            dst = %ep1_nodeid.fmt_short(),
-        )));
-        let p1_connect = tokio::spawn(connect_hello(ep1.clone(), ep2_nodeaddr).instrument(
-            info_span!(
-                "p1_connect",
-                ep1 = %ep1.node_id().fmt_short(),
-                dst = %ep2_nodeid.fmt_short(),
-            ),
-        ));
-        let p2_connect = tokio::spawn(connect_hello(ep2.clone(), ep1_nodeaddr).instrument(
-            info_span!(
-                "p2_connect",
-                ep2 = %ep2.node_id().fmt_short(),
-                dst = %ep1_nodeid.fmt_short(),
-            ),
-        ));
-
-        p1_accept.await.e()??;
-        p2_accept.await.e()??;
-        p1_connect.await.e()??;
-        p2_connect.await.e()??;
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    #[traced_test]
-    async fn endpoint_conn_type_becomes_direct() -> Result {
-        const TIMEOUT: Duration = std::time::Duration::from_secs(15);
-        let (relay_map, _relay_url, _relay_guard) = run_relay_server().await?;
-        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(42);
-        let ep1_secret_key = SecretKey::generate(&mut rng);
-        let ep2_secret_key = SecretKey::generate(&mut rng);
-        let ep1 = Endpoint::builder()
-            .secret_key(ep1_secret_key)
-            .insecure_skip_relay_cert_verify(true)
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .relay_mode(RelayMode::Custom(relay_map.clone()))
-            .bind()
-            .await?;
-        let ep2 = Endpoint::builder()
-            .secret_key(ep2_secret_key)
-            .insecure_skip_relay_cert_verify(true)
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .relay_mode(RelayMode::Custom(relay_map))
-            .bind()
-            .await?;
-
-        async fn wait_for_conn_type_direct(ep: &Endpoint, node_id: NodeId) -> Result {
-            let mut stream = ep.conn_type(node_id).expect("connection exists").stream();
-            let src = ep.node_id().fmt_short();
-            let dst = node_id.fmt_short();
-            while let Some(conn_type) = stream.next().await {
-                tracing::info!(me = %src, dst = %dst, conn_type = ?conn_type);
-                if matches!(conn_type, ConnectionType::Direct(_)) {
-                    return Ok(());
-                }
-            }
-            snafu::whatever!("conn_type stream ended before `ConnectionType::Direct`");
-        }
-
-        async fn accept(ep: &Endpoint) -> Result<Connection> {
-            let incoming = ep.accept().await.expect("ep closed");
-            let conn = incoming.await.e()?;
-            let node_id = conn.remote_node_id()?;
-            tracing::info!(node_id=%node_id.fmt_short(), "accepted connection");
-            Ok(conn)
-        }
-
-        let ep1_nodeid = ep1.node_id();
-        let ep2_nodeid = ep2.node_id();
-
-        let ep1_nodeaddr = ep1.watch_node_addr().initialized().await;
-        tracing::info!(
-            "node id 1 {ep1_nodeid}, relay URL {:?}",
-            ep1_nodeaddr.relay_url()
-        );
-        tracing::info!("node id 2 {ep2_nodeid}");
-
-        let ep1_side = tokio::time::timeout(TIMEOUT, async move {
-            let conn = accept(&ep1).await?;
-            let mut send = conn.open_uni().await.e()?;
-            wait_for_conn_type_direct(&ep1, ep2_nodeid).await?;
-            send.write_all(b"Conn is direct").await.e()?;
-            send.finish().e()?;
-            conn.closed().await;
-            Ok::<(), Error>(())
-        });
-
-        let ep2_side = tokio::time::timeout(TIMEOUT, async move {
-            let conn = ep2.connect(ep1_nodeaddr, TEST_ALPN).await?;
-            let mut recv = conn.accept_uni().await.e()?;
-            wait_for_conn_type_direct(&ep2, ep1_nodeid).await?;
-            let read = recv.read_to_end(100).await.e()?;
-            assert_eq!(read, b"Conn is direct".to_vec());
-            conn.close(0u32.into(), b"done");
-            conn.closed().await;
-            Ok::<(), Error>(())
-        });
-
-        let res_ep1 = AbortOnDropHandle::new(tokio::spawn(ep1_side));
-        let res_ep2 = AbortOnDropHandle::new(tokio::spawn(ep2_side));
-
-        let (r1, r2) = tokio::try_join!(res_ep1, res_ep2).e()?;
-        r1.e()??;
-        r2.e()??;
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    #[traced_test]
-    async fn test_direct_addresses_no_qad_relay() -> Result {
-        let (relay_map, _, _guard) = run_relay_server_with(false).await.unwrap();
-
-        let ep = Endpoint::builder()
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .relay_mode(RelayMode::Custom(relay_map))
-            .insecure_skip_relay_cert_verify(true)
-            .bind()
-            .await?;
-
-        tokio::time::timeout(
-            Duration::from_secs(10),
-            ep.watch_node_addr()
-                .map(|addr| addr.map(|addr| addr.direct_addresses))
-                .unwrap()
-                .initialized(),
-        )
-        .await
-        .e()?;
-        Ok(())
-    }
-
-    async fn spawn_0rtt_server(secret_key: SecretKey, log_span: tracing::Span) -> Result<Endpoint> {
-        let server = Endpoint::builder()
-            .secret_key(secret_key)
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .relay_mode(RelayMode::Disabled)
-            .bind()
-            .await?;
-
-        // Gets aborted via the endpoint closing causing an `Err`
-        // a simple echo server
-        tokio::spawn({
-            let server = server.clone();
-            async move {
-                while let Some(incoming) = server.accept().await {
-                    let connecting = incoming.accept().e()?;
-                    let conn = match connecting.into_0rtt() {
-                        Ok((conn, _)) => {
-                            info!("0rtt accepted");
-                            conn
-                        }
-                        Err(connecting) => {
-                            info!("0rtt denied");
-                            connecting.await.e()?
-                        }
-                    };
-                    let (mut send, mut recv) = conn.accept_bi().await.e()?;
-                    let data = recv.read_to_end(10_000_000).await.e()?;
-                    send.write_all(&data).await.e()?;
-                    send.finish().e()?;
-
-                    // Stay alive until the other side closes the connection.
-                    conn.closed().await;
-                }
-                Ok::<_, Error>(())
-            }
-            .instrument(log_span)
-        });
-
-        Ok(server)
-    }
-
-    async fn connect_client_0rtt_expect_err(client: &Endpoint, server_addr: NodeAddr) -> Result {
-        let conn = client
-            .connect_with_opts(server_addr, TEST_ALPN, ConnectOptions::new())
-            .await?
-            .into_0rtt()
-            .expect_err("expected 0rtt to fail")
-            .await
-            .e()?;
-
-        let (mut send, mut recv) = conn.open_bi().await.e()?;
-        send.write_all(b"hello").await.e()?;
-        send.finish().e()?;
-        let received = recv.read_to_end(1_000).await.e()?;
-        assert_eq!(&received, b"hello");
-        conn.close(0u32.into(), b"thx");
-        Ok(())
-    }
-
-    async fn connect_client_0rtt_expect_ok(
-        client: &Endpoint,
-        server_addr: NodeAddr,
-        expect_server_accepts: bool,
-    ) -> Result {
-        let (conn, accepted_0rtt) = client
-            .connect_with_opts(server_addr, TEST_ALPN, ConnectOptions::new())
-            .await?
-            .into_0rtt()
-            .ok()
-            .e()?;
-
-        // This is how we send data in 0-RTT:
-        let (mut send, recv) = conn.open_bi().await.e()?;
-        send.write_all(b"hello").await.e()?;
-        send.finish().e()?;
-        // When this resolves, we've gotten a response from the server about whether the 0-RTT data above was accepted:
-        let accepted = accepted_0rtt.await;
-        assert_eq!(accepted, expect_server_accepts);
-        let mut recv = if accepted {
-            recv
-        } else {
-            // in this case we need to re-send data by re-creating the connection.
-            let (mut send, recv) = conn.open_bi().await.e()?;
-            send.write_all(b"hello").await.e()?;
-            send.finish().e()?;
-            recv
-        };
-        let received = recv.read_to_end(1_000).await.e()?;
-        assert_eq!(&received, b"hello");
-        conn.close(0u32.into(), b"thx");
-        Ok(())
-    }
-
-    #[tokio::test]
-    #[traced_test]
-    async fn test_0rtt() -> Result {
-        let client = Endpoint::builder()
-            .relay_mode(RelayMode::Disabled)
-            .bind()
-            .await?;
-        let server = spawn_0rtt_server(
-            SecretKey::generate(rand::thread_rng()),
-            info_span!("server"),
-        )
-        .await?;
-
-        connect_client_0rtt_expect_err(&client, server.watch_node_addr().initialized().await)
-            .await?;
-        // The second 0rtt attempt should work
-        connect_client_0rtt_expect_ok(&client, server.watch_node_addr().initialized().await, true)
-            .await?;
-
-        client.close().await;
-        server.close().await;
-
-        Ok(())
-    }
-
-    // We have this test, as this would've failed at some point.
-    // This effectively tests that we correctly categorize the TLS session tickets we
-    // receive into the respective "bucket" for the recipient.
-    #[tokio::test]
-    #[traced_test]
-    async fn test_0rtt_non_consecutive() -> Result {
-        let client = Endpoint::builder()
-            .relay_mode(RelayMode::Disabled)
-            .bind()
-            .await?;
-        let server = spawn_0rtt_server(
-            SecretKey::generate(rand::thread_rng()),
-            info_span!("server"),
-        )
-        .await?;
-
-        connect_client_0rtt_expect_err(&client, server.watch_node_addr().initialized().await)
-            .await?;
-
-        // connecting with another endpoint should not interfere with our
-        // TLS session ticket cache for the first endpoint:
-        let another = spawn_0rtt_server(
-            SecretKey::generate(rand::thread_rng()),
-            info_span!("another"),
-        )
-        .await?;
-        connect_client_0rtt_expect_err(&client, another.watch_node_addr().initialized().await)
-            .await?;
-        another.close().await;
-
-        connect_client_0rtt_expect_ok(&client, server.watch_node_addr().initialized().await, true)
-            .await?;
-
-        client.close().await;
-        server.close().await;
-
-        Ok(())
-    }
-
-    // Test whether 0-RTT is possible after a restart:
-    #[tokio::test]
-    #[traced_test]
-    async fn test_0rtt_after_server_restart() -> Result {
-        let client = Endpoint::builder()
-            .relay_mode(RelayMode::Disabled)
-            .bind()
-            .await?;
-        let server_key = SecretKey::generate(rand::thread_rng());
-        let server = spawn_0rtt_server(server_key.clone(), info_span!("server-initial")).await?;
-
-        connect_client_0rtt_expect_err(&client, server.watch_node_addr().initialized().await)
-            .await?;
-        connect_client_0rtt_expect_ok(&client, server.watch_node_addr().initialized().await, true)
-            .await?;
-
-        server.close().await;
-
-        let server = spawn_0rtt_server(server_key, info_span!("server-restart")).await?;
-
-        // we expect the client to *believe* it can 0-RTT connect to the server (hence expect_ok),
-        // but the server will reject the early data because it discarded necessary state
-        // to decrypt it when restarting.
-        connect_client_0rtt_expect_ok(&client, server.watch_node_addr().initialized().await, false)
-            .await?;
-
-        client.close().await;
-
-        Ok(())
-    }
-
-    #[cfg_attr(target_os = "windows", ignore = "flaky")]
-    #[tokio::test]
-    #[traced_test]
-    async fn graceful_close() -> Result {
-        let client = Endpoint::builder().bind().await?;
-        let server = Endpoint::builder()
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .bind()
-            .await?;
-        let server_addr = server.watch_node_addr().initialized().await;
-        let server_task = tokio::spawn(async move {
-            let incoming = server.accept().await.e()?;
-            let conn = incoming.await.e()?;
-            let (mut send, mut recv) = conn.accept_bi().await.e()?;
-            let msg = recv.read_to_end(1_000).await.e()?;
-            send.write_all(&msg).await.e()?;
-            send.finish().e()?;
-            let close_reason = conn.closed().await;
-            Ok::<_, Error>(close_reason)
-        });
-
-        let conn = client.connect(server_addr, TEST_ALPN).await?;
-        let (mut send, mut recv) = conn.open_bi().await.e()?;
-        send.write_all(b"Hello, world!").await.e()?;
-        send.finish().e()?;
-        recv.read_to_end(1_000).await.e()?;
-        conn.close(42u32.into(), b"thanks, bye!");
-        client.close().await;
-
-        let close_err = server_task.await.e()??;
-        let ConnectionError::ApplicationClosed(app_close) = close_err else {
-            panic!("Unexpected close reason: {close_err:?}");
-        };
-
-        assert_eq!(app_close.error_code, 42u32.into());
-        assert_eq!(app_close.reason.as_ref(), b"thanks, bye!");
-
-        Ok(())
-    }
-
-    #[cfg(feature = "metrics")]
-    #[tokio::test]
-    #[traced_test]
-    async fn metrics_smoke() -> Result {
-        use iroh_metrics::{MetricsSource, Registry};
-
-        let secret_key = SecretKey::from_bytes(&[0u8; 32]);
-        let client = Endpoint::builder()
-            .secret_key(secret_key)
-            .relay_mode(RelayMode::Disabled)
-            .bind()
-            .await?;
-        let secret_key = SecretKey::from_bytes(&[1u8; 32]);
-        let server = Endpoint::builder()
-            .secret_key(secret_key)
-            .relay_mode(RelayMode::Disabled)
-            .alpns(vec![TEST_ALPN.to_vec()])
-            .bind()
-            .await?;
-        let server_addr = server.watch_node_addr().initialized().await;
-        let server_task = tokio::task::spawn(async move {
-            let conn = server.accept().await.e()?.accept().e()?.await.e()?;
-            let mut uni = conn.accept_uni().await.e()?;
-            uni.read_to_end(10).await.e()?;
-            drop(conn);
-            Ok::<_, Error>(server)
-        });
-        let conn = client.connect(server_addr, TEST_ALPN).await?;
-        let mut uni = conn.open_uni().await.e()?;
-        uni.write_all(b"helloworld").await.e()?;
-        uni.finish().e()?;
-        conn.closed().await;
-        drop(conn);
-        let server = server_task.await.e()??;
-
-        let m = client.metrics();
-        assert_eq!(m.magicsock.num_direct_conns_added.get(), 1);
-        assert_eq!(m.magicsock.connection_became_direct.get(), 1);
-        assert_eq!(m.magicsock.connection_handshake_success.get(), 1);
-        assert_eq!(m.magicsock.nodes_contacted_directly.get(), 1);
-        assert!(m.magicsock.recv_datagrams.get() > 0);
-
-        let m = server.metrics();
-        assert_eq!(m.magicsock.num_direct_conns_added.get(), 1);
-        assert_eq!(m.magicsock.connection_became_direct.get(), 1);
-        assert_eq!(m.magicsock.nodes_contacted_directly.get(), 1);
-        assert_eq!(m.magicsock.connection_handshake_success.get(), 1);
-        assert!(m.magicsock.recv_datagrams.get() > 0);
-
-        // test openmetrics encoding with labeled subregistries per endpoint
-        fn register_endpoint(registry: &mut Registry, endpoint: &Endpoint) {
-            let id = endpoint.node_id().fmt_short();
-            let sub_registry = registry.sub_registry_with_label("id", id.to_string());
-            sub_registry.register_all(endpoint.metrics());
-        }
-        let mut registry = Registry::default();
-        register_endpoint(&mut registry, &client);
-        register_endpoint(&mut registry, &server);
-        let s = registry.encode_openmetrics_to_string()?;
-        assert!(s.contains(r#"magicsock_nodes_contacted_directly_total{id="3b6a27bcce"} 1"#));
-        assert!(s.contains(r#"magicsock_nodes_contacted_directly_total{id="8a88e3dd74"} 1"#));
-        Ok(())
-    }
-
-    /// Configures the accept side to take `accept_alpns` ALPNs, then connects to it with `primary_connect_alpn`
-    /// with `secondary_connect_alpns` set, and finally returns the negotiated ALPN.
-    async fn alpn_connection_test(
-        accept_alpns: Vec<Vec<u8>>,
-        primary_connect_alpn: &[u8],
-        secondary_connect_alpns: Vec<Vec<u8>>,
-    ) -> Result<Option<Vec<u8>>> {
-        let client = Endpoint::builder()
-            .relay_mode(RelayMode::Disabled)
-            .bind()
-            .await?;
-        let server = Endpoint::builder()
-            .relay_mode(RelayMode::Disabled)
-            .alpns(accept_alpns)
-            .bind()
-            .await?;
-        let server_addr = server.watch_node_addr().initialized().await;
-        let server_task = tokio::spawn({
-            let server = server.clone();
-            async move {
-                let incoming = server.accept().await.e()?;
-                let conn = incoming.await.e()?;
-                conn.close(0u32.into(), b"bye!");
-                Ok::<_, n0_snafu::Error>(conn.alpn())
-            }
-        });
-
-        let conn = client
-            .connect_with_opts(
-                server_addr,
-                primary_connect_alpn,
-                ConnectOptions::new().with_additional_alpns(secondary_connect_alpns),
-            )
-            .await?;
-        let conn = conn.await.e()?;
-        let client_alpn = conn.alpn();
-        conn.closed().await;
-        client.close().await;
-        server.close().await;
-
-        let server_alpn = server_task.await.e()??;
-
-        assert_eq!(client_alpn, server_alpn);
-
-        Ok(server_alpn)
-    }
-
-    #[tokio::test]
-    #[traced_test]
-    async fn connect_multiple_alpn_negotiated() -> Result {
-        const ALPN_ONE: &[u8] = b"alpn/1";
-        const ALPN_TWO: &[u8] = b"alpn/2";
-
-        assert_eq!(
-            alpn_connection_test(
-                // Prefer version 2 over version 1 on the accept side
-                vec![ALPN_TWO.to_vec(), ALPN_ONE.to_vec()],
-                ALPN_TWO,
-                vec![ALPN_ONE.to_vec()],
-            )
-            .await?,
-            Some(ALPN_TWO.to_vec()),
-            "accept side prefers version 2 over 1"
-        );
-
-        assert_eq!(
-            alpn_connection_test(
-                // Only support the old version
-                vec![ALPN_ONE.to_vec()],
-                ALPN_TWO,
-                vec![ALPN_ONE.to_vec()],
-            )
-            .await?,
-            Some(ALPN_ONE.to_vec()),
-            "accept side only supports the old version"
-        );
-
-        assert_eq!(
-            alpn_connection_test(
-                vec![ALPN_TWO.to_vec(), ALPN_ONE.to_vec()],
-                ALPN_ONE,
-                vec![ALPN_TWO.to_vec()],
-            )
-            .await?,
-            Some(ALPN_TWO.to_vec()),
-            "connect side ALPN order doesn't matter"
-        );
-
-        assert_eq!(
-            alpn_connection_test(vec![ALPN_TWO.to_vec(), ALPN_ONE.to_vec()], ALPN_ONE, vec![],)
-                .await?,
-            Some(ALPN_ONE.to_vec()),
-            "connect side only supports the old version"
-        );
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    #[traced_test]
-    async fn watch_net_report() -> Result {
-        let endpoint = Endpoint::builder()
-            .relay_mode(RelayMode::Staging)
-            .bind()
-            .await?;
-
-        // can get a first report
-        endpoint.net_report().updated().await?;
-
-        Ok(())
-    }
-
-    /// Tests that initial connection establishment isn't extremely slow compared
-    /// to subsequent connections.
-    ///
-    /// This is a time based test, but uses a very large ratio to reduce flakiness.
-    /// It also does a number of connections to average out any anomalies.
-    #[tokio::test]
-    #[traced_test]
-    async fn connect_multi_time() -> Result {
-        let n = 32;
-
-        const NOOP_ALPN: &[u8] = b"noop";
-
-        #[derive(Debug, Clone)]
-        struct Noop;
-
-        impl ProtocolHandler for Noop {
-            async fn accept(&self, connection: Connection) -> Result<(), AcceptError> {
-                connection.closed().await;
-                Ok(())
-            }
-        }
-
-        async fn noop_server() -> Result<(Router, NodeAddr)> {
-            let endpoint = Endpoint::builder()
-                .relay_mode(RelayMode::Disabled)
-                .bind()
-                .await
-                .e()?;
-            let addr = endpoint.watch_node_addr().initialized().await;
-            let router = Router::builder(endpoint).accept(NOOP_ALPN, Noop).spawn();
-            Ok((router, addr))
-        }
-
-        let routers = stream::iter(0..n)
-            .map(|_| noop_server())
-            .buffered_unordered(32)
-            .collect::<Vec<_>>()
-            .await
-            .into_iter()
-            .collect::<Result<Vec<_>, _>>()
-            .e()?;
-
-        let addrs = routers
-            .iter()
-            .map(|(_, addr)| addr.clone())
-            .collect::<Vec<_>>();
-        let ids = addrs.iter().map(|addr| addr.node_id).collect::<Vec<_>>();
-        let discovery = StaticProvider::from_node_info(addrs);
-        let endpoint = Endpoint::builder()
-            .relay_mode(RelayMode::Disabled)
-            .discovery(discovery)
-            .bind()
-            .await
-            .e()?;
-        // wait for the endpoint to be initialized. This should not be needed,
-        // but we don't want to measure endpoint init time but connection time
-        // from a fully initialized endpoint.
-        endpoint.watch_node_addr().initialized().await;
-        let t0 = Instant::now();
-        for id in &ids {
-            let conn = endpoint.connect(*id, NOOP_ALPN).await?;
-            conn.close(0u32.into(), b"done");
-        }
-        let dt0 = t0.elapsed().as_secs_f64();
-        let t1 = Instant::now();
-        for id in &ids {
-            let conn = endpoint.connect(*id, NOOP_ALPN).await?;
-            conn.close(0u32.into(), b"done");
-        }
-        let dt1 = t1.elapsed().as_secs_f64();
-
-        assert!(dt0 / dt1 < 20.0, "First round: {dt0}s, second round {dt1}s");
-        Ok(())
-    }
 }
diff --git a/iroh/src/key.rs b/iroh/src/key.rs
index 9c76f01138c..73d253c432a 100644
--- a/iroh/src/key.rs
+++ b/iroh/src/key.rs
@@ -3,7 +3,9 @@
 use std::fmt::Debug;
 
 use aead::Buffer;
+use crypto_box::aead::AeadInPlace;
 use nested_enum_utils::common_fields;
+use rand::TryRngCore;
 use snafu::{ResultExt, Snafu, ensure};
 
 pub(crate) const NONCE_LEN: usize = 24;
@@ -49,9 +51,13 @@ impl SharedSecret {
 
     /// Seals the provided cleartext.
     pub fn seal(&self, buffer: &mut dyn Buffer) {
-        use aead::{AeadCore, AeadInPlace, OsRng};
+        use aead::{AeadCore, AeadInPlace};
+
+        let mut nonce = crypto_box::Nonce::default();
+        rand::rngs::OsRng
+            .try_fill_bytes(&mut nonce)
+            .expect("failed to generate randomness");
 
-        let nonce = crypto_box::ChaChaBox::generate_nonce(&mut OsRng);
         self.0
             .encrypt_in_place(&nonce, &[], buffer)
             .expect("encryption failed");
@@ -91,7 +97,7 @@ mod tests {
 
     #[test]
     fn test_seal_open_roundtrip() {
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
         let key_a = iroh_base::SecretKey::generate(&mut rng);
         let key_b = iroh_base::SecretKey::generate(&mut rng);
 
@@ -113,7 +119,7 @@ mod tests {
 
     #[test]
     fn test_roundtrip_public_key() {
-        let key = crypto_box::SecretKey::generate(&mut rand::thread_rng());
+        let key = crypto_box::SecretKey::generate(&mut rand::rng());
         let public_bytes = *key.public_key().as_bytes();
         let public_key_back = crypto_box::PublicKey::from(public_bytes);
         assert_eq!(key.public_key(), public_key_back);
@@ -121,7 +127,7 @@ mod tests {
 
     #[test]
     fn test_same_public_key_api() {
-        let key = iroh_base::SecretKey::generate(rand::thread_rng());
+        let key = iroh_base::SecretKey::generate(rand::rng());
         let public_key1: crypto_box::PublicKey = public_ed_box(&key.public().public());
         let public_key2: crypto_box::PublicKey = secret_ed_box(key.secret()).public_key();
 
@@ -130,7 +136,7 @@ mod tests {
 
     #[test]
     fn test_same_public_key_low_level() {
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
         let key = ed25519_dalek::SigningKey::generate(&mut rng);
         let public_key1 = {
             let m = key.verifying_key().to_montgomery();
diff --git a/iroh/src/magicsock.rs b/iroh/src/magicsock.rs
index 4f05de10a2e..1b334131e38 100644
--- a/iroh/src/magicsock.rs
+++ b/iroh/src/magicsock.rs
@@ -2246,8 +2246,8 @@ impl Actor {
 fn new_re_stun_timer(initial_delay: bool) -> time::Interval {
     // Pick a random duration between 20 and 26 seconds (just under 30s,
     // a common UDP NAT timeout on Linux,etc)
-    let mut rng = rand::thread_rng();
-    let d: Duration = rng.gen_range(Duration::from_secs(20)..=Duration::from_secs(26));
+    let mut rng = rand::rng();
+    let d: Duration = rng.random_range(Duration::from_secs(20)..=Duration::from_secs(26));
     if initial_delay {
         debug!("scheduling periodic_stun to run in {}s", d.as_secs());
         time::interval_at(time::Instant::now() + d, d)
@@ -2539,7 +2539,7 @@ mod tests {
 
     impl Default for Options {
         fn default() -> Self {
-            let secret_key = SecretKey::generate(rand::rngs::OsRng);
+            let secret_key = SecretKey::generate(rand::rng());
             let server_config = make_default_server_config(&secret_key);
             Options {
                 addr_v4: None,
@@ -2592,7 +2592,7 @@ mod tests {
 
     impl MagicStack {
         async fn new(relay_mode: RelayMode) -> Self {
-            let secret_key = SecretKey::generate(rand::thread_rng());
+            let secret_key = SecretKey::generate(rand::rng());
 
             let mut transport_config = quinn::TransportConfig::default();
             transport_config.max_idle_timeout(Some(Duration::from_secs(10).try_into().unwrap()));
@@ -2865,7 +2865,7 @@ mod tests {
 
             info!("\n-- larger data");
             let mut data = vec![0u8; 10 * 1024];
-            rand::thread_rng().fill_bytes(&mut data);
+            rand::rng().fill_bytes(&mut data);
             run_roundtrip(m1.clone(), m2.clone(), &data, ExpectedLoss::AlmostNone).await;
             run_roundtrip(m2.clone(), m1.clone(), &data, ExpectedLoss::AlmostNone).await;
         }
@@ -2931,7 +2931,7 @@ mod tests {
         let _guard = mesh_stacks(vec![m1.clone(), m2.clone()]).await?;
 
         let offset = || {
-            let delay = rand::thread_rng().gen_range(10..=500);
+            let delay = rand::rng().random_range(10..=500);
             Duration::from_millis(delay)
         };
         let rounds = 5;
@@ -2956,7 +2956,7 @@ mod tests {
 
             println!("-- [m1 changes] larger data");
             let mut data = vec![0u8; 10 * 1024];
-            rand::thread_rng().fill_bytes(&mut data);
+            rand::rng().fill_bytes(&mut data);
             run_roundtrip(m1.clone(), m2.clone(), &data, ExpectedLoss::YeahSure).await;
             run_roundtrip(m2.clone(), m1.clone(), &data, ExpectedLoss::YeahSure).await;
         }
@@ -2983,7 +2983,7 @@ mod tests {
 
             println!("-- [m2 changes] larger data");
             let mut data = vec![0u8; 10 * 1024];
-            rand::thread_rng().fill_bytes(&mut data);
+            rand::rng().fill_bytes(&mut data);
             run_roundtrip(m1.clone(), m2.clone(), &data, ExpectedLoss::YeahSure).await;
             run_roundtrip(m2.clone(), m1.clone(), &data, ExpectedLoss::YeahSure).await;
         }
@@ -3011,7 +3011,7 @@ mod tests {
 
             println!("-- [m1 & m2 changes] larger data");
             let mut data = vec![0u8; 10 * 1024];
-            rand::thread_rng().fill_bytes(&mut data);
+            rand::rng().fill_bytes(&mut data);
             run_roundtrip(m1.clone(), m2.clone(), &data, ExpectedLoss::YeahSure).await;
             run_roundtrip(m2.clone(), m1.clone(), &data, ExpectedLoss::YeahSure).await;
         }
@@ -3359,7 +3359,7 @@ mod tests {
     #[tokio::test]
     async fn test_add_node_addr() -> Result {
         let stack = MagicStack::new(RelayMode::Default).await;
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
 
         assert_eq!(stack.endpoint.magic_sock().node_map.node_count(), 0);
 
diff --git a/iroh/src/magicsock/node_map.rs b/iroh/src/magicsock/node_map.rs
index 362e0af5b6c..445574428b7 100644
--- a/iroh/src/magicsock/node_map.rs
+++ b/iroh/src/magicsock/node_map.rs
@@ -743,7 +743,7 @@ mod tests {
     async fn restore_from_vec() {
         let node_map = NodeMap::default();
 
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
         let node_a = SecretKey::generate(&mut rng).public();
         let node_b = SecretKey::generate(&mut rng).public();
         let node_c = SecretKey::generate(&mut rng).public();
@@ -812,7 +812,7 @@ mod tests {
     #[traced_test]
     fn test_prune_direct_addresses() {
         let node_map = NodeMap::default();
-        let public_key = SecretKey::generate(rand::thread_rng()).public();
+        let public_key = SecretKey::generate(rand::rng()).public();
         let id = node_map
             .inner
             .lock()
@@ -886,7 +886,7 @@ mod tests {
     fn test_prune_inactive() {
         let node_map = NodeMap::default();
         // add one active node and more than MAX_INACTIVE_NODES inactive nodes
-        let active_node = SecretKey::generate(rand::thread_rng()).public();
+        let active_node = SecretKey::generate(rand::rng()).public();
         let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 167);
         node_map.add_test_addr(NodeAddr::new(active_node).with_direct_addresses([addr]));
         node_map
@@ -897,7 +897,7 @@ mod tests {
             .expect("registered");
 
         for _ in 0..MAX_INACTIVE_NODES + 1 {
-            let node = SecretKey::generate(rand::thread_rng()).public();
+            let node = SecretKey::generate(rand::rng()).public();
             node_map.add_test_addr(NodeAddr::new(node));
         }
 
diff --git a/iroh/src/magicsock/node_map/node_state.rs b/iroh/src/magicsock/node_map/node_state.rs
index 7cf6511b97f..11aacfb1ac4 100644
--- a/iroh/src/magicsock/node_map/node_state.rs
+++ b/iroh/src/magicsock/node_map/node_state.rs
@@ -1445,7 +1445,7 @@ mod tests {
 
         // endpoint with a `best_addr` that has a latency but no relay
         let (a_endpoint, a_socket_addr) = {
-            let key = SecretKey::generate(rand::thread_rng());
+            let key = SecretKey::generate(rand::rng());
             let node_id = key.public();
             let ip_port = IpPort {
                 ip: Ipv4Addr::UNSPECIFIED.into(),
@@ -1488,7 +1488,7 @@ mod tests {
         // endpoint w/ no best addr but a relay w/ latency
         let b_endpoint = {
             // let socket_addr = "0.0.0.0:9".parse().unwrap();
-            let key = SecretKey::generate(rand::thread_rng());
+            let key = SecretKey::generate(rand::rng());
             NodeState {
                 id: 1,
                 quic_mapped_addr: NodeIdMappedAddr::generate(),
@@ -1509,7 +1509,7 @@ mod tests {
         // endpoint w/ no best addr but a relay w/ no latency
         let c_endpoint = {
             // let socket_addr = "0.0.0.0:8".parse().unwrap();
-            let key = SecretKey::generate(rand::thread_rng());
+            let key = SecretKey::generate(rand::rng());
             NodeState {
                 id: 2,
                 quic_mapped_addr: NodeIdMappedAddr::generate(),
@@ -1538,7 +1538,7 @@ mod tests {
         // endpoint w/ expired best addr and relay w/ latency
         let (d_endpoint, d_socket_addr) = {
             let socket_addr: SocketAddr = "0.0.0.0:7".parse().unwrap();
-            let key = SecretKey::generate(rand::thread_rng());
+            let key = SecretKey::generate(rand::rng());
             let node_id = key.public();
             let endpoint_state = BTreeMap::from([(
                 IpPort::from(socket_addr),
@@ -1685,7 +1685,7 @@ mod tests {
         // When we handle a call-me-maybe with more than MAX_INACTIVE_DIRECT_ADDRESSES we do
         // not want to prune them right away but send pings to all of them.
 
-        let key = SecretKey::generate(rand::thread_rng());
+        let key = SecretKey::generate(rand::rng());
         let opts = Options {
             node_id: key.public(),
             relay_url: None,
diff --git a/iroh/src/net_report/reportgen.rs b/iroh/src/net_report/reportgen.rs
index 30da5b94007..cbc19da0df2 100644
--- a/iroh/src/net_report/reportgen.rs
+++ b/iroh/src/net_report/reportgen.rs
@@ -572,9 +572,7 @@ async fn check_captive_portal(
                 return Ok(false);
             }
 
-            let i = (0..urls.len())
-                .choose(&mut rand::thread_rng())
-                .unwrap_or_default();
+            let i = (0..urls.len()).choose(&mut rand::rng()).unwrap_or_default();
             urls[i].clone()
         }
     };
diff --git a/iroh/src/tls/name.rs b/iroh/src/tls/name.rs
index eae5ad625c1..2f02a6c6c72 100644
--- a/iroh/src/tls/name.rs
+++ b/iroh/src/tls/name.rs
@@ -38,7 +38,7 @@ mod tests {
 
     #[test]
     fn test_roundtrip() {
-        let key = SecretKey::generate(rand::rngs::OsRng);
+        let key = SecretKey::generate(rand::rng());
         let node_id = key.public();
         println!("{}", super::encode(node_id));
         assert_eq!(Some(node_id), super::decode(&super::encode(node_id)));

From a909dbc33d788acc58022be739a6863508d9c4c3 Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Mon, 29 Sep 2025 11:06:12 +0200
Subject: [PATCH 03/16] use released pkarr and fixups

---
 Cargo.lock                 | 170 ++++++++++++++++++-------------------
 Cargo.toml                 |   1 -
 iroh-dns-server/Cargo.toml |   2 +-
 iroh-relay/Cargo.toml      |   2 +-
 iroh/Cargo.toml            |   2 +-
 iroh/src/key.rs            |   6 +-
 6 files changed, 89 insertions(+), 94 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 1ed81202892..747aa239458 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -18,9 +18,9 @@ dependencies = [
 
 [[package]]
 name = "addr2line"
-version = "0.24.2"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
 dependencies = [
  "gimli",
 ]
@@ -277,9 +277,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "axum"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "021e862c184ae977658b36c4500f7feac3221ca5da43e3f25bd04ab6c79a29b5"
+checksum = "98e529aee37b5c8206bb4bf4c44797127566d72f76952c970bd3d1e85de8f4e2"
 dependencies = [
  "axum-core",
  "axum-macros",
@@ -297,8 +297,7 @@ dependencies = [
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
@@ -312,9 +311,9 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.5.2"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68464cd0412f486726fb3373129ef5d2993f90c34bc2bc1c1e9943b2f4fc7ca6"
+checksum = "0ac7a6beb1182c7e30253ee75c3e918080bfb83f5a3023bcdf7209d85fd147e6"
 dependencies = [
  "bytes",
  "futures-core",
@@ -323,7 +322,6 @@ dependencies = [
  "http-body-util",
  "mime",
  "pin-project-lite",
- "rustversion",
  "sync_wrapper",
  "tower-layer",
  "tower-service",
@@ -376,9 +374,9 @@ dependencies = [
 
 [[package]]
 name = "backtrace"
-version = "0.3.75"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
+checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
 dependencies = [
  "addr2line",
  "cfg-if",
@@ -386,7 +384,7 @@ dependencies = [
  "miniz_oxide",
  "object",
  "rustc-demangle",
- "windows-targets 0.52.6",
+ "windows-link 0.2.0",
 ]
 
 [[package]]
@@ -522,9 +520,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.2.38"
+version = "1.2.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80f41ae168f955c12fb8960b057d70d0ca153fb83182b57d86380443527be7e9"
+checksum = "e1354349954c6fc9cb0deab020f27f783cf0b604e8bb754dc4658ecf0d29c35f"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -657,7 +655,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
 dependencies = [
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -697,7 +695,7 @@ dependencies = [
  "libc",
  "once_cell",
  "unicode-width",
- "windows-sys 0.61.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -893,7 +891,7 @@ dependencies = [
 [[package]]
 name = "crypto_box"
 version = "0.9.1"
-source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#4a3ebc3dd6ebad2b1a2919bc292e415427033b4e"
+source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#9f8cd8115def3a43aa017ff7ab9c94cb9b7f7b57"
 dependencies = [
  "aead",
  "chacha20",
@@ -908,11 +906,12 @@ dependencies = [
 [[package]]
 name = "crypto_secretbox"
 version = "0.1.1"
-source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#4a3ebc3dd6ebad2b1a2919bc292e415427033b4e"
+source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#9f8cd8115def3a43aa017ff7ab9c94cb9b7f7b57"
 dependencies = [
  "aead",
  "chacha20",
  "cipher",
+ "hybrid-array",
  "poly1305",
  "salsa20",
  "subtle",
@@ -1302,7 +1301,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -1561,9 +1560,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.31.1"
+version = "0.32.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
 
 [[package]]
 name = "glob"
@@ -1898,7 +1897,7 @@ dependencies = [
  "ring",
  "rustls",
  "serde",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tinyvec",
  "tokio",
  "tokio-rustls",
@@ -1924,7 +1923,7 @@ dependencies = [
  "rustls",
  "serde",
  "smallvec",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-rustls",
  "tracing",
@@ -1950,7 +1949,7 @@ dependencies = [
  "prefix-trie",
  "rustls",
  "serde",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "time",
  "tokio",
  "tokio-rustls",
@@ -2148,7 +2147,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core 0.62.0",
+ "windows-core 0.62.1",
 ]
 
 [[package]]
@@ -2587,7 +2586,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2 0.5.10",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
  "web-time",
@@ -2608,7 +2607,7 @@ dependencies = [
  "rustls-pki-types",
  "rustls-platform-verifier",
  "slab",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tinyvec",
  "tracing",
  "web-time",
@@ -2869,7 +2868,7 @@ dependencies = [
  "serde_bencode",
  "serde_bytes",
  "sha1_smol",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tracing",
 ]
 
@@ -2896,9 +2895,9 @@ checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771"
 
 [[package]]
 name = "memchr"
-version = "2.7.5"
+version = "2.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
 
 [[package]]
 name = "mime"
@@ -3115,7 +3114,7 @@ dependencies = [
  "log",
  "netlink-packet-core",
  "netlink-sys",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -3291,9 +3290,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.36.7"
+version = "0.37.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
 dependencies = [
  "memchr",
 ]
@@ -3408,7 +3407,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "21e0a3a33733faeaf8651dfee72dd0f388f0c8e5ad496a3478fa5a922f49cfa8"
 dependencies = [
  "memchr",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "ucd-trie",
 ]
 
@@ -3489,8 +3488,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkarr"
-version = "3.10.0"
-source = "git+https://github.com/dignifiedquire/pkarr?branch=feat-rand-09#8d605f12d7d5ef90a599a1e68f94b356b469a80a"
+version = "3.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7aca11bc0399b1e7e4a6d7d92ec1646990d9eb5197e199b46ed0c7eb4c45c07"
 dependencies = [
  "async-compat",
  "base32",
@@ -3511,7 +3511,7 @@ dependencies = [
  "serde",
  "sha1_smol",
  "simple-dns",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
  "url",
@@ -3831,7 +3831,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2 0.6.0",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
  "web-time",
@@ -3852,7 +3852,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tinyvec",
  "tracing",
  "web-time",
@@ -3874,9 +3874,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.40"
+version = "1.0.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1"
 dependencies = [
  "proc-macro2",
 ]
@@ -4051,9 +4051,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.11.2"
+version = "1.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
+checksum = "8b5288124840bee7b386bc413c487869b360b2b4ec421ea56425128692f2a82c"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -4063,9 +4063,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
+checksum = "833eb9ce86d40ef33cb1306d8accf7bc8ec2bfea4355cbdebb3df68b40925cad"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -4202,7 +4202,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -4229,7 +4229,7 @@ dependencies = [
  "rustls-cert-read",
  "rustls-pemfile",
  "rustls-pki-types",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tokio",
 ]
 
@@ -4252,7 +4252,7 @@ dependencies = [
  "reloadable-state",
  "rustls",
  "rustls-cert-read",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -4373,7 +4373,7 @@ version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
 dependencies = [
- "windows-sys 0.61.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -4390,9 +4390,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "security-framework"
-version = "3.5.0"
+version = "3.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc198e42d9b7510827939c9a15f5062a0c913f3371d765977e586d2fe6c16f4a"
+checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
 dependencies = [
  "bitflags",
  "core-foundation 0.10.1",
@@ -4431,9 +4431,9 @@ checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
 
 [[package]]
 name = "serde"
-version = "1.0.226"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dca6411025b24b60bfa7ec1fe1f8e710ac09782dca409ee8237ba74b51295fd"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -4472,18 +4472,18 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.226"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba2ba63999edb9dac981fb34b3e5c0d111a69b0924e253ed29d83f7c99e966a4"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.226"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8db53ae22f34573731bafa1db20f04027b2d25e02d8205921b569171699cdb33"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4891,7 +4891,7 @@ dependencies = [
  "hickory-proto",
  "rand 0.9.2",
  "socket2 0.5.10",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
 ]
@@ -4975,7 +4975,7 @@ dependencies = [
  "getrandom 0.3.3",
  "once_cell",
  "rustix",
- "windows-sys 0.61.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -4998,11 +4998,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.16"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3467d614147380f2e4e374161426ff399c91084acd2363eaf549172b3d5e60c0"
+checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
 dependencies = [
- "thiserror-impl 2.0.16",
+ "thiserror-impl 2.0.17",
 ]
 
 [[package]]
@@ -5018,9 +5018,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.16"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c5e1be1c48b9172ee610da68fd9cd2770e7a4056cb3fc98710ee6906f0c7960"
+checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5138,9 +5138,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.3"
+version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f63835928ca123f1bef57abbcd23bb2ba0ac9ae1235f1e65bda0d06e7786bd"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
  "rustls",
  "tokio",
@@ -5167,7 +5167,7 @@ dependencies = [
  "rustls",
  "serde",
  "serde_json",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "time",
  "tokio",
  "tokio-rustls",
@@ -5203,9 +5203,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-websockets"
-version = "0.12.1"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5190767f03b86528ab9f4f6a9158072a6d0ef240d9a9591772eb411f315920f4"
+checksum = "b1b6348ebfaaecd771cecb69e832961d277f59845d4220a584701f72728152b7"
 dependencies = [
  "base64",
  "bytes",
@@ -5332,7 +5332,7 @@ dependencies = [
  "governor",
  "http 1.3.1",
  "pin-project",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "tower",
  "tracing",
 ]
@@ -5825,7 +5825,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -5871,9 +5871,9 @@ dependencies = [
 
 [[package]]
 name = "windows-core"
-version = "0.62.0"
+version = "0.62.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57fe7168f7de578d2d8a05b07fd61870d2e73b4020e9f49aa00da8471723497c"
+checksum = "6844ee5416b285084d3d3fffd743b925a6c9385455f64f6d4fa3031c4c2749a9"
 dependencies = [
  "windows-implement",
  "windows-interface",
@@ -5895,9 +5895,9 @@ dependencies = [
 
 [[package]]
 name = "windows-implement"
-version = "0.60.0"
+version = "0.60.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
+checksum = "edb307e42a74fb6de9bf3a02d9712678b22399c87e6fa869d6dfcd8c1b7754e0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5906,9 +5906,9 @@ dependencies = [
 
 [[package]]
 name = "windows-interface"
-version = "0.59.1"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
+checksum = "c0abd1ddbc6964ac14db11c7213d6532ef34bd9aa042c2e5935f59d7908b46a5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6015,14 +6015,14 @@ version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
 dependencies = [
- "windows-targets 0.53.3",
+ "windows-targets 0.53.4",
 ]
 
 [[package]]
 name = "windows-sys"
-version = "0.61.0"
+version = "0.61.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e201184e40b2ede64bc2ea34968b28e33622acdbbf37104f0e4a33f7abe657aa"
+checksum = "6f109e41dd4a3c848907eb83d5a42ea98b3769495597450cf6d153507b166f0f"
 dependencies = [
  "windows-link 0.2.0",
 ]
@@ -6075,11 +6075,11 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.53.3"
+version = "0.53.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe6031c4041849d7c496a8ded650796e7b6ecc19df1a431c1a363342e5dc91"
+checksum = "2d42b7b7f66d2a06854650af09cfdf8713e427a439c97ad65a6375318033ac4b"
 dependencies = [
- "windows-link 0.1.3",
+ "windows-link 0.2.0",
  "windows_aarch64_gnullvm 0.53.0",
  "windows_aarch64_msvc 0.53.0",
  "windows_i686_gnu 0.53.0",
@@ -6314,7 +6314,7 @@ dependencies = [
  "futures",
  "log",
  "serde",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "windows",
  "windows-core 0.61.2",
 ]
@@ -6338,7 +6338,7 @@ dependencies = [
  "pharos",
  "rustc_version",
  "send_wrapper",
- "thiserror 2.0.16",
+ "thiserror 2.0.17",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
diff --git a/Cargo.toml b/Cargo.toml
index e335fe0e6ab..1f529020c47 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -43,5 +43,4 @@ unused-async = "warn"
 
 
 [patch.crates-io]
-pkarr = { git = "https://github.com/dignifiedquire/pkarr", branch = "feat-rand-09" }
 crypto_box = { git = "https://github.com/dignifiedquire/nacl-compat", branch = "rand-09" }
diff --git a/iroh-dns-server/Cargo.toml b/iroh-dns-server/Cargo.toml
index 4b92c368c52..ef5c42cef0e 100644
--- a/iroh-dns-server/Cargo.toml
+++ b/iroh-dns-server/Cargo.toml
@@ -32,7 +32,7 @@ iroh-metrics = { version = "0.35", features = ["service"] }
 lru = "0.13"
 n0-future = "0.1.2"
 n0-snafu = "0.2.2"
-pkarr = { version = "3.7", features = ["relays", "dht"], default-features = false }
+pkarr = { version = "3.11", features = ["relays", "dht"], default-features = false }
 rcgen = "0.13"
 redb = "2.6.3"
 regex = "1.10.3"
diff --git a/iroh-relay/Cargo.toml b/iroh-relay/Cargo.toml
index 2b80cca5b23..f459676e167 100644
--- a/iroh-relay/Cargo.toml
+++ b/iroh-relay/Cargo.toml
@@ -36,7 +36,7 @@ iroh-metrics = { version = "0.35", default-features = false }
 n0-future = "0.1.2"
 num_enum = "0.7"
 pin-project = "1"
-pkarr = { version = "3.7", default-features = false, features = ["signed_packet"] }
+pkarr = { version = "3.11", default-features = false, features = ["signed_packet"] }
 postcard = { version = "1", default-features = false, features = [
     "alloc",
     "use-std",
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index 6d8aebc9f5d..ea9a1de081d 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -45,7 +45,7 @@ n0-watcher = "0.3"
 nested_enum_utils = "0.2.1"
 netwatch = { version = "0.9" }
 pin-project = "1"
-pkarr = { version = "3.7", default-features = false, features = [
+pkarr = { version = "3.11", default-features = false, features = [
     "relays",
 ] }
 quinn = { package = "iroh-quinn", version = "0.14.0", default-features = false, features = ["rustls-ring"] }
diff --git a/iroh/src/key.rs b/iroh/src/key.rs
index 73d253c432a..0340695fc38 100644
--- a/iroh/src/key.rs
+++ b/iroh/src/key.rs
@@ -2,8 +2,7 @@
 
 use std::fmt::Debug;
 
-use aead::Buffer;
-use crypto_box::aead::AeadInPlace;
+use aead::{AeadInOut, Buffer};
 use nested_enum_utils::common_fields;
 use rand::TryRngCore;
 use snafu::{ResultExt, Snafu, ensure};
@@ -51,8 +50,6 @@ impl SharedSecret {
 
     /// Seals the provided cleartext.
     pub fn seal(&self, buffer: &mut dyn Buffer) {
-        use aead::{AeadCore, AeadInPlace};
-
         let mut nonce = crypto_box::Nonce::default();
         rand::rngs::OsRng
             .try_fill_bytes(&mut nonce)
@@ -67,7 +64,6 @@ impl SharedSecret {
 
     /// Opens the ciphertext, which must have been created using `Self::seal`, and places the clear text into the provided buffer.
     pub fn open(&self, buffer: &mut dyn Buffer) -> Result<(), DecryptionError> {
-        use aead::AeadInPlace;
         ensure!(buffer.len() >= NONCE_LEN, InvalidNonceSnafu);
 
         let offset = buffer.len() - NONCE_LEN;

From a530e0e36aea9f6294c6a994dd63bbdd27443ee2 Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Mon, 29 Sep 2025 17:39:47 +0200
Subject: [PATCH 04/16] update deps

---
 Cargo.lock                 | 12 ++++++------
 iroh-dns-server/Cargo.toml |  2 +-
 iroh-relay/Cargo.toml      |  2 +-
 iroh/Cargo.toml            |  2 +-
 iroh/src/key.rs            | 24 +++++++++++++++---------
 5 files changed, 24 insertions(+), 18 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 747aa239458..3b7ee6ffb5d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -102,9 +102,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.11"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
+checksum = "c900954614442c827787a2ffcd8c0602eb53ff7b95a8fbfcdaf5e406197bf3be"
 
 [[package]]
 name = "anstyle-parse"
@@ -891,7 +891,7 @@ dependencies = [
 [[package]]
 name = "crypto_box"
 version = "0.9.1"
-source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#9f8cd8115def3a43aa017ff7ab9c94cb9b7f7b57"
+source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#7f58c670f90f4906ffd5e8d60e130e51954c5982"
 dependencies = [
  "aead",
  "chacha20",
@@ -906,7 +906,7 @@ dependencies = [
 [[package]]
 name = "crypto_secretbox"
 version = "0.1.1"
-source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#9f8cd8115def3a43aa017ff7ab9c94cb9b7f7b57"
+source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#7f58c670f90f4906ffd5e8d60e130e51954c5982"
 dependencies = [
  "aead",
  "chacha20",
@@ -3488,9 +3488,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkarr"
-version = "3.11.0"
+version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7aca11bc0399b1e7e4a6d7d92ec1646990d9eb5197e199b46ed0c7eb4c45c07"
+checksum = "a3e29542b35f65c89fb347945819af996f8b003e5e46d1e66e1c9bebbd54ba09"
 dependencies = [
  "async-compat",
  "base32",
diff --git a/iroh-dns-server/Cargo.toml b/iroh-dns-server/Cargo.toml
index ef5c42cef0e..841d3102239 100644
--- a/iroh-dns-server/Cargo.toml
+++ b/iroh-dns-server/Cargo.toml
@@ -32,7 +32,7 @@ iroh-metrics = { version = "0.35", features = ["service"] }
 lru = "0.13"
 n0-future = "0.1.2"
 n0-snafu = "0.2.2"
-pkarr = { version = "3.11", features = ["relays", "dht"], default-features = false }
+pkarr = { version = "4", features = ["relays", "dht"], default-features = false }
 rcgen = "0.13"
 redb = "2.6.3"
 regex = "1.10.3"
diff --git a/iroh-relay/Cargo.toml b/iroh-relay/Cargo.toml
index f459676e167..da62eac8655 100644
--- a/iroh-relay/Cargo.toml
+++ b/iroh-relay/Cargo.toml
@@ -36,7 +36,7 @@ iroh-metrics = { version = "0.35", default-features = false }
 n0-future = "0.1.2"
 num_enum = "0.7"
 pin-project = "1"
-pkarr = { version = "3.11", default-features = false, features = ["signed_packet"] }
+pkarr = { version = "4", default-features = false, features = ["signed_packet"] }
 postcard = { version = "1", default-features = false, features = [
     "alloc",
     "use-std",
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index ea9a1de081d..c95aad8c0a9 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -45,7 +45,7 @@ n0-watcher = "0.3"
 nested_enum_utils = "0.2.1"
 netwatch = { version = "0.9" }
 pin-project = "1"
-pkarr = { version = "3.11", default-features = false, features = [
+pkarr = { version = "4", default-features = false, features = [
     "relays",
 ] }
 quinn = { package = "iroh-quinn", version = "0.14.0", default-features = false, features = ["rustls-ring"] }
diff --git a/iroh/src/key.rs b/iroh/src/key.rs
index 0340695fc38..34d7f557888 100644
--- a/iroh/src/key.rs
+++ b/iroh/src/key.rs
@@ -2,13 +2,14 @@
 
 use std::fmt::Debug;
 
-use aead::{AeadInOut, Buffer};
+use aead::{AeadCore, AeadInOut, Buffer};
 use nested_enum_utils::common_fields;
-use rand::TryRngCore;
 use snafu::{ResultExt, Snafu, ensure};
 
 pub(crate) const NONCE_LEN: usize = 24;
 
+const AEAD_DATA: &[u8] = &[];
+
 pub(super) fn public_ed_box(key: &ed25519_dalek::VerifyingKey) -> crypto_box::PublicKey {
     crypto_box::PublicKey::from(key.to_montgomery())
 }
@@ -50,13 +51,11 @@ impl SharedSecret {
 
     /// Seals the provided cleartext.
     pub fn seal(&self, buffer: &mut dyn Buffer) {
-        let mut nonce = crypto_box::Nonce::default();
-        rand::rngs::OsRng
-            .try_fill_bytes(&mut nonce)
-            .expect("failed to generate randomness");
+        let nonce = crypto_box::ChaChaBox::try_generate_nonce_with_rng(&mut rand::rngs::OsRng)
+            .expect("not enough randomness");
 
         self.0
-            .encrypt_in_place(&nonce, &[], buffer)
+            .encrypt_in_place(&nonce, AEAD_DATA, buffer)
             .expect("encryption failed");
 
         buffer.extend_from_slice(&nonce).expect("buffer too small");
@@ -73,7 +72,7 @@ impl SharedSecret {
 
         buffer.truncate(offset);
         self.0
-            .decrypt_in_place(&nonce.into(), &[], buffer)
+            .decrypt_in_place(&nonce.into(), AEAD_DATA, buffer)
             .context(AeadSnafu)?;
 
         Ok(())
@@ -97,9 +96,15 @@ mod tests {
         let key_a = iroh_base::SecretKey::generate(&mut rng);
         let key_b = iroh_base::SecretKey::generate(&mut rng);
 
+        println!("a -> a");
+        seal_open_roundtrip(&key_a, &key_a);
+        println!("b -> b");
+        seal_open_roundtrip(&key_b, &key_b);
+
+        println!("a -> b");
         seal_open_roundtrip(&key_a, &key_b);
+        println!("b -> a");
         seal_open_roundtrip(&key_b, &key_a);
-        seal_open_roundtrip(&key_a, &key_a);
     }
 
     fn seal_open_roundtrip(key_a: &iroh_base::SecretKey, key_b: &iroh_base::SecretKey) {
@@ -107,6 +112,7 @@ mod tests {
         let shared_a = shared(key_a, &key_b.public());
         let mut sealed_message = msg.clone();
         shared_a.seal(&mut sealed_message);
+
         let shared_b = shared(key_b, &key_a.public());
         let mut decrypted_message = sealed_message.clone();
         shared_b.open(&mut decrypted_message).unwrap();

From fa1a975f0b9835b0bf4fc5a41b7fb4be02ca716e Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Mon, 29 Sep 2025 19:22:12 +0200
Subject: [PATCH 05/16] fixup for chachabox

---
 Cargo.lock      | 4 ++--
 iroh/src/key.rs | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3b7ee6ffb5d..93579b250ed 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -891,7 +891,7 @@ dependencies = [
 [[package]]
 name = "crypto_box"
 version = "0.9.1"
-source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#7f58c670f90f4906ffd5e8d60e130e51954c5982"
+source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#f7d92b0fac4c8883ee6d5ff0144e6d8d0a4a7d9e"
 dependencies = [
  "aead",
  "chacha20",
@@ -906,7 +906,7 @@ dependencies = [
 [[package]]
 name = "crypto_secretbox"
 version = "0.1.1"
-source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#7f58c670f90f4906ffd5e8d60e130e51954c5982"
+source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#f7d92b0fac4c8883ee6d5ff0144e6d8d0a4a7d9e"
 dependencies = [
  "aead",
  "chacha20",
diff --git a/iroh/src/key.rs b/iroh/src/key.rs
index 34d7f557888..31539914cf6 100644
--- a/iroh/src/key.rs
+++ b/iroh/src/key.rs
@@ -46,7 +46,7 @@ impl Debug for SharedSecret {
 
 impl SharedSecret {
     pub fn new(this: &crypto_box::SecretKey, other: &crypto_box::PublicKey) -> Self {
-        SharedSecret(crypto_box::ChaChaBox::new(other, this))
+        SharedSecret(crypto_box::ChaChaBox::from_clamped(other, this))
     }
 
     /// Seals the provided cleartext.

From e6f3ef863211bd464fee6150aa09ce36b8597b50 Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Mon, 29 Sep 2025 21:14:52 +0200
Subject: [PATCH 06/16] test: use seeded randomness for keys

---
 Cargo.lock                                |  1 +
 iroh-base/Cargo.toml                      |  1 +
 iroh-base/src/key.rs                      | 12 +++---
 iroh-base/src/ticket/node.rs              |  4 +-
 iroh-dns-server/examples/publish.rs       |  2 +-
 iroh-dns-server/src/lib.rs                | 17 +++++---
 iroh-relay/src/protos/handshake.rs        | 49 +++++++++++++++--------
 iroh-relay/src/server.rs                  | 18 +++++----
 iroh-relay/src/server/client.rs           | 11 +++--
 iroh-relay/src/server/clients.rs          |  6 ++-
 iroh-relay/src/server/http_server.rs      | 25 ++++++++----
 iroh/Cargo.toml                           |  1 +
 iroh/examples/0rtt.rs                     |  2 +-
 iroh/examples/connect-unreliable.rs       |  3 +-
 iroh/examples/connect.rs                  |  3 +-
 iroh/examples/dht_discovery.rs            |  5 +--
 iroh/examples/listen-unreliable.rs        |  3 +-
 iroh/examples/listen.rs                   |  3 +-
 iroh/examples/transfer.rs                 |  3 +-
 iroh/src/disco.rs                         |  6 ++-
 iroh/src/discovery.rs                     | 40 +++++++++++-------
 iroh/src/discovery/mdns.rs                | 49 ++++++++++++++---------
 iroh/src/endpoint.rs                      |  6 ++-
 iroh/src/key.rs                           |  5 ++-
 iroh/src/magicsock.rs                     |  8 ++--
 iroh/src/magicsock/node_map.rs            | 10 +++--
 iroh/src/magicsock/node_map/node_state.rs | 14 ++++---
 iroh/src/tls/name.rs                      |  4 +-
 28 files changed, 198 insertions(+), 113 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 93579b250ed..ff108ca9924 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2460,6 +2460,7 @@ dependencies = [
  "postcard",
  "proptest",
  "rand 0.9.2",
+ "rand_chacha 0.9.0",
  "rand_core 0.9.3",
  "serde",
  "serde_json",
diff --git a/iroh-base/Cargo.toml b/iroh-base/Cargo.toml
index 3608da7712d..f33981fd529 100644
--- a/iroh-base/Cargo.toml
+++ b/iroh-base/Cargo.toml
@@ -31,6 +31,7 @@ nested_enum_utils = "0.2.0"
 postcard = { version = "1", features = ["use-std"] }
 proptest = "1.0.0"
 rand = "0.9"
+rand_chacha = "0.9"
 serde_json = "1"
 serde_test = "1"
 
diff --git a/iroh-base/src/key.rs b/iroh-base/src/key.rs
index e89316217ea..5b082ec76e2 100644
--- a/iroh-base/src/key.rs
+++ b/iroh-base/src/key.rs
@@ -288,11 +288,11 @@ impl SecretKey {
     ///
     /// ```rust
     /// // use the OsRng option for OS depedndent most secure RNG.
-    /// let mut rng = rand::rngs::OsRng;
-    /// let _key = iroh_base::SecretKey::generate(&mut rng);
+    /// use rand::{TryRngCore, rngs::OsRng};
+    /// let _key = iroh_base::SecretKey::generate(&mut OsRng.unwrap_err());
     /// ```
-    pub fn generate<R: CryptoRng>(mut csprng: R) -> Self {
-        let secret = SigningKey::generate(&mut csprng);
+    pub fn generate<R: CryptoRng + ?Sized>(csprng: &mut R) -> Self {
+        let secret = SigningKey::generate(csprng);
 
         Self { secret }
     }
@@ -372,6 +372,7 @@ fn decode_base32_hex(s: &str) -> Result<[u8; 32], KeyParsingError> {
 #[cfg(test)]
 mod tests {
     use data_encoding::HEXLOWER;
+    use rand::SeedableRng;
 
     use super::*;
 
@@ -405,7 +406,8 @@ mod tests {
 
     #[test]
     fn test_from_str() {
-        let key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let key = SecretKey::generate(&mut rng);
         assert_eq!(
             SecretKey::from_str(&HEXLOWER.encode(&key.to_bytes()))
                 .unwrap()
diff --git a/iroh-base/src/ticket/node.rs b/iroh-base/src/ticket/node.rs
index 4476f7d39b5..3a9ae9df443 100644
--- a/iroh-base/src/ticket/node.rs
+++ b/iroh-base/src/ticket/node.rs
@@ -136,12 +136,14 @@ mod tests {
     use std::net::{Ipv4Addr, SocketAddr};
 
     use data_encoding::HEXLOWER;
+    use rand::SeedableRng;
 
     use super::*;
     use crate::key::{PublicKey, SecretKey};
 
     fn make_ticket() -> NodeTicket {
-        let peer = SecretKey::generate(rand::rng()).public();
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let peer = SecretKey::generate(&mut rng).public();
         let addr = SocketAddr::from((Ipv4Addr::LOCALHOST, 1234));
         let relay_url = None;
         NodeTicket {
diff --git a/iroh-dns-server/examples/publish.rs b/iroh-dns-server/examples/publish.rs
index 56d8873d8d9..d102bdbaf18 100644
--- a/iroh-dns-server/examples/publish.rs
+++ b/iroh-dns-server/examples/publish.rs
@@ -64,7 +64,7 @@ async fn main() -> Result<()> {
         Ok(s) => SecretKey::from_str(&s)
             .context("failed to parse IROH_SECRET environment variable as iroh secret key")?,
         Err(_) => {
-            let s = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
+            let s = SecretKey::generate(&mut rand::rngs::OsRng.unwrap_err());
             println!("Generated a new node secret. To reuse, set");
             println!(
                 "\tIROH_SECRET={}",
diff --git a/iroh-dns-server/src/lib.rs b/iroh-dns-server/src/lib.rs
index 947ec3986f0..f6d4f8aca0c 100644
--- a/iroh-dns-server/src/lib.rs
+++ b/iroh-dns-server/src/lib.rs
@@ -27,6 +27,7 @@ mod tests {
     };
     use n0_snafu::{Result, ResultExt};
     use pkarr::{SignedPacket, Timestamp};
+    use rand::{CryptoRng, SeedableRng};
     use tracing_test::traced_test;
 
     use crate::{
@@ -167,7 +168,9 @@ mod tests {
 
         let origin = "irohdns.example.";
 
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
+        let secret_key = SecretKey::generate(&mut rng);
         let node_id = secret_key.public();
         let pkarr = PkarrRelayClient::new(pkarr_relay);
         let relay_url: RelayUrl = "https://relay.example.".parse()?;
@@ -189,6 +192,8 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn store_eviction() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         let options = ZoneStoreOptions {
             eviction: Duration::from_millis(100),
             eviction_interval: Duration::from_millis(100),
@@ -198,7 +203,7 @@ mod tests {
         let store = ZoneStore::in_memory(options, Default::default())?;
 
         // create a signed packet
-        let signed_packet = random_signed_packet()?;
+        let signed_packet = random_signed_packet(&mut rng)?;
         let key = PublicKeyBytes::from_signed_packet(&signed_packet);
 
         store
@@ -219,6 +224,8 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn integration_mainline() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         // run a mainline testnet
         let testnet = pkarr::mainline::Testnet::new_async(5).await.e()?;
         let bootstrap = testnet.bootstrap.clone();
@@ -231,7 +238,7 @@ mod tests {
         let origin = "irohdns.example.";
 
         // create a signed packet
-        let secret_key = SecretKey::generate(rand::rng());
+        let secret_key = SecretKey::generate(&mut rng);
         let node_id = secret_key.public();
         let relay_url: RelayUrl = "https://relay.example.".parse()?;
         let node_info = NodeInfo::new(node_id).with_relay_url(Some(relay_url.clone()));
@@ -260,8 +267,8 @@ mod tests {
         DnsResolver::with_nameserver(nameserver)
     }
 
-    fn random_signed_packet() -> Result<SignedPacket> {
-        let secret_key = SecretKey::generate(rand::rng());
+    fn random_signed_packet<R: CryptoRng + ?Sized>(rng: &mut R) -> Result<SignedPacket> {
+        let secret_key = SecretKey::generate(rng);
         let node_id = secret_key.public();
         let relay_url: RelayUrl = "https://relay.example.".parse()?;
         let node_info = NodeInfo::new(node_id).with_relay_url(Some(relay_url.clone()));
diff --git a/iroh-relay/src/protos/handshake.rs b/iroh-relay/src/protos/handshake.rs
index ebb8077f9bc..82f1112ff57 100644
--- a/iroh-relay/src/protos/handshake.rs
+++ b/iroh-relay/src/protos/handshake.rs
@@ -196,7 +196,7 @@ pub(crate) enum VerificationError {
 impl ServerChallenge {
     /// Generates a new challenge.
     #[cfg(feature = "server")]
-    pub(crate) fn new(mut rng: impl CryptoRng) -> Self {
+    pub(crate) fn new<R: CryptoRng + ?Sized>(rng: &mut R) -> Self {
         let mut challenge = [0u8; 16];
         rng.fill_bytes(&mut challenge);
         Self { challenge }
@@ -432,7 +432,7 @@ pub(crate) async fn serverside(
         // We'll fall back to verification that takes another round trip more time.
     }
 
-    let challenge = ServerChallenge::new(rand::rng());
+    let challenge = ServerChallenge::new(&mut rand::rng());
     write_frame(io, &challenge).await?;
 
     let (_, frame) = read_frame(io, &[ClientAuth::TAG]).await?;
@@ -530,6 +530,7 @@ mod tests {
     use iroh_base::{PublicKey, SecretKey};
     use n0_future::{Sink, SinkExt, Stream, TryStreamExt};
     use n0_snafu::{Result, ResultExt};
+    use rand::SeedableRng;
     use tokio_util::codec::{Framed, LengthDelimitedCodec};
     use tracing::{Instrument, info_span};
     use tracing_test::traced_test;
@@ -662,7 +663,9 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_via_shared_secrets() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
+        let secret_key = SecretKey::generate(&mut rng);
         let (client, server) = simulate_handshake(&secret_key, Some(42), Some(42), None).await;
         client?;
         let (public_key, auth) = server?;
@@ -674,7 +677,9 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_via_challenge() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
+        let secret_key = SecretKey::generate(&mut rng);
         let (client, server) = simulate_handshake(&secret_key, None, None, None).await;
         client?;
         let (public_key, auth) = server?;
@@ -686,7 +691,9 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_mismatching_shared_secrets() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
+        let secret_key = SecretKey::generate(&mut rng);
         // mismatching shared secrets *might* happen with HTTPS proxies that don't also middle-man the shared secret
         let (client, server) = simulate_handshake(&secret_key, Some(10), Some(99), None).await;
         client?;
@@ -699,7 +706,8 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_challenge_fallback() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let secret_key = SecretKey::generate(&mut rng);
         // clients might not have access to shared secrets
         let (client, server) = simulate_handshake(&secret_key, None, Some(99), None).await;
         client?;
@@ -712,7 +720,8 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_with_auth_positive() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let secret_key = SecretKey::generate(&mut rng);
         let public_key = secret_key.public();
         let (client, server) = simulate_handshake(&secret_key, None, None, Some(public_key)).await;
         client?;
@@ -724,9 +733,10 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_with_auth_negative() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let secret_key = SecretKey::generate(&mut rng);
         let public_key = secret_key.public();
-        let wrong_secret_key = SecretKey::generate(rand::rng());
+        let wrong_secret_key = SecretKey::generate(&mut rng);
         let (client, server) =
             simulate_handshake(&wrong_secret_key, None, None, Some(public_key)).await;
         assert!(client.is_err());
@@ -737,9 +747,10 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_handshake_via_shared_secret_with_auth_negative() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let secret_key = SecretKey::generate(&mut rng);
         let public_key = secret_key.public();
-        let wrong_secret_key = SecretKey::generate(rand::rng());
+        let wrong_secret_key = SecretKey::generate(&mut rng);
         let (client, server) =
             simulate_handshake(&wrong_secret_key, Some(42), Some(42), Some(public_key)).await;
         assert!(client.is_err());
@@ -749,8 +760,9 @@ mod tests {
 
     #[test]
     fn test_client_auth_roundtrip() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
-        let challenge = ServerChallenge::new(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let secret_key = SecretKey::generate(&mut rng);
+        let challenge = ServerChallenge::new(&mut rng);
         let client_auth = ClientAuth::new(&secret_key, &challenge);
 
         let bytes = postcard::to_allocvec(&client_auth).e()?;
@@ -764,7 +776,8 @@ mod tests {
 
     #[test]
     fn test_km_client_auth_roundtrip() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let secret_key = SecretKey::generate(&mut rng);
         let client_auth = KeyMaterialClientAuth::new(
             &secret_key,
             &TestKeyingMaterial {
@@ -785,8 +798,9 @@ mod tests {
 
     #[test]
     fn test_challenge_verification() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
-        let challenge = ServerChallenge::new(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let secret_key = SecretKey::generate(&mut rng);
+        let challenge = ServerChallenge::new(&mut rng);
         let client_auth = ClientAuth::new(&secret_key, &challenge);
         assert!(client_auth.verify(&challenge).is_ok());
 
@@ -795,7 +809,8 @@ mod tests {
 
     #[test]
     fn test_key_material_verification() -> Result {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let secret_key = SecretKey::generate(&mut rng);
         let io = TestKeyingMaterial {
             inner: (),
             shared_secret: Some(42),
diff --git a/iroh-relay/src/server.rs b/iroh-relay/src/server.rs
index 6cf9554e53b..f1295305abf 100644
--- a/iroh-relay/src/server.rs
+++ b/iroh-relay/src/server.rs
@@ -754,6 +754,7 @@ mod tests {
     use iroh_base::{NodeId, RelayUrl, SecretKey};
     use n0_future::{FutureExt, SinkExt, StreamExt};
     use n0_snafu::Result;
+    use rand::SeedableRng;
     use tracing::{info, instrument};
     use tracing_test::traced_test;
 
@@ -887,13 +888,14 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_relay_clients() -> Result<()> {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let server = spawn_local_relay().await?;
 
         let relay_url = format!("http://{}", server.http_addr().unwrap());
         let relay_url: RelayUrl = relay_url.parse()?;
 
         // set up client a
-        let a_secret_key = SecretKey::generate(rand::rng());
+        let a_secret_key = SecretKey::generate(&mut rng);
         let a_key = a_secret_key.public();
         let resolver = dns_resolver();
         info!("client a build & connect");
@@ -902,7 +904,7 @@ mod tests {
             .await?;
 
         // set up client b
-        let b_secret_key = SecretKey::generate(rand::rng());
+        let b_secret_key = SecretKey::generate(&mut rng);
         let b_key = b_secret_key.public();
         info!("client b build & connect");
         let mut client_b = ClientBuilder::new(relay_url.clone(), b_secret_key, resolver.clone())
@@ -947,10 +949,11 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_relay_access_control() -> Result<()> {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let current_span = tracing::info_span!("this is a test");
         let _guard = current_span.enter();
 
-        let a_secret_key = SecretKey::generate(rand::rng());
+        let a_secret_key = SecretKey::generate(&mut rng);
         let a_key = a_secret_key.public();
 
         let server = Server::spawn(ServerConfig::<(), ()> {
@@ -993,7 +996,7 @@ mod tests {
         // test that another client has access
 
         // set up client b
-        let b_secret_key = SecretKey::generate(rand::rng());
+        let b_secret_key = SecretKey::generate(&mut rng);
         let b_key = b_secret_key.public();
 
         let resolver = dns_resolver();
@@ -1002,7 +1005,7 @@ mod tests {
             .await?;
 
         // set up client c
-        let c_secret_key = SecretKey::generate(rand::rng());
+        let c_secret_key = SecretKey::generate(&mut rng);
         let c_key = c_secret_key.public();
 
         let resolver = dns_resolver();
@@ -1031,19 +1034,20 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_relay_clients_full() -> Result<()> {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let server = spawn_local_relay().await.unwrap();
         let relay_url = format!("http://{}", server.http_addr().unwrap());
         let relay_url: RelayUrl = relay_url.parse().unwrap();
 
         // set up client a
-        let a_secret_key = SecretKey::generate(rand::rng());
+        let a_secret_key = SecretKey::generate(&mut rng);
         let resolver = dns_resolver();
         let mut client_a = ClientBuilder::new(relay_url.clone(), a_secret_key, resolver.clone())
             .connect()
             .await?;
 
         // set up client b
-        let b_secret_key = SecretKey::generate(rand::rng());
+        let b_secret_key = SecretKey::generate(&mut rng);
         let b_key = b_secret_key.public();
         let _client_b = ClientBuilder::new(relay_url.clone(), b_secret_key, resolver.clone())
             .connect()
diff --git a/iroh-relay/src/server/client.rs b/iroh-relay/src/server/client.rs
index 085278763b3..afdfaeb7de5 100644
--- a/iroh-relay/src/server/client.rs
+++ b/iroh-relay/src/server/client.rs
@@ -567,6 +567,7 @@ mod tests {
     use iroh_base::SecretKey;
     use n0_future::Stream;
     use n0_snafu::{Result, ResultExt};
+    use rand::SeedableRng;
     use tracing::info;
     use tracing_test::traced_test;
 
@@ -599,11 +600,13 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_client_actor_basic() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         let (send_queue_s, send_queue_r) = mpsc::channel(10);
         let (disco_send_queue_s, disco_send_queue_r) = mpsc::channel(10);
         let (peer_gone_s, peer_gone_r) = mpsc::channel(10);
 
-        let node_id = SecretKey::generate(rand::rng()).public();
+        let node_id = SecretKey::generate(&mut rng).public();
         let (io, io_rw) = tokio::io::duplex(1024);
         let mut io_rw = Conn::test(io_rw);
         let stream = RelayedStream::test(io);
@@ -685,7 +688,7 @@ mod tests {
         let frame = recv_frame(FrameType::Pong, &mut io_rw).await?;
         assert_eq!(frame, RelayToClientMsg::Pong(*data));
 
-        let target = SecretKey::generate(rand::rng()).public();
+        let target = SecretKey::generate(&mut rng).public();
 
         // send packet
         println!("  send packet");
@@ -723,6 +726,8 @@ mod tests {
         const LIMIT: u32 = 50;
         const MAX_FRAMES: u32 = 100;
 
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         // Build the rate limited stream.
         let (io_read, io_write) = tokio::io::duplex((LIMIT * MAX_FRAMES) as _);
         let mut frame_writer = Conn::test(io_write);
@@ -731,7 +736,7 @@ mod tests {
 
         // Prepare a frame to send, assert its size.
         let data = Datagrams::from(b"hello world!!!!!");
-        let target = SecretKey::generate(rand::rng()).public();
+        let target = SecretKey::generate(&mut rng).public();
         let frame = ClientToRelayMsg::Datagrams {
             dst_node_id: target,
             datagrams: data.clone(),
diff --git a/iroh-relay/src/server/clients.rs b/iroh-relay/src/server/clients.rs
index 8190d2321ec..fc4927b78a6 100644
--- a/iroh-relay/src/server/clients.rs
+++ b/iroh-relay/src/server/clients.rs
@@ -196,6 +196,7 @@ mod tests {
     use iroh_base::SecretKey;
     use n0_future::{Stream, StreamExt};
     use n0_snafu::{Result, ResultExt};
+    use rand::SeedableRng;
 
     use super::*;
     use crate::{
@@ -242,8 +243,9 @@ mod tests {
 
     #[tokio::test]
     async fn test_clients() -> Result {
-        let a_key = SecretKey::generate(rand::rng()).public();
-        let b_key = SecretKey::generate(rand::rng()).public();
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let a_key = SecretKey::generate(&mut rng).public();
+        let b_key = SecretKey::generate(&mut rng).public();
 
         let (builder_a, mut a_rw) = test_client_builder(a_key);
 
diff --git a/iroh-relay/src/server/http_server.rs b/iroh-relay/src/server/http_server.rs
index 8622da5cdcb..2ed7b5d558c 100644
--- a/iroh-relay/src/server/http_server.rs
+++ b/iroh-relay/src/server/http_server.rs
@@ -868,6 +868,7 @@ mod tests {
     use iroh_base::{PublicKey, SecretKey};
     use n0_future::{SinkExt, StreamExt};
     use n0_snafu::{Result, ResultExt};
+    use rand::SeedableRng;
     use reqwest::Url;
     use snafu::whatever;
     use tracing::info;
@@ -908,8 +909,10 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_http_clients_and_server() -> Result {
-        let a_key = SecretKey::generate(rand::rng());
-        let b_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
+        let a_key = SecretKey::generate(&mut rng);
+        let b_key = SecretKey::generate(&mut rng);
 
         // start server
         let server = ServerBuilder::new("127.0.0.1:0".parse().unwrap())
@@ -1023,8 +1026,10 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_https_clients_and_server() -> Result {
-        let a_key = SecretKey::generate(rand::rng());
-        let b_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
+        let a_key = SecretKey::generate(&mut rng);
+        let b_key = SecretKey::generate(&mut rng);
 
         // create tls_config
         let tls_config = make_tls_config();
@@ -1112,6 +1117,8 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_server_basic() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         info!("Create the server.");
         let metrics = Arc::new(Metrics::default());
         let service = RelayService::new(
@@ -1124,7 +1131,7 @@ mod tests {
         );
 
         info!("Create client A and connect it to the server.");
-        let key_a = SecretKey::generate(rand::rng());
+        let key_a = SecretKey::generate(&mut rng);
         let public_key_a = key_a.public();
         let (client_a, rw_a) = tokio::io::duplex(10);
         let s = service.clone();
@@ -1134,7 +1141,7 @@ mod tests {
         handler_task.await.context("join")??;
 
         info!("Create client B and connect it to the server.");
-        let key_b = SecretKey::generate(rand::rng());
+        let key_b = SecretKey::generate(&mut rng);
         let public_key_b = key_b.public();
         let (client_b, rw_b) = tokio::io::duplex(10);
         let s = service.clone();
@@ -1211,6 +1218,8 @@ mod tests {
 
     #[tokio::test]
     async fn test_server_replace_client() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         info!("Create the server.");
         let service = RelayService::new(
             Default::default(),
@@ -1222,7 +1231,7 @@ mod tests {
         );
 
         info!("Create client A and connect it to the server.");
-        let key_a = SecretKey::generate(rand::rng());
+        let key_a = SecretKey::generate(&mut rng);
         let public_key_a = key_a.public();
         let (client_a, rw_a) = tokio::io::duplex(10);
         let s = service.clone();
@@ -1232,7 +1241,7 @@ mod tests {
         handler_task.await.context("join")??;
 
         info!("Create client B and connect it to the server.");
-        let key_b = SecretKey::generate(rand::rng());
+        let key_b = SecretKey::generate(&mut rng);
         let public_key_b = key_b.public();
         let (client_b, rw_b) = tokio::io::duplex(10);
         let s = service.clone();
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index c95aad8c0a9..0d734c3bb32 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -135,6 +135,7 @@ getrandom = { version = "0.3.2", features = ["wasm_js"] }
 console_error_panic_hook = "0.1"
 postcard = { version = "1.1.1", features = ["use-std"] }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+rand_chacha = "0.9"
 
 # *non*-wasm-in-browser test/dev dependencies
 [target.'cfg(not(all(target_family = "wasm", target_os = "unknown")))'.dev-dependencies]
diff --git a/iroh/examples/0rtt.rs b/iroh/examples/0rtt.rs
index 2061674c113..1c250dcf46a 100644
--- a/iroh/examples/0rtt.rs
+++ b/iroh/examples/0rtt.rs
@@ -34,7 +34,7 @@ pub fn get_or_generate_secret_key() -> n0_snafu::Result<SecretKey> {
         SecretKey::from_str(&secret).context("Invalid secret key format")
     } else {
         // Generate a new random key
-        let secret_key = SecretKey::generate(rand::rng());
+        let secret_key = SecretKey::generate(&mut rand::rng());
         println!(
             "Generated new secret key: {}",
             HEXLOWER.encode(&secret_key.to_bytes())
diff --git a/iroh/examples/connect-unreliable.rs b/iroh/examples/connect-unreliable.rs
index 448e7cefe5b..d6907e54b93 100644
--- a/iroh/examples/connect-unreliable.rs
+++ b/iroh/examples/connect-unreliable.rs
@@ -10,7 +10,6 @@ use std::net::SocketAddr;
 use clap::Parser;
 use iroh::{Endpoint, NodeAddr, RelayMode, RelayUrl, SecretKey};
 use n0_snafu::ResultExt;
-use rand::TryRngCore;
 use tracing::info;
 
 // An example ALPN that we are using to communicate over the `Endpoint`
@@ -34,7 +33,7 @@ async fn main() -> n0_snafu::Result<()> {
     tracing_subscriber::fmt::init();
     println!("\nconnect (unreliable) example!\n");
     let args = Cli::parse();
-    let secret_key = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
+    let secret_key = SecretKey::generate(&mut rand::rng());
     println!("public key: {}", secret_key.public());
 
     // Build a `Endpoint`, which uses PublicKeys as node identifiers, uses QUIC for directly connecting to other nodes, and uses the relay protocol and relay servers to holepunch direct connections between nodes when there are NATs or firewalls preventing direct connections. If no direct connection can be made, packets are relayed over the relay servers.
diff --git a/iroh/examples/connect.rs b/iroh/examples/connect.rs
index 955f36c7d35..3ea61031f00 100644
--- a/iroh/examples/connect.rs
+++ b/iroh/examples/connect.rs
@@ -10,7 +10,6 @@ use std::net::SocketAddr;
 use clap::Parser;
 use iroh::{Endpoint, NodeAddr, RelayMode, RelayUrl, SecretKey};
 use n0_snafu::{Result, ResultExt};
-use rand::TryRngCore;
 use tracing::info;
 
 // An example ALPN that we are using to communicate over the `Endpoint`
@@ -34,7 +33,7 @@ async fn main() -> Result<()> {
     tracing_subscriber::fmt::init();
     println!("\nconnect example!\n");
     let args = Cli::parse();
-    let secret_key = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
+    let secret_key = SecretKey::generate(&mut rand::rng());
     println!("public key: {}", secret_key.public());
 
     // Build a `Endpoint`, which uses PublicKeys as node identifiers, uses QUIC for directly connecting to other nodes, and uses the relay protocol and relay servers to holepunch direct connections between nodes when there are NATs or firewalls preventing direct connections. If no direct connection can be made, packets are relayed over the relay servers.
diff --git a/iroh/examples/dht_discovery.rs b/iroh/examples/dht_discovery.rs
index dcacbbf8bc2..57fc3b718be 100644
--- a/iroh/examples/dht_discovery.rs
+++ b/iroh/examples/dht_discovery.rs
@@ -13,7 +13,6 @@ use std::str::FromStr;
 use clap::Parser;
 use iroh::{Endpoint, NodeId};
 use n0_snafu::ResultExt;
-use rand::TryRngCore;
 use tracing::warn;
 use url::Url;
 
@@ -63,7 +62,7 @@ fn build_discovery(args: Args) -> iroh::discovery::pkarr::dht::Builder {
 }
 
 async fn chat_server(args: Args) -> n0_snafu::Result<()> {
-    let secret_key = iroh::SecretKey::generate(rand::rngs::OsRng.unwrap_err());
+    let secret_key = iroh::SecretKey::generate(&mut rand::rng());
     let node_id = secret_key.public();
     let discovery = build_discovery(args);
     let endpoint = Endpoint::builder()
@@ -107,7 +106,7 @@ async fn chat_server(args: Args) -> n0_snafu::Result<()> {
 
 async fn chat_client(args: Args) -> n0_snafu::Result<()> {
     let remote_node_id = args.node_id.unwrap();
-    let secret_key = iroh::SecretKey::generate(rand::rngs::OsRng.unwrap_err());
+    let secret_key = iroh::SecretKey::generate(&mut rand::rng());
     let node_id = secret_key.public();
     // note: we don't pass a secret key here, because we don't need to publish our address, don't spam the DHT
     let discovery = build_discovery(args).no_publish();
diff --git a/iroh/examples/listen-unreliable.rs b/iroh/examples/listen-unreliable.rs
index e988128c812..61dba5a7aac 100644
--- a/iroh/examples/listen-unreliable.rs
+++ b/iroh/examples/listen-unreliable.rs
@@ -5,7 +5,6 @@
 //!     $ cargo run --example listen-unreliable
 use iroh::{Endpoint, RelayMode, SecretKey};
 use n0_snafu::{Error, Result, ResultExt};
-use rand::TryRngCore;
 use tracing::{info, warn};
 
 // An example ALPN that we are using to communicate over the `Endpoint`
@@ -15,7 +14,7 @@ const EXAMPLE_ALPN: &[u8] = b"n0/iroh/examples/magic/0";
 async fn main() -> Result<()> {
     tracing_subscriber::fmt::init();
     println!("\nlisten (unreliable) example!\n");
-    let secret_key = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
+    let secret_key = SecretKey::generate(&mut rand::rng());
     println!("public key: {}", secret_key.public());
 
     // Build a `Endpoint`, which uses PublicKeys as node identifiers, uses QUIC for directly connecting to other nodes, and uses the relay servers to holepunch direct connections between nodes when there are NATs or firewalls preventing direct connections. If no direct connection can be made, packets are relayed over the relay servers.
diff --git a/iroh/examples/listen.rs b/iroh/examples/listen.rs
index 6f34eb5e50c..0b116142b48 100644
--- a/iroh/examples/listen.rs
+++ b/iroh/examples/listen.rs
@@ -7,7 +7,6 @@ use std::time::Duration;
 
 use iroh::{Endpoint, RelayMode, SecretKey, endpoint::ConnectionError};
 use n0_snafu::ResultExt;
-use rand::TryRngCore;
 use tracing::{debug, info, warn};
 
 // An example ALPN that we are using to communicate over the `Endpoint`
@@ -17,7 +16,7 @@ const EXAMPLE_ALPN: &[u8] = b"n0/iroh/examples/magic/0";
 async fn main() -> n0_snafu::Result<()> {
     tracing_subscriber::fmt::init();
     println!("\nlisten example!\n");
-    let secret_key = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
+    let secret_key = SecretKey::generate(&mut rand::rng());
     println!("public key: {}", secret_key.public());
 
     // Build a `Endpoint`, which uses PublicKeys as node identifiers, uses QUIC for directly connecting to other nodes, and uses the relay protocol and relay servers to holepunch direct connections between nodes when there are NATs or firewalls preventing direct connections. If no direct connection can be made, packets are relayed over the relay servers.
diff --git a/iroh/examples/transfer.rs b/iroh/examples/transfer.rs
index 7e80af9d649..171378378d0 100644
--- a/iroh/examples/transfer.rs
+++ b/iroh/examples/transfer.rs
@@ -20,7 +20,6 @@ use iroh_base::ticket::NodeTicket;
 use n0_future::task::AbortOnDropHandle;
 use n0_snafu::{Result, ResultExt};
 use n0_watcher::Watcher as _;
-use rand::TryRngCore;
 use tokio_stream::StreamExt;
 use tracing::{info, warn};
 use url::Url;
@@ -187,7 +186,7 @@ impl EndpointArgs {
             Ok(s) => SecretKey::from_str(&s)
                 .context("Failed to parse IROH_SECRET environment variable as iroh secret key")?,
             Err(_) => {
-                let s = SecretKey::generate(rand::rngs::OsRng.unwrap_err());
+                let s = SecretKey::generate(&mut rand::rng());
                 println!("Generated a new node secret. To reuse, set");
                 println!("\tIROH_SECRET={}", HEXLOWER.encode(&s.to_bytes()));
                 s
diff --git a/iroh/src/disco.rs b/iroh/src/disco.rs
index f9041ff891f..80d65c1de4b 100644
--- a/iroh/src/disco.rs
+++ b/iroh/src/disco.rs
@@ -431,6 +431,7 @@ const fn msg_header(t: MessageType, ver: u8) -> [u8; HEADER_LEN] {
 #[cfg(test)]
 mod tests {
     use iroh_base::SecretKey;
+    use rand::SeedableRng;
 
     use super::*;
     use crate::key::{SharedSecret, public_ed_box, secret_ed_box};
@@ -511,8 +512,9 @@ mod tests {
 
     #[test]
     fn test_extraction() {
-        let sender_key = SecretKey::generate(rand::rng());
-        let recv_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let sender_key = SecretKey::generate(&mut rng);
+        let recv_key = SecretKey::generate(&mut rng);
 
         let msg = Message::Ping(Ping {
             tx_id: stun_rs::TransactionId::default(),
diff --git a/iroh/src/discovery.rs b/iroh/src/discovery.rs
index 751e7b3a774..ae8786bd036 100644
--- a/iroh/src/discovery.rs
+++ b/iroh/src/discovery.rs
@@ -643,7 +643,7 @@ mod tests {
     use n0_snafu::{Error, Result, ResultExt};
     use n0_watcher::Watcher as _;
     use quinn::{IdleTimeout, TransportConfig};
-    use rand::Rng;
+    use rand::{Rng, SeedableRng};
     use tokio_util::task::AbortOnDropHandle;
     use tracing_test::traced_test;
 
@@ -756,14 +756,16 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn endpoint_discovery_simple_shared() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
@@ -803,14 +805,15 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn endpoint_discovery_combined_with_empty() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco1 = EmptyDiscovery;
             let disco2 = disco_shared.create_discovery(secret.public());
             let disco = ConcurrentDiscovery::empty();
@@ -834,14 +837,15 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn endpoint_discovery_combined_with_empty_and_wrong() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco1 = EmptyDiscovery;
             let disco2 = disco_shared.create_lying_discovery(secret.public());
             let disco3 = disco_shared.create_discovery(secret.public());
@@ -861,14 +865,16 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn endpoint_discovery_combined_wrong_only() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco1 = disco_shared.create_lying_discovery(secret.public());
             let disco = ConcurrentDiscovery::from_services(vec![Box::new(disco1)]);
             new_endpoint(secret, disco).await
@@ -895,14 +901,16 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn endpoint_discovery_with_wrong_existing_addr() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco = disco_shared.create_discovery(secret.public());
             new_endpoint(secret, disco).await
         };
@@ -967,6 +975,7 @@ mod test_dns_pkarr {
     use iroh_relay::{RelayMap, node_info::UserData};
     use n0_future::time::Duration;
     use n0_snafu::{Error, Result, ResultExt};
+    use rand::SeedableRng;
     use tokio_util::task::AbortOnDropHandle;
     use tracing_test::traced_test;
 
@@ -985,13 +994,14 @@ mod test_dns_pkarr {
     #[tokio::test]
     #[traced_test]
     async fn dns_resolve() -> Result<()> {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let origin = "testdns.example".to_string();
         let state = State::new(origin.clone());
         let (nameserver, _dns_drop_guard) = run_dns_server(state.clone())
             .await
             .context("Running DNS server")?;
 
-        let secret_key = SecretKey::generate(rand::rng());
+        let secret_key = SecretKey::generate(&mut rng);
         let node_info = NodeInfo::new(secret_key.public())
             .with_relay_url(Some("https://relay.example".parse().unwrap()));
         let signed_packet = node_info.to_pkarr_signed_packet(&secret_key, 30)?;
@@ -1013,12 +1023,13 @@ mod test_dns_pkarr {
     #[traced_test]
     async fn pkarr_publish_dns_resolve() -> Result<()> {
         let origin = "testdns.example".to_string();
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
 
         let dns_pkarr_server = DnsPkarrServer::run_with_origin(origin.clone())
             .await
             .context("DnsPkarrServer")?;
 
-        let secret_key = SecretKey::generate(rand::rng());
+        let secret_key = SecretKey::generate(&mut rng);
         let node_id = secret_key.public();
 
         let relay_url = Some("https://relay.example".parse().unwrap());
@@ -1076,7 +1087,8 @@ mod test_dns_pkarr {
         relay_map: &RelayMap,
         dns_pkarr_server: &DnsPkarrServer,
     ) -> Result<(Endpoint, AbortOnDropHandle<Result<()>>)> {
-        let secret_key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let secret_key = SecretKey::generate(&mut rng);
         let ep = Endpoint::builder()
             .relay_mode(RelayMode::Custom(relay_map.clone()))
             .insecure_skip_relay_cert_verify(true)
diff --git a/iroh/src/discovery/mdns.rs b/iroh/src/discovery/mdns.rs
index 91140b63755..0bc2c88180e 100644
--- a/iroh/src/discovery/mdns.rs
+++ b/iroh/src/discovery/mdns.rs
@@ -532,6 +532,7 @@ mod tests {
         use iroh_base::SecretKey;
         use n0_future::StreamExt;
         use n0_snafu::{Error, Result, ResultExt};
+        use rand::{CryptoRng, SeedableRng};
         use snafu::whatever;
         use tracing_test::traced_test;
 
@@ -541,10 +542,12 @@ mod tests {
         #[tokio::test]
         #[traced_test]
         async fn mdns_publish_resolve() -> Result {
+            let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
             // Create discoverer A with advertise=false (only listens)
-            let (_, discovery_a) = make_discoverer(false)?;
+            let (_, discovery_a) = make_discoverer(&mut rng, false)?;
             // Create discoverer B with advertise=true (will broadcast)
-            let (node_id_b, discovery_b) = make_discoverer(true)?;
+            let (node_id_b, discovery_b) = make_discoverer(&mut rng, true)?;
 
             // make addr info for discoverer b
             let user_data: UserData = "foobar".parse()?;
@@ -593,8 +596,9 @@ mod tests {
         #[tokio::test]
         #[traced_test]
         async fn mdns_publish_expire() -> Result {
-            let (_, discovery_a) = make_discoverer(false)?;
-            let (node_id_b, discovery_b) = make_discoverer(true)?;
+            let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+            let (_, discovery_a) = make_discoverer(&mut rng, false)?;
+            let (node_id_b, discovery_b) = make_discoverer(&mut rng, true)?;
 
             // publish discovery_b's address
             let node_data = NodeData::new(None, BTreeSet::from(["0.0.0.0:11111".parse().unwrap()]))
@@ -648,15 +652,17 @@ mod tests {
         #[tokio::test]
         #[traced_test]
         async fn mdns_subscribe() -> Result {
+            let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
             let num_nodes = 5;
             let mut node_ids = BTreeSet::new();
             let mut discoverers = vec![];
 
-            let (_, discovery) = make_discoverer(false)?;
+            let (_, discovery) = make_discoverer(&mut rng, false)?;
             let node_data = NodeData::new(None, BTreeSet::from(["0.0.0.0:11111".parse().unwrap()]));
 
             for i in 0..num_nodes {
-                let (node_id, discovery) = make_discoverer(true)?;
+                let (node_id, discovery) = make_discoverer(&mut rng, true)?;
                 let user_data: UserData = format!("node{i}").parse()?;
                 let node_data = node_data.clone().with_user_data(Some(user_data.clone()));
                 node_ids.insert((node_id, Some(user_data)));
@@ -693,10 +699,12 @@ mod tests {
         #[tokio::test]
         #[traced_test]
         async fn non_advertising_node_not_discovered() -> Result {
-            let (_, discovery_a) = make_discoverer(false)?;
-            let (node_id_b, discovery_b) = make_discoverer(false)?;
+            let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
+            let (_, discovery_a) = make_discoverer(&mut rng, false)?;
+            let (node_id_b, discovery_b) = make_discoverer(&mut rng, false)?;
 
-            let (node_id_c, discovery_c) = make_discoverer(true)?;
+            let (node_id_c, discovery_c) = make_discoverer(&mut rng, true)?;
             let node_data_c =
                 NodeData::new(None, BTreeSet::from(["0.0.0.0:22222".parse().unwrap()]));
             discovery_c.publish(&node_data_c);
@@ -719,16 +727,6 @@ mod tests {
             Ok(())
         }
 
-        fn make_discoverer(advertise: bool) -> Result<(PublicKey, MdnsDiscovery)> {
-            let node_id = SecretKey::generate(rand::thread_rng()).public();
-            Ok((
-                node_id,
-                MdnsDiscovery::builder()
-                    .advertise(advertise)
-                    .build(node_id)?,
-            ))
-        }
-
         #[tokio::test]
         #[traced_test]
         async fn test_service_names() -> Result {
@@ -786,5 +784,18 @@ mod tests {
 
             Ok(())
         }
+
+        fn make_discoverer<R: CryptoRng + ?Sized>(
+            rng: &mut R,
+            advertise: bool,
+        ) -> Result<(PublicKey, MdnsDiscovery)> {
+            let node_id = SecretKey::generate(rng).public();
+            Ok((
+                node_id,
+                MdnsDiscovery::builder()
+                    .advertise(advertise)
+                    .build(node_id)?,
+            ))
+        }
     }
 }
diff --git a/iroh/src/endpoint.rs b/iroh/src/endpoint.rs
index 5c962795e38..df271eabad6 100644
--- a/iroh/src/endpoint.rs
+++ b/iroh/src/endpoint.rs
@@ -151,10 +151,11 @@ impl Builder {
 
     /// Binds the magic endpoint.
     pub async fn bind(self) -> Result<Endpoint, BindError> {
+        let mut rng = rand::rng();
         let relay_map = self.relay_mode.relay_map();
         let secret_key = self
             .secret_key
-            .unwrap_or_else(|| SecretKey::generate(rand::rng()));
+            .unwrap_or_else(move || SecretKey::generate(&mut rng));
         let static_config = StaticConfig {
             transport_config: Arc::new(self.transport_config),
             tls_config: tls::TlsConfig::new(secret_key.clone(), self.max_tls_tickets),
@@ -2261,8 +2262,9 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn endpoint_connect_close() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let (relay_map, relay_url, _guard) = run_relay_server().await?;
-        let server_secret_key = SecretKey::generate(rand::rng());
+        let server_secret_key = SecretKey::generate(&mut rng);
         let server_peer_id = server_secret_key.public();
 
         // Wait for the endpoint to be started to make sure it's up before clients try to connect
diff --git a/iroh/src/key.rs b/iroh/src/key.rs
index 31539914cf6..a589e21a52c 100644
--- a/iroh/src/key.rs
+++ b/iroh/src/key.rs
@@ -81,6 +81,8 @@ impl SharedSecret {
 
 #[cfg(test)]
 mod tests {
+    use rand::SeedableRng;
+
     use super::*;
 
     fn shared(this: &iroh_base::SecretKey, other: &iroh_base::PublicKey) -> SharedSecret {
@@ -129,7 +131,8 @@ mod tests {
 
     #[test]
     fn test_same_public_key_api() {
-        let key = iroh_base::SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let key = iroh_base::SecretKey::generate(&mut rng);
         let public_key1: crypto_box::PublicKey = public_ed_box(&key.public().public());
         let public_key2: crypto_box::PublicKey = secret_ed_box(key.secret()).public_key();
 
diff --git a/iroh/src/magicsock.rs b/iroh/src/magicsock.rs
index 1b334131e38..bd3feae25ac 100644
--- a/iroh/src/magicsock.rs
+++ b/iroh/src/magicsock.rs
@@ -2520,7 +2520,7 @@ mod tests {
     use n0_snafu::{Result, ResultExt};
     use n0_watcher::Watcher;
     use quinn::ServerConfig;
-    use rand::{Rng, RngCore};
+    use rand::{Rng, RngCore, SeedableRng};
     use tokio::task::JoinSet;
     use tokio_util::task::AbortOnDropHandle;
     use tracing::{Instrument, error, info, info_span, instrument};
@@ -2539,7 +2539,8 @@ mod tests {
 
     impl Default for Options {
         fn default() -> Self {
-            let secret_key = SecretKey::generate(rand::rng());
+            let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+            let secret_key = SecretKey::generate(&mut rng);
             let server_config = make_default_server_config(&secret_key);
             Options {
                 addr_v4: None,
@@ -2592,7 +2593,8 @@ mod tests {
 
     impl MagicStack {
         async fn new(relay_mode: RelayMode) -> Self {
-            let secret_key = SecretKey::generate(rand::rng());
+            let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+            let secret_key = SecretKey::generate(&mut rng);
 
             let mut transport_config = quinn::TransportConfig::default();
             transport_config.max_idle_timeout(Some(Duration::from_secs(10).try_into().unwrap()));
diff --git a/iroh/src/magicsock/node_map.rs b/iroh/src/magicsock/node_map.rs
index 445574428b7..1f3b4dce2de 100644
--- a/iroh/src/magicsock/node_map.rs
+++ b/iroh/src/magicsock/node_map.rs
@@ -719,6 +719,7 @@ mod tests {
     use std::net::Ipv4Addr;
 
     use iroh_base::SecretKey;
+    use rand::SeedableRng;
     use tracing_test::traced_test;
 
     use super::{node_state::MAX_INACTIVE_DIRECT_ADDRESSES, *};
@@ -812,7 +813,8 @@ mod tests {
     #[traced_test]
     fn test_prune_direct_addresses() {
         let node_map = NodeMap::default();
-        let public_key = SecretKey::generate(rand::rng()).public();
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let public_key = SecretKey::generate(&mut rng).public();
         let id = node_map
             .inner
             .lock()
@@ -885,8 +887,10 @@ mod tests {
     #[test]
     fn test_prune_inactive() {
         let node_map = NodeMap::default();
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         // add one active node and more than MAX_INACTIVE_NODES inactive nodes
-        let active_node = SecretKey::generate(rand::rng()).public();
+        let active_node = SecretKey::generate(&mut rng).public();
         let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 167);
         node_map.add_test_addr(NodeAddr::new(active_node).with_direct_addresses([addr]));
         node_map
@@ -897,7 +901,7 @@ mod tests {
             .expect("registered");
 
         for _ in 0..MAX_INACTIVE_NODES + 1 {
-            let node = SecretKey::generate(rand::rng()).public();
+            let node = SecretKey::generate(&mut rng).public();
             node_map.add_test_addr(NodeAddr::new(node));
         }
 
diff --git a/iroh/src/magicsock/node_map/node_state.rs b/iroh/src/magicsock/node_map/node_state.rs
index 11aacfb1ac4..e7a74a1813c 100644
--- a/iroh/src/magicsock/node_map/node_state.rs
+++ b/iroh/src/magicsock/node_map/node_state.rs
@@ -1417,6 +1417,7 @@ mod tests {
     use std::{collections::BTreeMap, net::Ipv4Addr};
 
     use iroh_base::SecretKey;
+    use rand::SeedableRng;
 
     use super::*;
     use crate::magicsock::node_map::{NodeMap, NodeMapInner};
@@ -1443,9 +1444,11 @@ mod tests {
             Some((url, relay_state))
         };
 
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         // endpoint with a `best_addr` that has a latency but no relay
         let (a_endpoint, a_socket_addr) = {
-            let key = SecretKey::generate(rand::rng());
+            let key = SecretKey::generate(&mut rng);
             let node_id = key.public();
             let ip_port = IpPort {
                 ip: Ipv4Addr::UNSPECIFIED.into(),
@@ -1488,7 +1491,7 @@ mod tests {
         // endpoint w/ no best addr but a relay w/ latency
         let b_endpoint = {
             // let socket_addr = "0.0.0.0:9".parse().unwrap();
-            let key = SecretKey::generate(rand::rng());
+            let key = SecretKey::generate(&mut rng);
             NodeState {
                 id: 1,
                 quic_mapped_addr: NodeIdMappedAddr::generate(),
@@ -1509,7 +1512,7 @@ mod tests {
         // endpoint w/ no best addr but a relay w/ no latency
         let c_endpoint = {
             // let socket_addr = "0.0.0.0:8".parse().unwrap();
-            let key = SecretKey::generate(rand::rng());
+            let key = SecretKey::generate(&mut rng);
             NodeState {
                 id: 2,
                 quic_mapped_addr: NodeIdMappedAddr::generate(),
@@ -1538,7 +1541,7 @@ mod tests {
         // endpoint w/ expired best addr and relay w/ latency
         let (d_endpoint, d_socket_addr) = {
             let socket_addr: SocketAddr = "0.0.0.0:7".parse().unwrap();
-            let key = SecretKey::generate(rand::rng());
+            let key = SecretKey::generate(&mut rng);
             let node_id = key.public();
             let endpoint_state = BTreeMap::from([(
                 IpPort::from(socket_addr),
@@ -1684,8 +1687,9 @@ mod tests {
     fn test_prune_direct_addresses() {
         // When we handle a call-me-maybe with more than MAX_INACTIVE_DIRECT_ADDRESSES we do
         // not want to prune them right away but send pings to all of them.
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
 
-        let key = SecretKey::generate(rand::rng());
+        let key = SecretKey::generate(&mut rng);
         let opts = Options {
             node_id: key.public(),
             relay_url: None,
diff --git a/iroh/src/tls/name.rs b/iroh/src/tls/name.rs
index 2f02a6c6c72..2b7c7be26a9 100644
--- a/iroh/src/tls/name.rs
+++ b/iroh/src/tls/name.rs
@@ -35,10 +35,12 @@ pub(crate) fn decode(name: &str) -> Option<NodeId> {
 #[cfg(test)]
 mod tests {
     use iroh_base::SecretKey;
+    use rand::SeedableRng;
 
     #[test]
     fn test_roundtrip() {
-        let key = SecretKey::generate(rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let key = SecretKey::generate(&mut rng);
         let node_id = key.public();
         println!("{}", super::encode(node_id));
         assert_eq!(Some(node_id), super::decode(&super::encode(node_id)));

From d30ec2354e31f87228e96a5927a9281c033d6a74 Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Tue, 30 Sep 2025 09:53:19 +0200
Subject: [PATCH 07/16] test: fixup randomness

---
 iroh/src/discovery.rs | 14 ++++---
 iroh/src/magicsock.rs | 87 ++++++++++++++++++++++---------------------
 2 files changed, 53 insertions(+), 48 deletions(-)

diff --git a/iroh/src/discovery.rs b/iroh/src/discovery.rs
index ae8786bd036..e984b350916 100644
--- a/iroh/src/discovery.rs
+++ b/iroh/src/discovery.rs
@@ -975,7 +975,7 @@ mod test_dns_pkarr {
     use iroh_relay::{RelayMap, node_info::UserData};
     use n0_future::time::Duration;
     use n0_snafu::{Error, Result, ResultExt};
-    use rand::SeedableRng;
+    use rand::{CryptoRng, SeedableRng};
     use tokio_util::task::AbortOnDropHandle;
     use tracing_test::traced_test;
 
@@ -1066,11 +1066,13 @@ mod test_dns_pkarr {
     #[tokio::test]
     #[traced_test]
     async fn pkarr_publish_dns_discover() -> Result<()> {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
         let dns_pkarr_server = DnsPkarrServer::run().await.context("DnsPkarrServer run")?;
         let (relay_map, _relay_url, _relay_guard) = run_relay_server().await?;
 
-        let (ep1, _guard1) = ep_with_discovery(&relay_map, &dns_pkarr_server).await?;
-        let (ep2, _guard2) = ep_with_discovery(&relay_map, &dns_pkarr_server).await?;
+        let (ep1, _guard1) = ep_with_discovery(&mut rng, &relay_map, &dns_pkarr_server).await?;
+        let (ep2, _guard2) = ep_with_discovery(&mut rng, &relay_map, &dns_pkarr_server).await?;
 
         // wait until our shared state received the update from pkarr publishing
         dns_pkarr_server
@@ -1083,12 +1085,12 @@ mod test_dns_pkarr {
         Ok(())
     }
 
-    async fn ep_with_discovery(
+    async fn ep_with_discovery<R: CryptoRng + ?Sized>(
+        rng: &mut R,
         relay_map: &RelayMap,
         dns_pkarr_server: &DnsPkarrServer,
     ) -> Result<(Endpoint, AbortOnDropHandle<Result<()>>)> {
-        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
-        let secret_key = SecretKey::generate(&mut rng);
+        let secret_key = SecretKey::generate(rng);
         let ep = Endpoint::builder()
             .relay_mode(RelayMode::Custom(relay_map.clone()))
             .insecure_skip_relay_cert_verify(true)
diff --git a/iroh/src/magicsock.rs b/iroh/src/magicsock.rs
index bd3feae25ac..061fd51261e 100644
--- a/iroh/src/magicsock.rs
+++ b/iroh/src/magicsock.rs
@@ -2520,7 +2520,7 @@ mod tests {
     use n0_snafu::{Result, ResultExt};
     use n0_watcher::Watcher;
     use quinn::ServerConfig;
-    use rand::{Rng, RngCore, SeedableRng};
+    use rand::{CryptoRng, Rng, RngCore, SeedableRng};
     use tokio::task::JoinSet;
     use tokio_util::task::AbortOnDropHandle;
     use tracing::{Instrument, error, info, info_span, instrument};
@@ -2537,27 +2537,24 @@ mod tests {
 
     const ALPN: &[u8] = b"n0/test/1";
 
-    impl Default for Options {
-        fn default() -> Self {
-            let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
-            let secret_key = SecretKey::generate(&mut rng);
-            let server_config = make_default_server_config(&secret_key);
-            Options {
-                addr_v4: None,
-                addr_v6: None,
-                secret_key,
-                relay_map: RelayMap::empty(),
-                discovery: Default::default(),
-                proxy_url: None,
-                dns_resolver: DnsResolver::new(),
-                server_config,
-                #[cfg(any(test, feature = "test-utils"))]
-                insecure_skip_relay_cert_verify: false,
-                #[cfg(any(test, feature = "test-utils"))]
-                path_selection: PathSelection::default(),
-                discovery_user_data: None,
-                metrics: Default::default(),
-            }
+    fn default_options<R: CryptoRng + ?Sized>(rng: &mut R) -> Options {
+        let secret_key = SecretKey::generate(rng);
+        let server_config = make_default_server_config(&secret_key);
+        Options {
+            addr_v4: None,
+            addr_v6: None,
+            secret_key,
+            relay_map: RelayMap::empty(),
+            discovery: Default::default(),
+            proxy_url: None,
+            dns_resolver: DnsResolver::new(),
+            server_config,
+            #[cfg(any(test, feature = "test-utils"))]
+            insecure_skip_relay_cert_verify: false,
+            #[cfg(any(test, feature = "test-utils"))]
+            path_selection: PathSelection::default(),
+            discovery_user_data: None,
+            metrics: Default::default(),
         }
     }
 
@@ -2592,9 +2589,8 @@ mod tests {
     }
 
     impl MagicStack {
-        async fn new(relay_mode: RelayMode) -> Self {
-            let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
-            let secret_key = SecretKey::generate(&mut rng);
+        async fn new<R: CryptoRng + ?Sized>(rng: &mut R, relay_mode: RelayMode) -> Self {
+            let secret_key = SecretKey::generate(rng);
 
             let mut transport_config = quinn::TransportConfig::default();
             transport_config.max_idle_timeout(Some(Duration::from_secs(10).try_into().unwrap()));
@@ -2843,8 +2839,9 @@ mod tests {
     #[tokio::test(flavor = "multi_thread")]
     #[traced_test]
     async fn test_two_devices_roundtrip_quinn_magic() -> Result {
-        let m1 = MagicStack::new(RelayMode::Disabled).await;
-        let m2 = MagicStack::new(RelayMode::Disabled).await;
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let m1 = MagicStack::new(&mut rng, RelayMode::Disabled).await;
+        let m2 = MagicStack::new(&mut rng, RelayMode::Disabled).await;
 
         let _guard = mesh_stacks(vec![m1.clone(), m2.clone()]).await?;
 
@@ -2867,7 +2864,7 @@ mod tests {
 
             info!("\n-- larger data");
             let mut data = vec![0u8; 10 * 1024];
-            rand::rng().fill_bytes(&mut data);
+            rng.fill_bytes(&mut data);
             run_roundtrip(m1.clone(), m2.clone(), &data, ExpectedLoss::AlmostNone).await;
             run_roundtrip(m2.clone(), m1.clone(), &data, ExpectedLoss::AlmostNone).await;
         }
@@ -2878,8 +2875,9 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_regression_network_change_rebind_wakes_connection_driver() -> n0_snafu::Result {
-        let m1 = MagicStack::new(RelayMode::Disabled).await;
-        let m2 = MagicStack::new(RelayMode::Disabled).await;
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let m1 = MagicStack::new(&mut rng, RelayMode::Disabled).await;
+        let m2 = MagicStack::new(&mut rng, RelayMode::Disabled).await;
 
         println!("Net change");
         m1.endpoint.magic_sock().force_network_change(true).await;
@@ -2927,13 +2925,14 @@ mod tests {
     /// Same structure as `test_two_devices_roundtrip_quinn_magic`, but interrupts regularly
     /// with (simulated) network changes.
     async fn test_two_devices_roundtrip_network_change_impl() -> Result {
-        let m1 = MagicStack::new(RelayMode::Disabled).await;
-        let m2 = MagicStack::new(RelayMode::Disabled).await;
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let m1 = MagicStack::new(&mut rng, RelayMode::Disabled).await;
+        let m2 = MagicStack::new(&mut rng, RelayMode::Disabled).await;
 
         let _guard = mesh_stacks(vec![m1.clone(), m2.clone()]).await?;
 
-        let offset = || {
-            let delay = rand::rng().random_range(10..=500);
+        let offset = |rng: &mut rand_chacha::ChaCha8Rng| {
+            let delay = rng.random_range(10..=500);
             Duration::from_millis(delay)
         };
         let rounds = 5;
@@ -2941,11 +2940,12 @@ mod tests {
         // Regular network changes to m1 only.
         let m1_network_change_guard = {
             let m1 = m1.clone();
+            let mut rng = rng.clone();
             let task = tokio::spawn(async move {
                 loop {
                     println!("[m1] network change");
                     m1.endpoint.magic_sock().force_network_change(true).await;
-                    time::sleep(offset()).await;
+                    time::sleep(offset(&mut rng)).await;
                 }
             });
             AbortOnDropHandle::new(task)
@@ -2958,7 +2958,7 @@ mod tests {
 
             println!("-- [m1 changes] larger data");
             let mut data = vec![0u8; 10 * 1024];
-            rand::rng().fill_bytes(&mut data);
+            rng.fill_bytes(&mut data);
             run_roundtrip(m1.clone(), m2.clone(), &data, ExpectedLoss::YeahSure).await;
             run_roundtrip(m2.clone(), m1.clone(), &data, ExpectedLoss::YeahSure).await;
         }
@@ -2968,11 +2968,12 @@ mod tests {
         // Regular network changes to m2 only.
         let m2_network_change_guard = {
             let m2 = m2.clone();
+            let mut rng = rng.clone();
             let task = tokio::spawn(async move {
                 loop {
                     println!("[m2] network change");
                     m2.endpoint.magic_sock().force_network_change(true).await;
-                    time::sleep(offset()).await;
+                    time::sleep(offset(&mut rng)).await;
                 }
             });
             AbortOnDropHandle::new(task)
@@ -3001,7 +3002,7 @@ mod tests {
                 m1.endpoint.magic_sock().force_network_change(true).await;
                 println!("-- [m2] network change");
                 m2.endpoint.magic_sock().force_network_change(true).await;
-                time::sleep(offset()).await;
+                time::sleep(offset(&mut rng)).await;
             });
             AbortOnDropHandle::new(task)
         };
@@ -3025,11 +3026,12 @@ mod tests {
     #[tokio::test(flavor = "multi_thread")]
     #[traced_test]
     async fn test_two_devices_setup_teardown() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         for i in 0..10 {
             println!("-- round {i}");
             println!("setting up magic stack");
-            let m1 = MagicStack::new(RelayMode::Disabled).await;
-            let m2 = MagicStack::new(RelayMode::Disabled).await;
+            let m1 = MagicStack::new(&mut rng, RelayMode::Disabled).await;
+            let m2 = MagicStack::new(&mut rng, RelayMode::Disabled).await;
 
             let _guard = mesh_stacks(vec![m1.clone(), m2.clone()]).await?;
 
@@ -3048,6 +3050,7 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn test_direct_addresses() {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let ms = Handle::new(Default::default()).await.unwrap();
 
         // See if we can get endpoints.
@@ -3360,8 +3363,8 @@ mod tests {
 
     #[tokio::test]
     async fn test_add_node_addr() -> Result {
-        let stack = MagicStack::new(RelayMode::Default).await;
-        let mut rng = rand::rng();
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let stack = MagicStack::new(&mut rng, RelayMode::Default).await;
 
         assert_eq!(stack.endpoint.magic_sock().node_map.node_count(), 0);
 

From 53e156821fd8438dd75a3135d541410db19ed9c8 Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Tue, 30 Sep 2025 10:30:50 +0200
Subject: [PATCH 08/16] fix minimal versions

---
 Cargo.lock                 | 20 ++++++++++----------
 iroh-base/Cargo.toml       |  4 ++--
 iroh-dns-server/Cargo.toml |  2 +-
 iroh-relay/Cargo.toml      |  2 +-
 iroh/Cargo.toml            |  2 +-
 iroh/bench/Cargo.toml      |  2 +-
 6 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ff108ca9924..9603aeb09f2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -102,9 +102,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.12"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c900954614442c827787a2ffcd8c0602eb53ff7b95a8fbfcdaf5e406197bf3be"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
 
 [[package]]
 name = "anstyle-parse"
@@ -943,7 +943,7 @@ dependencies = [
  "cfg-if",
  "cpufeatures",
  "curve25519-dalek-derive",
- "digest 0.11.0-rc.2",
+ "digest 0.11.0-rc.3",
  "fiat-crypto 0.3.0",
  "rand_core 0.9.3",
  "rustc_version",
@@ -1106,9 +1106,9 @@ dependencies = [
 
 [[package]]
 name = "digest"
-version = "0.11.0-rc.2"
+version = "0.11.0-rc.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6749b668519cd7149ee3d11286a442a8a8bdc3a9d529605f579777bfccc5a4bc"
+checksum = "dac89f8a64533a9b0eaa73a68e424db0fb1fd6271c74cc0125336a05f090568d"
 dependencies = [
  "block-buffer 0.11.0-rc.5",
  "crypto-common 0.2.0-rc.4",
@@ -2063,9 +2063,9 @@ dependencies = [
 
 [[package]]
 name = "hybrid-array"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bad028b20a90afcdb5e28a53392562f1db2bdfa238aa1a978b911461bfffb92"
+checksum = "f471e0a81b2f90ffc0cb2f951ae04da57de8baa46fa99112b062a5173a5088d0"
 dependencies = [
  "typenum",
  "zeroize",
@@ -4591,7 +4591,7 @@ checksum = "d1e3878ab0f98e35b2df35fe53201d088299b41a6bb63e3e34dada2ac4abd924"
 dependencies = [
  "cfg-if",
  "cpufeatures",
- "digest 0.11.0-rc.2",
+ "digest 0.11.0-rc.3",
 ]
 
 [[package]]
@@ -6465,9 +6465,9 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.8.1"
+version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
 
 [[package]]
 name = "zerotrie"
diff --git a/iroh-base/Cargo.toml b/iroh-base/Cargo.toml
index f33981fd529..208d90e00af 100644
--- a/iroh-base/Cargo.toml
+++ b/iroh-base/Cargo.toml
@@ -21,7 +21,7 @@ ed25519-dalek = { version = "=3.0.0-pre.1", features = ["serde", "rand_core", "z
 derive_more = { version = "2.0.1", features = ["display"], optional = true }
 url = { version = "2.5.3", features = ["serde"], optional = true }
 postcard = { version = "1", default-features = false, features = ["alloc", "use-std", "experimental-derive"], optional = true }
-rand_core = { version = "0.9", optional = true }
+rand_core = { version = "0.9.3", optional = true }
 serde = { version = "1", features = ["derive", "rc"] }
 snafu = { version = "0.8.5", features = ["rust_1_81"], optional = true }
 n0-snafu = "0.2.2"
@@ -30,7 +30,7 @@ nested_enum_utils = "0.2.0"
 [dev-dependencies]
 postcard = { version = "1", features = ["use-std"] }
 proptest = "1.0.0"
-rand = "0.9"
+rand = "0.9.2"
 rand_chacha = "0.9"
 serde_json = "1"
 serde_test = "1"
diff --git a/iroh-dns-server/Cargo.toml b/iroh-dns-server/Cargo.toml
index 841d3102239..1f279ed79bf 100644
--- a/iroh-dns-server/Cargo.toml
+++ b/iroh-dns-server/Cargo.toml
@@ -64,7 +64,7 @@ criterion = "0.5.1"
 data-encoding = "2.3.3"
 hickory-resolver = "0.25.0"
 iroh = { path = "../iroh" }
-rand = "0.9"
+rand = "0.9.2"
 rand_chacha = "0.9"
 tracing-test = "0.2.5"
 
diff --git a/iroh-relay/Cargo.toml b/iroh-relay/Cargo.toml
index da62eac8655..ced0ccbfdac 100644
--- a/iroh-relay/Cargo.toml
+++ b/iroh-relay/Cargo.toml
@@ -44,7 +44,7 @@ postcard = { version = "1", default-features = false, features = [
 ] }
 quinn = { package = "iroh-quinn", version = "0.14.0", default-features = false, features = ["rustls-ring"] }
 quinn-proto = { package = "iroh-quinn-proto", version = "0.13.0" }
-rand = "0.9"
+rand = "0.9.2"
 reqwest = { version = "0.12", default-features = false, features = [
     "rustls-tls",
 ] }
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index 0d734c3bb32..650b97eb5ba 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -51,7 +51,7 @@ pkarr = { version = "4", default-features = false, features = [
 quinn = { package = "iroh-quinn", version = "0.14.0", default-features = false, features = ["rustls-ring"] }
 quinn-proto = { package = "iroh-quinn-proto", version = "0.13.0" }
 quinn-udp = { package = "iroh-quinn-udp", version = "0.5.7" }
-rand = "0.9"
+rand = "0.9.2"
 reqwest = { version = "0.12", default-features = false, features = [
     "rustls-tls",
     "stream",
diff --git a/iroh/bench/Cargo.toml b/iroh/bench/Cargo.toml
index 4bda4e2f2af..5763521ae6b 100644
--- a/iroh/bench/Cargo.toml
+++ b/iroh/bench/Cargo.toml
@@ -13,7 +13,7 @@ iroh-metrics = "0.35"
 n0-future = "0.1.1"
 n0-snafu = "0.2.0"
 quinn = { package = "iroh-quinn", version = "0.14" }
-rand = "0.9"
+rand = "0.9.2"
 rcgen = "0.14"
 rustls = { version = "0.23", default-features = false, features = ["ring"] }
 clap = { version = "4", features = ["derive"] }

From 04af24fc1dc95adeff49d33c73a51bcad415a93b Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Tue, 30 Sep 2025 10:52:22 +0200
Subject: [PATCH 09/16] deduplicate more deps

---
 Cargo.lock      | 151 ++++++++++--------------------------------------
 Cargo.toml      |   1 +
 iroh/Cargo.toml |   4 +-
 3 files changed, 34 insertions(+), 122 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 9603aeb09f2..c92928fb966 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -708,12 +708,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "const-oid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
-
 [[package]]
 name = "const-oid"
 version = "0.10.1"
@@ -896,7 +890,7 @@ dependencies = [
  "aead",
  "chacha20",
  "crypto_secretbox",
- "curve25519-dalek 5.0.0-pre.1",
+ "curve25519-dalek",
  "salsa20",
  "serdect",
  "subtle",
@@ -918,22 +912,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "curve25519-dalek"
-version = "4.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "curve25519-dalek-derive",
- "digest 0.10.7",
- "fiat-crypto 0.2.9",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "curve25519-dalek"
 version = "5.0.0-pre.1"
@@ -944,7 +922,7 @@ dependencies = [
  "cpufeatures",
  "curve25519-dalek-derive",
  "digest 0.11.0-rc.3",
- "fiat-crypto 0.3.0",
+ "fiat-crypto",
  "rand_core 0.9.3",
  "rustc_version",
  "serde",
@@ -983,24 +961,14 @@ version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
 
-[[package]]
-name = "der"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
-dependencies = [
- "const-oid 0.9.6",
- "der_derive",
- "zeroize",
-]
-
 [[package]]
 name = "der"
 version = "0.8.0-rc.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9d8dd2f26c86b27a2a8ea2767ec7f9df7a89516e4794e54ac01ee618dda3aa4"
 dependencies = [
- "const-oid 0.10.1",
+ "const-oid",
+ "der_derive",
  "pem-rfc7468",
  "zeroize",
 ]
@@ -1021,9 +989,9 @@ dependencies = [
 
 [[package]]
 name = "der_derive"
-version = "0.7.3"
+version = "0.8.0-rc.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
+checksum = "be645fee2afe89d293b96c19e4456e6ac69520fc9c6b8a58298550138e361ffe"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1172,39 +1140,15 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
-[[package]]
-name = "ed25519"
-version = "2.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
-dependencies = [
- "pkcs8 0.10.2",
- "signature 2.2.0",
-]
-
 [[package]]
 name = "ed25519"
 version = "3.0.0-rc.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ef49c0b20c0ad088893ad2a790a29c06a012b3f05bcfc66661fd22a94b32129"
 dependencies = [
- "pkcs8 0.11.0-rc.7",
+ "pkcs8",
  "serde",
- "signature 3.0.0-rc.4",
-]
-
-[[package]]
-name = "ed25519-dalek"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
-dependencies = [
- "curve25519-dalek 4.1.3",
- "ed25519 2.2.3",
- "serde",
- "sha2 0.10.9",
- "subtle",
- "zeroize",
+ "signature",
 ]
 
 [[package]]
@@ -1213,12 +1157,12 @@ version = "3.0.0-pre.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad207ed88a133091f83224265eac21109930db09bedcad05d5252f2af2de20a1"
 dependencies = [
- "curve25519-dalek 5.0.0-pre.1",
- "ed25519 3.0.0-rc.1",
+ "curve25519-dalek",
+ "ed25519",
  "rand_core 0.9.3",
  "serde",
  "sha2 0.11.0-rc.2",
- "signature 3.0.0-rc.4",
+ "signature",
  "subtle",
  "zeroize",
 ]
@@ -1316,12 +1260,6 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
-[[package]]
-name = "fiat-crypto"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-
 [[package]]
 name = "fiat-crypto"
 version = "0.3.0"
@@ -2387,9 +2325,9 @@ dependencies = [
  "console_error_panic_hook",
  "crypto_box",
  "data-encoding",
- "der 0.7.10",
+ "der",
  "derive_more 2.0.1",
- "ed25519-dalek 3.0.0-pre.1",
+ "ed25519-dalek",
  "futures-buffered",
  "futures-util",
  "getrandom 0.3.3",
@@ -2427,7 +2365,6 @@ dependencies = [
  "serde_json",
  "smallvec",
  "snafu",
- "spki 0.7.3",
  "strum 0.27.2",
  "stun-rs",
  "surge-ping",
@@ -2451,10 +2388,10 @@ dependencies = [
 name = "iroh-base"
 version = "0.92.0"
 dependencies = [
- "curve25519-dalek 5.0.0-pre.1",
+ "curve25519-dalek",
  "data-encoding",
  "derive_more 2.0.1",
- "ed25519-dalek 3.0.0-pre.1",
+ "ed25519-dalek",
  "n0-snafu",
  "nested_enum_utils",
  "postcard",
@@ -2511,7 +2448,7 @@ dependencies = [
  "humantime-serde",
  "iroh",
  "iroh-metrics",
- "lru",
+ "lru 0.13.0",
  "n0-future",
  "n0-snafu",
  "pkarr",
@@ -2653,7 +2590,7 @@ dependencies = [
  "iroh-metrics",
  "iroh-quinn",
  "iroh-quinn-proto",
- "lru",
+ "lru 0.13.0",
  "n0-future",
  "n0-snafu",
  "nested_enum_utils",
@@ -2845,6 +2782,12 @@ dependencies = [
  "hashbrown 0.15.5",
 ]
 
+[[package]]
+name = "lru"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfe949189f46fabb938b3a9a0be30fdd93fd8a09260da863399a8cf3db756ec8"
+
 [[package]]
 name = "lru-slab"
 version = "0.1.2"
@@ -2854,17 +2797,16 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 [[package]]
 name = "mainline"
 version = "5.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c258b001fa52b7270dc1a239b36a9b608b024e68733648c1757b025204fdc248"
+source = "git+https://github.com/dignifiedquire/mainline?branch=feat-rand-09#542e92333f4f061c2f712ff6096ca0c9a031121f"
 dependencies = [
  "crc",
  "document-features",
  "dyn-clone",
- "ed25519-dalek 2.2.0",
+ "ed25519-dalek",
  "flume",
  "futures-lite",
- "getrandom 0.2.16",
- "lru",
+ "getrandom 0.3.3",
+ "lru 0.16.1",
  "serde",
  "serde_bencode",
  "serde_bytes",
@@ -3499,12 +3441,12 @@ dependencies = [
  "cfg_aliases",
  "document-features",
  "dyn-clone",
- "ed25519-dalek 3.0.0-pre.1",
+ "ed25519-dalek",
  "futures-buffered",
  "futures-lite",
  "getrandom 0.3.3",
  "log",
- "lru",
+ "lru 0.13.0",
  "mainline",
  "ntimestamp",
  "reqwest",
@@ -3519,24 +3461,14 @@ dependencies = [
  "wasm-bindgen-futures",
 ]
 
-[[package]]
-name = "pkcs8"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
-dependencies = [
- "der 0.7.10",
- "spki 0.7.3",
-]
-
 [[package]]
 name = "pkcs8"
 version = "0.11.0-rc.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "93eac55f10aceed84769df670ea4a32d2ffad7399400d41ee1c13b1cd8e1b478"
 dependencies = [
- "der 0.8.0-rc.9",
- "spki 0.8.0-rc.4",
+ "der",
+ "spki",
 ]
 
 [[package]]
@@ -4618,15 +4550,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "signature"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "signature"
 version = "3.0.0-rc.4"
@@ -4732,16 +4655,6 @@ dependencies = [
  "lock_api",
 ]
 
-[[package]]
-name = "spki"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
-dependencies = [
- "base64ct",
- "der 0.7.10",
-]
-
 [[package]]
 name = "spki"
 version = "0.8.0-rc.4"
@@ -4749,7 +4662,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8baeff88f34ed0691978ec34440140e1572b68c7dd4a495fd14a3dc1944daa80"
 dependencies = [
  "base64ct",
- "der 0.8.0-rc.9",
+ "der",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 1f529020c47..c65f76ef913 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,3 +44,4 @@ unused-async = "warn"
 
 [patch.crates-io]
 crypto_box = { git = "https://github.com/dignifiedquire/nacl-compat", branch = "rand-09" }
+mainline = { git = "https://github.com/dignifiedquire/mainline", branch = "feat-rand-09" }
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index 650b97eb5ba..b09a116f953 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -26,7 +26,7 @@ backon = { version = "1.4" }
 bytes = "1.7"
 crypto_box = { version = "0.9.1", features = ["serde", "chacha20"] }
 data-encoding = "2.2"
-der = { version = "0.7", features = ["alloc", "derive"] }
+der = { version = "0.8.0-rc.9", features = ["alloc", "derive"] }
 derive_more = { version = "2.0.1", features = [
     "debug",
     "display",
@@ -81,8 +81,6 @@ z32 = "1.0.3"
 # fix minimal versions
 # for n0-futures
 futures-buffered = "0.2.11"
-# for ed25519-dalek
-spki = { version = "0.7.3", features = ["std"] }
 
 # metrics
 iroh-metrics = { version = "0.35", default-features = false }

From 0168670e72d4ce5e90b6f31120f626ebf79514eb Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Thu, 2 Oct 2025 12:23:21 +0200
Subject: [PATCH 10/16] fixup rebase

---
 iroh/src/discovery/mdns.rs | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/iroh/src/discovery/mdns.rs b/iroh/src/discovery/mdns.rs
index 0bc2c88180e..fe28ccdf525 100644
--- a/iroh/src/discovery/mdns.rs
+++ b/iroh/src/discovery/mdns.rs
@@ -730,21 +730,23 @@ mod tests {
         #[tokio::test]
         #[traced_test]
         async fn test_service_names() -> Result {
+            let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+
             // Create a discovery service using the default
             // service name
-            let id_a = SecretKey::generate(rand::rng()).public();
+            let id_a = SecretKey::generate(&mut rng).public();
             let discovery_a = MdnsDiscovery::builder().build(id_a)?;
 
             // Create a discovery service using a custom
             // service name
-            let id_b = SecretKey::generate(rand::rng()).public();
+            let id_b = SecretKey::generate(&mut rng).public();
             let discovery_b = MdnsDiscovery::builder()
                 .service_name("different.name")
                 .build(id_b)?;
 
             // Create a discovery service using the same
             // custom service name
-            let id_c = SecretKey::generate(rand::rng()).public();
+            let id_c = SecretKey::generate(&mut rng).public();
             let discovery_c = MdnsDiscovery::builder()
                 .service_name("different.name")
                 .build(id_c)?;

From 93003117f47265f024bfece9fe7885e40c5cd970 Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Thu, 2 Oct 2025 12:26:05 +0200
Subject: [PATCH 11/16] minimal versions fix

---
 iroh/Cargo.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index b09a116f953..9901d8b8caf 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -81,6 +81,7 @@ z32 = "1.0.3"
 # fix minimal versions
 # for n0-futures
 futures-buffered = "0.2.11"
+pkcs8 = "0.11.0-rc.7"
 
 # metrics
 iroh-metrics = { version = "0.35", default-features = false }

From 46ac7e7ecdf997447e0420fd580ab3cc85966ffd Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Mon, 6 Oct 2025 10:20:24 +0200
Subject: [PATCH 12/16] cleanup and update to non patched versions

---
 Cargo.lock                 | 359 +++++++++++++++++++++++++++++--------
 Cargo.toml                 |   5 -
 iroh-dns-server/Cargo.toml |   2 +-
 iroh-relay/Cargo.toml      |   2 +-
 iroh/Cargo.toml            |   6 +-
 iroh/src/discovery.rs      |   5 +-
 iroh/src/endpoint.rs       |  16 +-
 iroh/src/key.rs            |   2 +-
 iroh/src/magicsock.rs      |   2 +-
 9 files changed, 293 insertions(+), 106 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c92928fb966..c02201fd3de 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -31,6 +31,16 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common 0.1.6",
+ "generic-array",
+]
+
 [[package]]
 name = "aead"
 version = "0.6.0-rc.2"
@@ -39,7 +49,7 @@ checksum = "ac8202ab55fcbf46ca829833f347a82a2a4ce0596f0304ac322c2d100030cd56"
 dependencies = [
  "bytes",
  "crypto-common 0.2.0-rc.4",
- "inout",
+ "inout 0.2.0-rc.6",
 ]
 
 [[package]]
@@ -87,9 +97,9 @@ checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
 
 [[package]]
 name = "anstream"
-version = "0.6.20"
+version = "0.6.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae563653d1938f79b1ab1b5e668c87c76a9930414574a6583a7b7e11a8e6192"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -277,9 +287,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "axum"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98e529aee37b5c8206bb4bf4c44797127566d72f76952c970bd3d1e85de8f4e2"
+checksum = "8a18ed336352031311f4e0b4dd2ff392d4fbb370777c9d18d7fc9d7359f73871"
 dependencies = [
  "axum-core",
  "axum-macros",
@@ -311,9 +321,9 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.5.4"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ac7a6beb1182c7e30253ee75c3e918080bfb83f5a3023bcdf7209d85fd147e6"
+checksum = "59446ce19cd142f8833f856eb31f3eb097812d1479ab224f54d72428ca21ea22"
 dependencies = [
  "bytes",
  "futures-core",
@@ -393,6 +403,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base16ct"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b59d472eab27ade8d770dcb11da7201c11234bef9f82ce7aa517be028d462b"
+
 [[package]]
 name = "base32"
 version = "0.5.1"
@@ -520,9 +536,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.2.39"
+version = "1.2.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1354349954c6fc9cb0deab020f27f783cf0b604e8bb754dc4658ecf0d29c35f"
+checksum = "e1d05d92f4b1fd76aad469d46cdd858ca761576082cd37df81416691e50199fb"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -546,6 +562,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher 0.4.4",
+ "cpufeatures",
+]
+
 [[package]]
 name = "chacha20"
 version = "0.10.0-rc.2"
@@ -553,7 +580,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9bd162f2b8af3e0639d83f28a637e4e55657b7a74508dba5a9bf4da523d5c9e9"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.5.0-rc.1",
  "cpufeatures",
  "zeroize",
 ]
@@ -597,6 +624,17 @@ dependencies = [
  "half",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common 0.1.6",
+ "inout 0.1.4",
+ "zeroize",
+]
+
 [[package]]
 name = "cipher"
 version = "0.5.0-rc.1"
@@ -605,7 +643,7 @@ checksum = "1e12a13eb01ded5d32ee9658d94f553a19e804204f2dc811df69ab4d9e0cb8c7"
 dependencies = [
  "block-buffer 0.11.0-rc.5",
  "crypto-common 0.2.0-rc.4",
- "inout",
+ "inout 0.2.0-rc.6",
  "zeroize",
 ]
 
@@ -869,6 +907,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
+ "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -885,14 +924,31 @@ dependencies = [
 [[package]]
 name = "crypto_box"
 version = "0.9.1"
-source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#f7d92b0fac4c8883ee6d5ff0144e6d8d0a4a7d9e"
-dependencies = [
- "aead",
- "chacha20",
- "crypto_secretbox",
- "curve25519-dalek",
- "salsa20",
- "serdect",
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16182b4f39a82ec8a6851155cc4c0cda3065bb1db33651726a29e1951de0f009"
+dependencies = [
+ "aead 0.5.2",
+ "chacha20 0.9.1",
+ "crypto_secretbox 0.1.1",
+ "curve25519-dalek 4.1.3",
+ "salsa20 0.10.2",
+ "serdect 0.2.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto_box"
+version = "0.10.0-pre.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bda4de3e070830cf3a27a394de135b6709aefcc54d1e16f2f029271254a6ed9"
+dependencies = [
+ "aead 0.6.0-rc.2",
+ "chacha20 0.10.0-rc.2",
+ "crypto_secretbox 0.2.0-pre.0",
+ "curve25519-dalek 5.0.0-pre.1",
+ "salsa20 0.11.0-rc.1",
+ "serdect 0.4.1",
  "subtle",
  "zeroize",
 ]
@@ -900,14 +956,46 @@ dependencies = [
 [[package]]
 name = "crypto_secretbox"
 version = "0.1.1"
-source = "git+https://github.com/dignifiedquire/nacl-compat?branch=rand-09#f7d92b0fac4c8883ee6d5ff0144e6d8d0a4a7d9e"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d6cf87adf719ddf43a805e92c6870a531aedda35ff640442cbaf8674e141e1"
 dependencies = [
- "aead",
- "chacha20",
- "cipher",
+ "aead 0.5.2",
+ "chacha20 0.9.1",
+ "cipher 0.4.4",
+ "generic-array",
+ "poly1305 0.8.0",
+ "salsa20 0.10.2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto_secretbox"
+version = "0.2.0-pre.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54532aae6546084a52cef855593daf9555945719eeeda9974150e0def854873e"
+dependencies = [
+ "aead 0.6.0-rc.2",
+ "chacha20 0.10.0-rc.2",
+ "cipher 0.5.0-rc.1",
  "hybrid-array",
- "poly1305",
- "salsa20",
+ "poly1305 0.9.0-rc.2",
+ "salsa20 0.11.0-rc.1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "fiat-crypto 0.2.9",
+ "rustc_version",
  "subtle",
  "zeroize",
 ]
@@ -922,7 +1010,7 @@ dependencies = [
  "cpufeatures",
  "curve25519-dalek-derive",
  "digest 0.11.0-rc.3",
- "fiat-crypto",
+ "fiat-crypto 0.3.0",
  "rand_core 0.9.3",
  "rustc_version",
  "serde",
@@ -1157,7 +1245,7 @@ version = "3.0.0-pre.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad207ed88a133091f83224265eac21109930db09bedcad05d5252f2af2de20a1"
 dependencies = [
- "curve25519-dalek",
+ "curve25519-dalek 5.0.0-pre.1",
  "ed25519",
  "rand_core 0.9.3",
  "serde",
@@ -1260,6 +1348,12 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
 [[package]]
 name = "fiat-crypto"
 version = "0.3.0"
@@ -1268,9 +1362,9 @@ checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ced73b1dacfc750a6db6c0a0c3a3853c8b41997e2e2c563dc90804ae6867959"
+checksum = "0399f9d26e5191ce32c498bebd31e7a3ceabc2745f0ac54af3f335126c3f24b3"
 
 [[package]]
 name = "flume"
@@ -1316,9 +1410,9 @@ dependencies = [
 
 [[package]]
 name = "fs-err"
-version = "3.1.2"
+version = "3.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44f150ffc8782f35521cec2b23727707cb4045706ba3c854e86bef66b3a8cdbd"
+checksum = "6ad492b2cf1d89d568a43508ab24f98501fe03f2f31c01e1d0fe7366a71745d2"
 dependencies = [
  "autocfg",
  "tokio",
@@ -1456,7 +1550,7 @@ dependencies = [
  "libc",
  "log",
  "rustversion",
- "windows",
+ "windows 0.61.3",
 ]
 
 [[package]]
@@ -1467,6 +1561,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
+ "zeroize",
 ]
 
 [[package]]
@@ -2249,6 +2344,15 @@ dependencies = [
  "web-time",
 ]
 
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "inout"
 version = "0.2.0-rc.6"
@@ -2316,14 +2420,14 @@ dependencies = [
 name = "iroh"
 version = "0.92.0"
 dependencies = [
- "aead",
+ "aead 0.6.0-rc.2",
  "axum",
  "backon",
  "bytes",
  "cfg_aliases",
  "clap",
  "console_error_panic_hook",
- "crypto_box",
+ "crypto_box 0.10.0-pre.0",
  "data-encoding",
  "der",
  "derive_more 2.0.1",
@@ -2351,6 +2455,7 @@ dependencies = [
  "parse-size",
  "pin-project",
  "pkarr",
+ "pkcs8",
  "portmapper",
  "postcard",
  "pretty_assertions",
@@ -2388,7 +2493,7 @@ dependencies = [
 name = "iroh-base"
 version = "0.92.0"
 dependencies = [
- "curve25519-dalek",
+ "curve25519-dalek 5.0.0-pre.1",
  "data-encoding",
  "derive_more 2.0.1",
  "ed25519-dalek",
@@ -2574,7 +2679,7 @@ dependencies = [
  "bytes",
  "cfg_aliases",
  "clap",
- "crypto_box",
+ "crypto_box 0.9.1",
  "dashmap",
  "data-encoding",
  "derive_more 2.0.1",
@@ -2746,11 +2851,10 @@ checksum = "f5e54036fe321fd421e10d732f155734c4e4afd610dd556d9a82833ab3ee0bed"
 
 [[package]]
 name = "lock_api"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96936507f153605bddfcda068dd804796c84324ed2510809e5b2a624c81da765"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
 dependencies = [
- "autocfg",
  "scopeguard",
 ]
 
@@ -2796,8 +2900,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
 [[package]]
 name = "mainline"
-version = "5.4.0"
-source = "git+https://github.com/dignifiedquire/mainline?branch=feat-rand-09#542e92333f4f061c2f712ff6096ca0c9a031121f"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be6c12ff79bfbf65bcbec84882a4bf700177df6d83a7b866c6a01cda7db4777"
 dependencies = [
  "crc",
  "document-features",
@@ -3103,7 +3208,7 @@ dependencies = [
  "tokio-util",
  "tracing",
  "web-sys",
- "windows",
+ "windows 0.61.3",
  "windows-result 0.3.4",
  "wmi",
 ]
@@ -3271,6 +3376,12 @@ version = "11.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
 
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
 [[package]]
 name = "openssl-probe"
 version = "0.1.6"
@@ -3285,9 +3396,9 @@ checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
 
 [[package]]
 name = "parking_lot"
-version = "0.12.4"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70d58bf43669b5795d1576d0641cfb6fbb2057bf629506267a92807158584a13"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -3295,15 +3406,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.11"
+version = "0.9.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc838d2a56b5b1a6c25f55575dfc605fabb63bb2365f6c2353ef9159aa69e4a5"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-targets 0.52.6",
+ "windows-link 0.2.0",
 ]
 
 [[package]]
@@ -3345,20 +3456,19 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.8.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21e0a3a33733faeaf8651dfee72dd0f388f0c8e5ad496a3478fa5a922f49cfa8"
+checksum = "989e7521a040efde50c3ab6bbadafbe15ab6dc042686926be59ac35d74607df4"
 dependencies = [
  "memchr",
- "thiserror 2.0.17",
  "ucd-trie",
 ]
 
 [[package]]
 name = "pest_derive"
-version = "2.8.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc58706f770acb1dbd0973e6530a3cff4746fb721207feb3a8a6064cd0b6c663"
+checksum = "187da9a3030dbafabbbfb20cb323b976dc7b7ce91fcd84f2f74d6e31d378e2de"
 dependencies = [
  "pest",
  "pest_generator",
@@ -3366,9 +3476,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.8.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d4f36811dfe07f7b8573462465d5cb8965fffc2e71ae377a33aecf14c2c9a2f"
+checksum = "49b401d98f5757ebe97a26085998d6c0eecec4995cad6ab7fc30ffdf4b052843"
 dependencies = [
  "pest",
  "pest_meta",
@@ -3379,9 +3489,9 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.8.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42919b05089acbd0a5dcd5405fb304d17d1053847b81163d09c4ad18ce8e8420"
+checksum = "72f27a2cfee9f9039c4d86faa5af122a0ac3851441a34865b8a043b46be0065a"
 dependencies = [
  "pest",
  "sha2 0.10.9",
@@ -3431,9 +3541,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkarr"
-version = "4.0.0"
+version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e29542b35f65c89fb347945819af996f8b003e5e46d1e66e1c9bebbd54ba09"
+checksum = "792c1328860f6874e90e3b387b4929819cc7783a6bd5a4728e918706eb436a48"
 dependencies = [
  "async-compat",
  "base32",
@@ -3541,6 +3651,17 @@ dependencies = [
  "pnet_macros_support",
 ]
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash 0.5.1",
+]
+
 [[package]]
 name = "poly1305"
 version = "0.9.0-rc.2"
@@ -3548,7 +3669,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fb78a635f75d76d856374961deecf61031c0b6f928c83dc9c0924ab6c019c298"
 dependencies = [
  "cpufeatures",
- "universal-hash",
+ "universal-hash 0.6.0-rc.2",
 ]
 
 [[package]]
@@ -3650,9 +3771,9 @@ dependencies = [
 
 [[package]]
 name = "precis-profiles"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc4f67f78f50388f03494794766ba824a704db16fb5d400fe8d545fa7bc0d3f1"
+checksum = "31e2768890a47af73a032af9f0cedbddce3c9d06cf8de201d5b8f2436ded7674"
 dependencies = [
  "lazy_static",
  "precis-core",
@@ -3964,9 +4085,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.17"
+version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5407465600fb0548f1442edf71dd20683c6ed326200ace4b1ef0763521bb3b77"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
  "bitflags",
 ]
@@ -4248,9 +4369,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.6"
+version = "0.103.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8572f3c2cb9934231157b45499fc41e1f58c589fdfb81a844ba873265e80f8eb"
+checksum = "e10b3f4191e8a80e6b43eebabfac91e5dcecebb27a71f04e820c47ec41d314bf"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -4265,9 +4386,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "rusty-fork"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb3dcc6e454c328bb824492db107ab7c0ae8fcffe4ad210136ef014458c1bc4f"
+checksum = "cc6bf79ff24e648f6da1f8d1f011e9cac26491b619e6b9280f2b47f1774e6ee2"
 dependencies = [
  "fnv",
  "quick-error",
@@ -4281,6 +4402,15 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
+[[package]]
+name = "salsa20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
+dependencies = [
+ "cipher 0.4.4",
+]
+
 [[package]]
 name = "salsa20"
 version = "0.11.0-rc.1"
@@ -4288,7 +4418,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3ff3b81c8a6e381bc1673768141383f9328048a60edddcfc752a8291a138443"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.5.0-rc.1",
 ]
 
 [[package]]
@@ -4483,7 +4613,17 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
+ "serde",
+]
+
+[[package]]
+name = "serdect"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3ef0e35b322ddfaecbc60f34ab448e157e48531288ee49fafbb053696b8ffe2"
+dependencies = [
+ "base16ct 0.3.0",
  "serde",
 ]
 
@@ -5373,9 +5513,9 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
 
 [[package]]
 name = "ucd-parse"
@@ -5431,6 +5571,16 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "323402cff2dd658f39ca17c789b502021b3f18707c91cdf22e3838e1b4023817"
 
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common 0.1.6",
+ "subtle",
+]
+
 [[package]]
 name = "universal-hash"
 version = "0.6.0-rc.2"
@@ -5754,11 +5904,23 @@ version = "0.61.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
 dependencies = [
- "windows-collections",
+ "windows-collections 0.2.0",
  "windows-core 0.61.2",
- "windows-future",
+ "windows-future 0.2.1",
  "windows-link 0.1.3",
- "windows-numerics",
+ "windows-numerics 0.2.0",
+]
+
+[[package]]
+name = "windows"
+version = "0.62.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49e6c4a1f363c8210c6f77ba24f645c61c6fb941eccf013da691f7e09515b8ac"
+dependencies = [
+ "windows-collections 0.3.1",
+ "windows-core 0.62.1",
+ "windows-future 0.3.1",
+ "windows-numerics 0.3.0",
 ]
 
 [[package]]
@@ -5770,6 +5932,15 @@ dependencies = [
  "windows-core 0.61.2",
 ]
 
+[[package]]
+name = "windows-collections"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "123e712f464a8a60ce1a13f4c446d2d43ab06464cb5842ff68f5c71b6fb7852e"
+dependencies = [
+ "windows-core 0.62.1",
+]
+
 [[package]]
 name = "windows-core"
 version = "0.61.2"
@@ -5804,7 +5975,18 @@ checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
 dependencies = [
  "windows-core 0.61.2",
  "windows-link 0.1.3",
- "windows-threading",
+ "windows-threading 0.1.0",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f3db6b24b120200d649cd4811b4947188ed3a8d2626f7075146c5d178a9a4a"
+dependencies = [
+ "windows-core 0.62.1",
+ "windows-link 0.2.0",
+ "windows-threading 0.2.0",
 ]
 
 [[package]]
@@ -5851,6 +6033,16 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
+[[package]]
+name = "windows-numerics"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ce3498fe0aba81e62e477408383196b4b0363db5e0c27646f932676283b43d8"
+dependencies = [
+ "windows-core 0.62.1",
+ "windows-link 0.2.0",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.3.4"
@@ -6013,6 +6205,15 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
+[[package]]
+name = "windows-threading"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab47f085ad6932defa48855254c758cdd0e2f2d48e62a34118a268d8f345e118"
+dependencies = [
+ "windows-link 0.2.0",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
@@ -6220,17 +6421,17 @@ checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 
 [[package]]
 name = "wmi"
-version = "0.17.2"
+version = "0.17.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d3de777dce4cbcdc661d5d18e78ce4b46a37adc2bb7c0078a556c7f07bcce2f"
+checksum = "120d8c2b6a7c96c27bf4a7947fd7f02d73ca7f5958b8bd72a696e46cb5521ee6"
 dependencies = [
  "chrono",
  "futures",
  "log",
  "serde",
  "thiserror 2.0.17",
- "windows",
- "windows-core 0.61.2",
+ "windows 0.62.1",
+ "windows-core 0.62.1",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index c65f76ef913..593f1d0ec73 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -40,8 +40,3 @@ unexpected_cfgs = { level = "warn", check-cfg = ["cfg(iroh_docsrs)", "cfg(iroh_l
 
 [workspace.lints.clippy]
 unused-async = "warn"
-
-
-[patch.crates-io]
-crypto_box = { git = "https://github.com/dignifiedquire/nacl-compat", branch = "rand-09" }
-mainline = { git = "https://github.com/dignifiedquire/mainline", branch = "feat-rand-09" }
diff --git a/iroh-dns-server/Cargo.toml b/iroh-dns-server/Cargo.toml
index 1f279ed79bf..13f59578a54 100644
--- a/iroh-dns-server/Cargo.toml
+++ b/iroh-dns-server/Cargo.toml
@@ -32,7 +32,7 @@ iroh-metrics = { version = "0.35", features = ["service"] }
 lru = "0.13"
 n0-future = "0.1.2"
 n0-snafu = "0.2.2"
-pkarr = { version = "4", features = ["relays", "dht"], default-features = false }
+pkarr = { version = "5", features = ["relays", "dht"], default-features = false }
 rcgen = "0.13"
 redb = "2.6.3"
 regex = "1.10.3"
diff --git a/iroh-relay/Cargo.toml b/iroh-relay/Cargo.toml
index ced0ccbfdac..b696cbf2650 100644
--- a/iroh-relay/Cargo.toml
+++ b/iroh-relay/Cargo.toml
@@ -36,7 +36,7 @@ iroh-metrics = { version = "0.35", default-features = false }
 n0-future = "0.1.2"
 num_enum = "0.7"
 pin-project = "1"
-pkarr = { version = "4", default-features = false, features = ["signed_packet"] }
+pkarr = { version = "5", default-features = false, features = ["signed_packet"] }
 postcard = { version = "1", default-features = false, features = [
     "alloc",
     "use-std",
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index 9901d8b8caf..ac31d50671d 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -24,7 +24,7 @@ workspace = true
 aead = { version = "=0.6.0-rc.2", features = ["bytes"] }
 backon = { version = "1.4" }
 bytes = "1.7"
-crypto_box = { version = "0.9.1", features = ["serde", "chacha20"] }
+crypto_box = { version = "0.10.0-pre.0", features = ["serde", "chacha20"] }
 data-encoding = "2.2"
 der = { version = "0.8.0-rc.9", features = ["alloc", "derive"] }
 derive_more = { version = "2.0.1", features = [
@@ -45,9 +45,7 @@ n0-watcher = "0.3"
 nested_enum_utils = "0.2.1"
 netwatch = { version = "0.9" }
 pin-project = "1"
-pkarr = { version = "4", default-features = false, features = [
-    "relays",
-] }
+pkarr = { version = "5", default-features = false, features = ["relays"] }
 quinn = { package = "iroh-quinn", version = "0.14.0", default-features = false, features = ["rustls-ring"] }
 quinn-proto = { package = "iroh-quinn-proto", version = "0.13.0" }
 quinn-udp = { package = "iroh-quinn-udp", version = "0.5.7" }
diff --git a/iroh/src/discovery.rs b/iroh/src/discovery.rs
index e984b350916..b78344090b9 100644
--- a/iroh/src/discovery.rs
+++ b/iroh/src/discovery.rs
@@ -781,15 +781,16 @@ mod tests {
     #[tokio::test]
     #[traced_test]
     async fn endpoint_discovery_simple_shared_with_arc() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let disco_shared = TestDiscoveryShared::default();
         let (ep1, _guard1) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco = disco_shared.create_discovery(secret.public());
             let disco = Arc::new(disco);
             new_endpoint(secret, disco).await
         };
         let (ep2, _guard2) = {
-            let secret = SecretKey::generate(rand::thread_rng());
+            let secret = SecretKey::generate(&mut rng);
             let disco = disco_shared.create_discovery(secret.public());
             let disco = Arc::new(disco);
             new_endpoint(secret, disco).await
diff --git a/iroh/src/endpoint.rs b/iroh/src/endpoint.rs
index df271eabad6..8c979ef82c1 100644
--- a/iroh/src/endpoint.rs
+++ b/iroh/src/endpoint.rs
@@ -2216,25 +2216,17 @@ fn is_cgi() -> bool {
 // https://github.com/n0-computer/iroh/issues/1183
 #[cfg(test)]
 mod tests {
-    use std::time::{Duration, Instant};
+    use std::time::Duration;
 
-    use iroh_base::{NodeAddr, NodeId, SecretKey};
-    use n0_future::{BufferedStreamExt, StreamExt, stream, task::AbortOnDropHandle};
+    use iroh_base::{NodeAddr, SecretKey};
     use n0_snafu::{Error, Result, ResultExt};
     use n0_watcher::Watcher;
-    use quinn::ConnectionError;
     use rand::SeedableRng;
-    use tracing::{Instrument, error_span, info, info_span};
+    use tracing::{Instrument, info, info_span};
     use tracing_test::traced_test;
 
     use super::Endpoint;
-    use crate::{
-        RelayMode,
-        discovery::static_provider::StaticProvider,
-        endpoint::{ConnectOptions, Connection, ConnectionType},
-        protocol::{AcceptError, ProtocolHandler, Router},
-        test_utils::{run_relay_server, run_relay_server_with},
-    };
+    use crate::{RelayMode, test_utils::run_relay_server};
 
     const TEST_ALPN: &[u8] = b"n0/iroh/test";
 
diff --git a/iroh/src/key.rs b/iroh/src/key.rs
index a589e21a52c..94762b792d0 100644
--- a/iroh/src/key.rs
+++ b/iroh/src/key.rs
@@ -46,7 +46,7 @@ impl Debug for SharedSecret {
 
 impl SharedSecret {
     pub fn new(this: &crypto_box::SecretKey, other: &crypto_box::PublicKey) -> Self {
-        SharedSecret(crypto_box::ChaChaBox::from_clamped(other, this))
+        SharedSecret(crypto_box::ChaChaBox::new_from_clamped(other, this))
     }
 
     /// Seals the provided cleartext.
diff --git a/iroh/src/magicsock.rs b/iroh/src/magicsock.rs
index 061fd51261e..576c8a0dcc7 100644
--- a/iroh/src/magicsock.rs
+++ b/iroh/src/magicsock.rs
@@ -3051,7 +3051,7 @@ mod tests {
     #[traced_test]
     async fn test_direct_addresses() {
         let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
-        let ms = Handle::new(Default::default()).await.unwrap();
+        let ms = Handle::new(default_options(&mut rng)).await.unwrap();
 
         // See if we can get endpoints.
         let eps0 = ms.direct_addresses().initialized().await;

From 51dcb7b4e10e322b2b3830d4f6fd536d7a3d894c Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Mon, 6 Oct 2025 10:27:58 +0200
Subject: [PATCH 13/16] bring back deleted testes

---
 iroh/src/endpoint.rs | 838 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 834 insertions(+), 4 deletions(-)

diff --git a/iroh/src/endpoint.rs b/iroh/src/endpoint.rs
index 8c979ef82c1..63cb738124e 100644
--- a/iroh/src/endpoint.rs
+++ b/iroh/src/endpoint.rs
@@ -2216,17 +2216,25 @@ fn is_cgi() -> bool {
 // https://github.com/n0-computer/iroh/issues/1183
 #[cfg(test)]
 mod tests {
-    use std::time::Duration;
+    use std::time::{Duration, Instant};
 
-    use iroh_base::{NodeAddr, SecretKey};
+    use iroh_base::{NodeAddr, NodeId, SecretKey};
+    use n0_future::{BufferedStreamExt, StreamExt, stream, task::AbortOnDropHandle};
     use n0_snafu::{Error, Result, ResultExt};
     use n0_watcher::Watcher;
+    use quinn::ConnectionError;
     use rand::SeedableRng;
-    use tracing::{Instrument, info, info_span};
+    use tracing::{Instrument, error_span, info, info_span};
     use tracing_test::traced_test;
 
     use super::Endpoint;
-    use crate::{RelayMode, test_utils::run_relay_server};
+    use crate::{
+        RelayMode,
+        discovery::static_provider::StaticProvider,
+        endpoint::{ConnectOptions, Connection, ConnectionType},
+        protocol::{AcceptError, ProtocolHandler, Router},
+        test_utils::{run_relay_server, run_relay_server_with},
+    };
 
     const TEST_ALPN: &[u8] = b"n0/iroh/test";
 
@@ -2346,4 +2354,826 @@ mod tests {
         client.e()??;
         Ok(())
     }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn endpoint_relay_connect_loop() -> Result {
+        let test_start = Instant::now();
+        let n_clients = 5;
+        let n_chunks_per_client = 2;
+        let chunk_size = 10;
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(42);
+        let (relay_map, relay_url, _relay_guard) = run_relay_server().await.unwrap();
+        let server_secret_key = SecretKey::generate(&mut rng);
+        let server_node_id = server_secret_key.public();
+
+        // Make sure the server is bound before having clients connect to it:
+        let ep = Endpoint::builder()
+            .insecure_skip_relay_cert_verify(true)
+            .secret_key(server_secret_key)
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .relay_mode(RelayMode::Custom(relay_map.clone()))
+            .bind()
+            .await?;
+        // Also make sure the server has a working relay connection
+        ep.home_relay().initialized().await;
+
+        info!(time = ?test_start.elapsed(), "test setup done");
+
+        // The server accepts the connections of the clients sequentially.
+        let server = tokio::spawn(
+            async move {
+                let eps = ep.bound_sockets();
+
+                info!(me = %ep.node_id().fmt_short(), eps = ?eps, "server listening on");
+                for i in 0..n_clients {
+                    let round_start = Instant::now();
+                    info!("[server] round {i}");
+                    let incoming = ep.accept().await.e()?;
+                    let conn = incoming.await.e()?;
+                    let node_id = conn.remote_node_id()?;
+                    info!(%i, peer = %node_id.fmt_short(), "accepted connection");
+                    let (mut send, mut recv) = conn.accept_bi().await.e()?;
+                    let mut buf = vec![0u8; chunk_size];
+                    for _i in 0..n_chunks_per_client {
+                        recv.read_exact(&mut buf).await.e()?;
+                        send.write_all(&buf).await.e()?;
+                    }
+                    send.finish().e()?;
+                    conn.closed().await; // we're the last to send data, so we wait for the other side to close
+                    info!(%i, peer = %node_id.fmt_short(), "finished");
+                    info!("[server] round {i} done in {:?}", round_start.elapsed());
+                }
+                Ok::<_, Error>(())
+            }
+            .instrument(error_span!("server")),
+        );
+
+        let start = Instant::now();
+
+        for i in 0..n_clients {
+            let round_start = Instant::now();
+            info!("[client] round {i}");
+            let client_secret_key = SecretKey::generate(&mut rng);
+            async {
+                info!("client binding");
+                let ep = Endpoint::builder()
+                    .alpns(vec![TEST_ALPN.to_vec()])
+                    .insecure_skip_relay_cert_verify(true)
+                    .relay_mode(RelayMode::Custom(relay_map.clone()))
+                    .secret_key(client_secret_key)
+                    .bind()
+                    .await?;
+                let eps = ep.bound_sockets();
+
+                info!(me = %ep.node_id().fmt_short(), eps=?eps, "client bound");
+                let node_addr = NodeAddr::new(server_node_id).with_relay_url(relay_url.clone());
+                info!(to = ?node_addr, "client connecting");
+                let conn = ep.connect(node_addr, TEST_ALPN).await.e()?;
+                info!("client connected");
+                let (mut send, mut recv) = conn.open_bi().await.e()?;
+
+                for i in 0..n_chunks_per_client {
+                    let mut buf = vec![i; chunk_size];
+                    send.write_all(&buf).await.e()?;
+                    recv.read_exact(&mut buf).await.e()?;
+                    assert_eq!(buf, vec![i; chunk_size]);
+                }
+                // we're the last to receive data, so we close
+                conn.close(0u32.into(), b"bye!");
+                info!("client finished");
+                ep.close().await;
+                info!("client closed");
+                Ok::<_, Error>(())
+            }
+            .instrument(error_span!("client", %i))
+            .await?;
+            info!("[client] round {i} done in {:?}", round_start.elapsed());
+        }
+
+        server.await.e()??;
+
+        // We appear to have seen this being very slow at times.  So ensure we fail if this
+        // test is too slow.  We're only making two connections transferring very little
+        // data, this really shouldn't take long.
+        if start.elapsed() > Duration::from_secs(15) {
+            panic!("Test too slow, something went wrong");
+        }
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn endpoint_send_relay() -> Result {
+        let (relay_map, _relay_url, _guard) = run_relay_server().await?;
+        let client = Endpoint::builder()
+            .insecure_skip_relay_cert_verify(true)
+            .relay_mode(RelayMode::Custom(relay_map.clone()))
+            .bind()
+            .await?;
+        let server = Endpoint::builder()
+            .insecure_skip_relay_cert_verify(true)
+            .relay_mode(RelayMode::Custom(relay_map))
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .bind()
+            .await?;
+
+        let task = tokio::spawn({
+            let server = server.clone();
+            async move {
+                let Some(conn) = server.accept().await else {
+                    snafu::whatever!("Expected an incoming connection");
+                };
+                let conn = conn.await.e()?;
+                let (mut send, mut recv) = conn.accept_bi().await.e()?;
+                let data = recv.read_to_end(1000).await.e()?;
+                send.write_all(&data).await.e()?;
+                send.finish().e()?;
+                conn.closed().await;
+
+                Ok::<_, Error>(())
+            }
+        });
+
+        let addr = server.node_addr().initialized().await;
+        let conn = client.connect(addr, TEST_ALPN).await?;
+        let (mut send, mut recv) = conn.open_bi().await.e()?;
+        send.write_all(b"Hello, world!").await.e()?;
+        send.finish().e()?;
+        let data = recv.read_to_end(1000).await.e()?;
+        conn.close(0u32.into(), b"bye!");
+
+        task.await.e()??;
+
+        client.close().await;
+        server.close().await;
+
+        assert_eq!(&data, b"Hello, world!");
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn endpoint_bidi_send_recv() -> Result {
+        let ep1 = Endpoint::builder()
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .relay_mode(RelayMode::Disabled);
+
+        let ep1 = ep1.bind().await?;
+        let ep2 = Endpoint::builder()
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .relay_mode(RelayMode::Disabled);
+
+        let ep2 = ep2.bind().await?;
+
+        let ep1_nodeaddr = ep1.node_addr().initialized().await;
+        let ep2_nodeaddr = ep2.node_addr().initialized().await;
+        ep1.add_node_addr(ep2_nodeaddr.clone())?;
+        ep2.add_node_addr(ep1_nodeaddr.clone())?;
+        let ep1_nodeid = ep1.node_id();
+        let ep2_nodeid = ep2.node_id();
+        eprintln!("node id 1 {ep1_nodeid}");
+        eprintln!("node id 2 {ep2_nodeid}");
+
+        async fn connect_hello(ep: Endpoint, dst: NodeAddr) -> Result {
+            let conn = ep.connect(dst, TEST_ALPN).await?;
+            let (mut send, mut recv) = conn.open_bi().await.e()?;
+            info!("sending hello");
+            send.write_all(b"hello").await.e()?;
+            send.finish().e()?;
+            info!("receiving world");
+            let m = recv.read_to_end(100).await.e()?;
+            assert_eq!(m, b"world");
+            conn.close(1u8.into(), b"done");
+            Ok(())
+        }
+
+        async fn accept_world(ep: Endpoint, src: NodeId) -> Result {
+            let incoming = ep.accept().await.e()?;
+            let mut iconn = incoming.accept().e()?;
+            let alpn = iconn.alpn().await?;
+            let conn = iconn.await.e()?;
+            let node_id = conn.remote_node_id()?;
+            assert_eq!(node_id, src);
+            assert_eq!(alpn, TEST_ALPN);
+            let (mut send, mut recv) = conn.accept_bi().await.e()?;
+            info!("receiving hello");
+            let m = recv.read_to_end(100).await.e()?;
+            assert_eq!(m, b"hello");
+            info!("sending hello");
+            send.write_all(b"world").await.e()?;
+            send.finish().e()?;
+            match conn.closed().await {
+                ConnectionError::ApplicationClosed(closed) => {
+                    assert_eq!(closed.error_code, 1u8.into());
+                    Ok(())
+                }
+                _ => panic!("wrong close error"),
+            }
+        }
+
+        let p1_accept = tokio::spawn(accept_world(ep1.clone(), ep2_nodeid).instrument(info_span!(
+            "p1_accept",
+            ep1 = %ep1.node_id().fmt_short(),
+            dst = %ep2_nodeid.fmt_short(),
+        )));
+        let p2_accept = tokio::spawn(accept_world(ep2.clone(), ep1_nodeid).instrument(info_span!(
+            "p2_accept",
+            ep2 = %ep2.node_id().fmt_short(),
+            dst = %ep1_nodeid.fmt_short(),
+        )));
+        let p1_connect = tokio::spawn(connect_hello(ep1.clone(), ep2_nodeaddr).instrument(
+            info_span!(
+                "p1_connect",
+                ep1 = %ep1.node_id().fmt_short(),
+                dst = %ep2_nodeid.fmt_short(),
+            ),
+        ));
+        let p2_connect = tokio::spawn(connect_hello(ep2.clone(), ep1_nodeaddr).instrument(
+            info_span!(
+                "p2_connect",
+                ep2 = %ep2.node_id().fmt_short(),
+                dst = %ep1_nodeid.fmt_short(),
+            ),
+        ));
+
+        p1_accept.await.e()??;
+        p2_accept.await.e()??;
+        p1_connect.await.e()??;
+        p2_connect.await.e()??;
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn endpoint_conn_type_becomes_direct() -> Result {
+        const TIMEOUT: Duration = std::time::Duration::from_secs(15);
+        let (relay_map, _relay_url, _relay_guard) = run_relay_server().await?;
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(42);
+        let ep1_secret_key = SecretKey::generate(&mut rng);
+        let ep2_secret_key = SecretKey::generate(&mut rng);
+        let ep1 = Endpoint::builder()
+            .secret_key(ep1_secret_key)
+            .insecure_skip_relay_cert_verify(true)
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .relay_mode(RelayMode::Custom(relay_map.clone()))
+            .bind()
+            .await?;
+        let ep2 = Endpoint::builder()
+            .secret_key(ep2_secret_key)
+            .insecure_skip_relay_cert_verify(true)
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .relay_mode(RelayMode::Custom(relay_map))
+            .bind()
+            .await?;
+
+        async fn wait_for_conn_type_direct(ep: &Endpoint, node_id: NodeId) -> Result {
+            let mut stream = ep.conn_type(node_id).expect("connection exists").stream();
+            let src = ep.node_id().fmt_short();
+            let dst = node_id.fmt_short();
+            while let Some(conn_type) = stream.next().await {
+                tracing::info!(me = %src, dst = %dst, conn_type = ?conn_type);
+                if matches!(conn_type, ConnectionType::Direct(_)) {
+                    return Ok(());
+                }
+            }
+            snafu::whatever!("conn_type stream ended before `ConnectionType::Direct`");
+        }
+
+        async fn accept(ep: &Endpoint) -> Result<Connection> {
+            let incoming = ep.accept().await.expect("ep closed");
+            let conn = incoming.await.e()?;
+            let node_id = conn.remote_node_id()?;
+            tracing::info!(node_id=%node_id.fmt_short(), "accepted connection");
+            Ok(conn)
+        }
+
+        let ep1_nodeid = ep1.node_id();
+        let ep2_nodeid = ep2.node_id();
+
+        let ep1_nodeaddr = ep1.node_addr().initialized().await;
+        tracing::info!(
+            "node id 1 {ep1_nodeid}, relay URL {:?}",
+            ep1_nodeaddr.relay_url()
+        );
+        tracing::info!("node id 2 {ep2_nodeid}");
+
+        let ep1_side = tokio::time::timeout(TIMEOUT, async move {
+            let conn = accept(&ep1).await?;
+            let mut send = conn.open_uni().await.e()?;
+            wait_for_conn_type_direct(&ep1, ep2_nodeid).await?;
+            send.write_all(b"Conn is direct").await.e()?;
+            send.finish().e()?;
+            conn.closed().await;
+            Ok::<(), Error>(())
+        });
+
+        let ep2_side = tokio::time::timeout(TIMEOUT, async move {
+            let conn = ep2.connect(ep1_nodeaddr, TEST_ALPN).await?;
+            let mut recv = conn.accept_uni().await.e()?;
+            wait_for_conn_type_direct(&ep2, ep1_nodeid).await?;
+            let read = recv.read_to_end(100).await.e()?;
+            assert_eq!(read, b"Conn is direct".to_vec());
+            conn.close(0u32.into(), b"done");
+            conn.closed().await;
+            Ok::<(), Error>(())
+        });
+
+        let res_ep1 = AbortOnDropHandle::new(tokio::spawn(ep1_side));
+        let res_ep2 = AbortOnDropHandle::new(tokio::spawn(ep2_side));
+
+        let (r1, r2) = tokio::try_join!(res_ep1, res_ep2).e()?;
+        r1.e()??;
+        r2.e()??;
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn test_direct_addresses_no_qad_relay() -> Result {
+        let (relay_map, _, _guard) = run_relay_server_with(false).await.unwrap();
+
+        let ep = Endpoint::builder()
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .relay_mode(RelayMode::Custom(relay_map))
+            .insecure_skip_relay_cert_verify(true)
+            .bind()
+            .await?;
+
+        tokio::time::timeout(Duration::from_secs(10), ep.direct_addresses().initialized())
+            .await
+            .e()?;
+        Ok(())
+    }
+
+    async fn spawn_0rtt_server(secret_key: SecretKey, log_span: tracing::Span) -> Result<Endpoint> {
+        let server = Endpoint::builder()
+            .secret_key(secret_key)
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .relay_mode(RelayMode::Disabled)
+            .bind()
+            .await?;
+
+        // Gets aborted via the endpoint closing causing an `Err`
+        // a simple echo server
+        tokio::spawn({
+            let server = server.clone();
+            async move {
+                while let Some(incoming) = server.accept().await {
+                    let connecting = incoming.accept().e()?;
+                    let conn = match connecting.into_0rtt() {
+                        Ok((conn, _)) => {
+                            info!("0rtt accepted");
+                            conn
+                        }
+                        Err(connecting) => {
+                            info!("0rtt denied");
+                            connecting.await.e()?
+                        }
+                    };
+                    let (mut send, mut recv) = conn.accept_bi().await.e()?;
+                    let data = recv.read_to_end(10_000_000).await.e()?;
+                    send.write_all(&data).await.e()?;
+                    send.finish().e()?;
+
+                    // Stay alive until the other side closes the connection.
+                    conn.closed().await;
+                }
+                Ok::<_, Error>(())
+            }
+            .instrument(log_span)
+        });
+
+        Ok(server)
+    }
+
+    async fn connect_client_0rtt_expect_err(client: &Endpoint, server_addr: NodeAddr) -> Result {
+        let conn = client
+            .connect_with_opts(server_addr, TEST_ALPN, ConnectOptions::new())
+            .await?
+            .into_0rtt()
+            .expect_err("expected 0rtt to fail")
+            .await
+            .e()?;
+
+        let (mut send, mut recv) = conn.open_bi().await.e()?;
+        send.write_all(b"hello").await.e()?;
+        send.finish().e()?;
+        let received = recv.read_to_end(1_000).await.e()?;
+        assert_eq!(&received, b"hello");
+        conn.close(0u32.into(), b"thx");
+        Ok(())
+    }
+
+    async fn connect_client_0rtt_expect_ok(
+        client: &Endpoint,
+        server_addr: NodeAddr,
+        expect_server_accepts: bool,
+    ) -> Result {
+        let (conn, accepted_0rtt) = client
+            .connect_with_opts(server_addr, TEST_ALPN, ConnectOptions::new())
+            .await?
+            .into_0rtt()
+            .ok()
+            .e()?;
+
+        // This is how we send data in 0-RTT:
+        let (mut send, recv) = conn.open_bi().await.e()?;
+        send.write_all(b"hello").await.e()?;
+        send.finish().e()?;
+        // When this resolves, we've gotten a response from the server about whether the 0-RTT data above was accepted:
+        let accepted = accepted_0rtt.await;
+        assert_eq!(accepted, expect_server_accepts);
+        let mut recv = if accepted {
+            recv
+        } else {
+            // in this case we need to re-send data by re-creating the connection.
+            let (mut send, recv) = conn.open_bi().await.e()?;
+            send.write_all(b"hello").await.e()?;
+            send.finish().e()?;
+            recv
+        };
+        let received = recv.read_to_end(1_000).await.e()?;
+        assert_eq!(&received, b"hello");
+        conn.close(0u32.into(), b"thx");
+        Ok(())
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn test_0rtt() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(42);
+        let client = Endpoint::builder()
+            .relay_mode(RelayMode::Disabled)
+            .bind()
+            .await?;
+        let server = spawn_0rtt_server(SecretKey::generate(&mut rng), info_span!("server")).await?;
+
+        connect_client_0rtt_expect_err(&client, server.node_addr().initialized().await).await?;
+        // The second 0rtt attempt should work
+        connect_client_0rtt_expect_ok(&client, server.node_addr().initialized().await, true)
+            .await?;
+
+        client.close().await;
+        server.close().await;
+
+        Ok(())
+    }
+
+    // We have this test, as this would've failed at some point.
+    // This effectively tests that we correctly categorize the TLS session tickets we
+    // receive into the respective "bucket" for the recipient.
+    #[tokio::test]
+    #[traced_test]
+    async fn test_0rtt_non_consecutive() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(42);
+        let client = Endpoint::builder()
+            .relay_mode(RelayMode::Disabled)
+            .bind()
+            .await?;
+        let server = spawn_0rtt_server(SecretKey::generate(&mut rng), info_span!("server")).await?;
+
+        connect_client_0rtt_expect_err(&client, server.node_addr().initialized().await).await?;
+
+        // connecting with another endpoint should not interfere with our
+        // TLS session ticket cache for the first endpoint:
+        let another =
+            spawn_0rtt_server(SecretKey::generate(&mut rng), info_span!("another")).await?;
+        connect_client_0rtt_expect_err(&client, another.node_addr().initialized().await).await?;
+        another.close().await;
+
+        connect_client_0rtt_expect_ok(&client, server.node_addr().initialized().await, true)
+            .await?;
+
+        client.close().await;
+        server.close().await;
+
+        Ok(())
+    }
+
+    // Test whether 0-RTT is possible after a restart:
+    #[tokio::test]
+    #[traced_test]
+    async fn test_0rtt_after_server_restart() -> Result {
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(42);
+        let client = Endpoint::builder()
+            .relay_mode(RelayMode::Disabled)
+            .bind()
+            .await?;
+        let server_key = SecretKey::generate(&mut rng);
+        let server = spawn_0rtt_server(server_key.clone(), info_span!("server-initial")).await?;
+
+        connect_client_0rtt_expect_err(&client, server.node_addr().initialized().await).await?;
+        connect_client_0rtt_expect_ok(&client, server.node_addr().initialized().await, true)
+            .await?;
+
+        server.close().await;
+
+        let server = spawn_0rtt_server(server_key, info_span!("server-restart")).await?;
+
+        // we expect the client to *believe* it can 0-RTT connect to the server (hence expect_ok),
+        // but the server will reject the early data because it discarded necessary state
+        // to decrypt it when restarting.
+        connect_client_0rtt_expect_ok(&client, server.node_addr().initialized().await, false)
+            .await?;
+
+        client.close().await;
+
+        Ok(())
+    }
+
+    #[cfg_attr(target_os = "windows", ignore = "flaky")]
+    #[tokio::test]
+    #[traced_test]
+    async fn graceful_close() -> Result {
+        let client = Endpoint::builder().bind().await?;
+        let server = Endpoint::builder()
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .bind()
+            .await?;
+        let server_addr = server.node_addr().initialized().await;
+        let server_task = tokio::spawn(async move {
+            let incoming = server.accept().await.e()?;
+            let conn = incoming.await.e()?;
+            let (mut send, mut recv) = conn.accept_bi().await.e()?;
+            let msg = recv.read_to_end(1_000).await.e()?;
+            send.write_all(&msg).await.e()?;
+            send.finish().e()?;
+            let close_reason = conn.closed().await;
+            Ok::<_, Error>(close_reason)
+        });
+
+        let conn = client.connect(server_addr, TEST_ALPN).await?;
+        let (mut send, mut recv) = conn.open_bi().await.e()?;
+        send.write_all(b"Hello, world!").await.e()?;
+        send.finish().e()?;
+        recv.read_to_end(1_000).await.e()?;
+        conn.close(42u32.into(), b"thanks, bye!");
+        client.close().await;
+
+        let close_err = server_task.await.e()??;
+        let ConnectionError::ApplicationClosed(app_close) = close_err else {
+            panic!("Unexpected close reason: {close_err:?}");
+        };
+
+        assert_eq!(app_close.error_code, 42u32.into());
+        assert_eq!(app_close.reason.as_ref(), b"thanks, bye!");
+
+        Ok(())
+    }
+
+    #[cfg(feature = "metrics")]
+    #[tokio::test]
+    #[traced_test]
+    async fn metrics_smoke() -> Result {
+        use iroh_metrics::{MetricsSource, Registry};
+
+        let secret_key = SecretKey::from_bytes(&[0u8; 32]);
+        let client = Endpoint::builder()
+            .secret_key(secret_key)
+            .relay_mode(RelayMode::Disabled)
+            .bind()
+            .await?;
+        let secret_key = SecretKey::from_bytes(&[1u8; 32]);
+        let server = Endpoint::builder()
+            .secret_key(secret_key)
+            .relay_mode(RelayMode::Disabled)
+            .alpns(vec![TEST_ALPN.to_vec()])
+            .bind()
+            .await?;
+        let server_addr = server.node_addr().initialized().await;
+        let server_task = tokio::task::spawn(async move {
+            let conn = server.accept().await.e()?.accept().e()?.await.e()?;
+            let mut uni = conn.accept_uni().await.e()?;
+            uni.read_to_end(10).await.e()?;
+            drop(conn);
+            Ok::<_, Error>(server)
+        });
+        let conn = client.connect(server_addr, TEST_ALPN).await?;
+        let mut uni = conn.open_uni().await.e()?;
+        uni.write_all(b"helloworld").await.e()?;
+        uni.finish().e()?;
+        conn.closed().await;
+        drop(conn);
+        let server = server_task.await.e()??;
+
+        let m = client.metrics();
+        assert_eq!(m.magicsock.num_direct_conns_added.get(), 1);
+        assert_eq!(m.magicsock.connection_became_direct.get(), 1);
+        assert_eq!(m.magicsock.connection_handshake_success.get(), 1);
+        assert_eq!(m.magicsock.nodes_contacted_directly.get(), 1);
+        assert!(m.magicsock.recv_datagrams.get() > 0);
+
+        let m = server.metrics();
+        assert_eq!(m.magicsock.num_direct_conns_added.get(), 1);
+        assert_eq!(m.magicsock.connection_became_direct.get(), 1);
+        assert_eq!(m.magicsock.nodes_contacted_directly.get(), 1);
+        assert_eq!(m.magicsock.connection_handshake_success.get(), 1);
+        assert!(m.magicsock.recv_datagrams.get() > 0);
+
+        // test openmetrics encoding with labeled subregistries per endpoint
+        fn register_endpoint(registry: &mut Registry, endpoint: &Endpoint) {
+            let id = endpoint.node_id().fmt_short();
+            let sub_registry = registry.sub_registry_with_label("id", id.to_string());
+            sub_registry.register_all(endpoint.metrics());
+        }
+        let mut registry = Registry::default();
+        register_endpoint(&mut registry, &client);
+        register_endpoint(&mut registry, &server);
+        let s = registry.encode_openmetrics_to_string()?;
+        assert!(s.contains(r#"magicsock_nodes_contacted_directly_total{id="3b6a27bcce"} 1"#));
+        assert!(s.contains(r#"magicsock_nodes_contacted_directly_total{id="8a88e3dd74"} 1"#));
+        Ok(())
+    }
+
+    /// Configures the accept side to take `accept_alpns` ALPNs, then connects to it with `primary_connect_alpn`
+    /// with `secondary_connect_alpns` set, and finally returns the negotiated ALPN.
+    async fn alpn_connection_test(
+        accept_alpns: Vec<Vec<u8>>,
+        primary_connect_alpn: &[u8],
+        secondary_connect_alpns: Vec<Vec<u8>>,
+    ) -> Result<Option<Vec<u8>>> {
+        let client = Endpoint::builder()
+            .relay_mode(RelayMode::Disabled)
+            .bind()
+            .await?;
+        let server = Endpoint::builder()
+            .relay_mode(RelayMode::Disabled)
+            .alpns(accept_alpns)
+            .bind()
+            .await?;
+        let server_addr = server.node_addr().initialized().await;
+        let server_task = tokio::spawn({
+            let server = server.clone();
+            async move {
+                let incoming = server.accept().await.e()?;
+                let conn = incoming.await.e()?;
+                conn.close(0u32.into(), b"bye!");
+                Ok::<_, n0_snafu::Error>(conn.alpn())
+            }
+        });
+
+        let conn = client
+            .connect_with_opts(
+                server_addr,
+                primary_connect_alpn,
+                ConnectOptions::new().with_additional_alpns(secondary_connect_alpns),
+            )
+            .await?;
+        let conn = conn.await.e()?;
+        let client_alpn = conn.alpn();
+        conn.closed().await;
+        client.close().await;
+        server.close().await;
+
+        let server_alpn = server_task.await.e()??;
+
+        assert_eq!(client_alpn, server_alpn);
+
+        Ok(server_alpn)
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn connect_multiple_alpn_negotiated() -> Result {
+        const ALPN_ONE: &[u8] = b"alpn/1";
+        const ALPN_TWO: &[u8] = b"alpn/2";
+
+        assert_eq!(
+            alpn_connection_test(
+                // Prefer version 2 over version 1 on the accept side
+                vec![ALPN_TWO.to_vec(), ALPN_ONE.to_vec()],
+                ALPN_TWO,
+                vec![ALPN_ONE.to_vec()],
+            )
+            .await?,
+            Some(ALPN_TWO.to_vec()),
+            "accept side prefers version 2 over 1"
+        );
+
+        assert_eq!(
+            alpn_connection_test(
+                // Only support the old version
+                vec![ALPN_ONE.to_vec()],
+                ALPN_TWO,
+                vec![ALPN_ONE.to_vec()],
+            )
+            .await?,
+            Some(ALPN_ONE.to_vec()),
+            "accept side only supports the old version"
+        );
+
+        assert_eq!(
+            alpn_connection_test(
+                vec![ALPN_TWO.to_vec(), ALPN_ONE.to_vec()],
+                ALPN_ONE,
+                vec![ALPN_TWO.to_vec()],
+            )
+            .await?,
+            Some(ALPN_TWO.to_vec()),
+            "connect side ALPN order doesn't matter"
+        );
+
+        assert_eq!(
+            alpn_connection_test(vec![ALPN_TWO.to_vec(), ALPN_ONE.to_vec()], ALPN_ONE, vec![],)
+                .await?,
+            Some(ALPN_ONE.to_vec()),
+            "connect side only supports the old version"
+        );
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn watch_net_report() -> Result {
+        let endpoint = Endpoint::builder()
+            .relay_mode(RelayMode::Staging)
+            .bind()
+            .await?;
+
+        // can get a first report
+        endpoint.net_report().updated().await?;
+
+        Ok(())
+    }
+
+    /// Tests that initial connection establishment isn't extremely slow compared
+    /// to subsequent connections.
+    ///
+    /// This is a time based test, but uses a very large ratio to reduce flakiness.
+    /// It also does a number of connections to average out any anomalies.
+    #[tokio::test]
+    #[traced_test]
+    async fn connect_multi_time() -> Result {
+        let n = 32;
+
+        const NOOP_ALPN: &[u8] = b"noop";
+
+        #[derive(Debug, Clone)]
+        struct Noop;
+
+        impl ProtocolHandler for Noop {
+            async fn accept(&self, connection: Connection) -> Result<(), AcceptError> {
+                connection.closed().await;
+                Ok(())
+            }
+        }
+
+        async fn noop_server() -> Result<(Router, NodeAddr)> {
+            let endpoint = Endpoint::builder()
+                .relay_mode(RelayMode::Disabled)
+                .bind()
+                .await
+                .e()?;
+            let addr = endpoint.node_addr().initialized().await;
+            let router = Router::builder(endpoint).accept(NOOP_ALPN, Noop).spawn();
+            Ok((router, addr))
+        }
+
+        let routers = stream::iter(0..n)
+            .map(|_| noop_server())
+            .buffered_unordered(32)
+            .collect::<Vec<_>>()
+            .await
+            .into_iter()
+            .collect::<Result<Vec<_>, _>>()
+            .e()?;
+
+        let addrs = routers
+            .iter()
+            .map(|(_, addr)| addr.clone())
+            .collect::<Vec<_>>();
+        let ids = addrs.iter().map(|addr| addr.node_id).collect::<Vec<_>>();
+        let discovery = StaticProvider::from_node_info(addrs);
+        let endpoint = Endpoint::builder()
+            .relay_mode(RelayMode::Disabled)
+            .discovery(discovery)
+            .bind()
+            .await
+            .e()?;
+        // wait for the endpoint to be initialized. This should not be needed,
+        // but we don't want to measure endpoint init time but connection time
+        // from a fully initialized endpoint.
+        endpoint.node_addr().initialized().await;
+        let t0 = Instant::now();
+        for id in &ids {
+            let conn = endpoint.connect(*id, NOOP_ALPN).await?;
+            conn.close(0u32.into(), b"done");
+        }
+        let dt0 = t0.elapsed().as_secs_f64();
+        let t1 = Instant::now();
+        for id in &ids {
+            let conn = endpoint.connect(*id, NOOP_ALPN).await?;
+            conn.close(0u32.into(), b"done");
+        }
+        let dt1 = t1.elapsed().as_secs_f64();
+
+        assert!(dt0 / dt1 < 20.0, "First round: {dt0}s, second round {dt1}s");
+        Ok(())
+    }
 }

From be1dc01cf59ec8e26357aa08324a06e0b87d40d0 Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Mon, 6 Oct 2025 10:34:11 +0200
Subject: [PATCH 14/16] cleanup rng usage

---
 iroh-base/src/key.rs                | 3 +--
 iroh-dns-server/examples/publish.rs | 3 +--
 iroh/src/key.rs                     | 9 +++++----
 iroh/src/magicsock.rs               | 5 +++--
 iroh/src/magicsock/node_map.rs      | 2 +-
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/iroh-base/src/key.rs b/iroh-base/src/key.rs
index 5b082ec76e2..e408402fdd5 100644
--- a/iroh-base/src/key.rs
+++ b/iroh-base/src/key.rs
@@ -288,8 +288,7 @@ impl SecretKey {
     ///
     /// ```rust
     /// // use the OsRng option for OS depedndent most secure RNG.
-    /// use rand::{TryRngCore, rngs::OsRng};
-    /// let _key = iroh_base::SecretKey::generate(&mut OsRng.unwrap_err());
+    /// let _key = iroh_base::SecretKey::generate(&mut rand::rng());
     /// ```
     pub fn generate<R: CryptoRng + ?Sized>(csprng: &mut R) -> Self {
         let secret = SigningKey::generate(csprng);
diff --git a/iroh-dns-server/examples/publish.rs b/iroh-dns-server/examples/publish.rs
index d102bdbaf18..7bc4ff82ceb 100644
--- a/iroh-dns-server/examples/publish.rs
+++ b/iroh-dns-server/examples/publish.rs
@@ -11,7 +11,6 @@ use iroh::{
     node_info::{IROH_TXT_NAME, NodeIdExt, NodeInfo},
 };
 use n0_snafu::{Result, ResultExt};
-use rand::TryRngCore;
 use url::Url;
 
 const DEV_PKARR_RELAY_URL: &str = "http://localhost:8080/pkarr";
@@ -64,7 +63,7 @@ async fn main() -> Result<()> {
         Ok(s) => SecretKey::from_str(&s)
             .context("failed to parse IROH_SECRET environment variable as iroh secret key")?,
         Err(_) => {
-            let s = SecretKey::generate(&mut rand::rngs::OsRng.unwrap_err());
+            let s = SecretKey::generate(&mut rand::rng());
             println!("Generated a new node secret. To reuse, set");
             println!(
                 "\tIROH_SECRET={}",
diff --git a/iroh/src/key.rs b/iroh/src/key.rs
index 94762b792d0..f596000e798 100644
--- a/iroh/src/key.rs
+++ b/iroh/src/key.rs
@@ -51,7 +51,7 @@ impl SharedSecret {
 
     /// Seals the provided cleartext.
     pub fn seal(&self, buffer: &mut dyn Buffer) {
-        let nonce = crypto_box::ChaChaBox::try_generate_nonce_with_rng(&mut rand::rngs::OsRng)
+        let nonce = crypto_box::ChaChaBox::try_generate_nonce_with_rng(&mut rand::rng())
             .expect("not enough randomness");
 
         self.0
@@ -94,7 +94,7 @@ mod tests {
 
     #[test]
     fn test_seal_open_roundtrip() {
-        let mut rng = rand::rng();
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let key_a = iroh_base::SecretKey::generate(&mut rng);
         let key_b = iroh_base::SecretKey::generate(&mut rng);
 
@@ -123,7 +123,8 @@ mod tests {
 
     #[test]
     fn test_roundtrip_public_key() {
-        let key = crypto_box::SecretKey::generate(&mut rand::rng());
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
+        let key = crypto_box::SecretKey::generate(&mut rng);
         let public_bytes = *key.public_key().as_bytes();
         let public_key_back = crypto_box::PublicKey::from(public_bytes);
         assert_eq!(key.public_key(), public_key_back);
@@ -141,7 +142,7 @@ mod tests {
 
     #[test]
     fn test_same_public_key_low_level() {
-        let mut rng = rand::rng();
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let key = ed25519_dalek::SigningKey::generate(&mut rng);
         let public_key1 = {
             let m = key.verifying_key().to_montgomery();
diff --git a/iroh/src/magicsock.rs b/iroh/src/magicsock.rs
index 576c8a0dcc7..2b61bbc653b 100644
--- a/iroh/src/magicsock.rs
+++ b/iroh/src/magicsock.rs
@@ -2986,7 +2986,7 @@ mod tests {
 
             println!("-- [m2 changes] larger data");
             let mut data = vec![0u8; 10 * 1024];
-            rand::rng().fill_bytes(&mut data);
+            rng.fill_bytes(&mut data);
             run_roundtrip(m1.clone(), m2.clone(), &data, ExpectedLoss::YeahSure).await;
             run_roundtrip(m2.clone(), m1.clone(), &data, ExpectedLoss::YeahSure).await;
         }
@@ -2997,6 +2997,7 @@ mod tests {
         let m1_m2_network_change_guard = {
             let m1 = m1.clone();
             let m2 = m2.clone();
+            let mut rng = rng.clone();
             let task = tokio::spawn(async move {
                 println!("-- [m1] network change");
                 m1.endpoint.magic_sock().force_network_change(true).await;
@@ -3014,7 +3015,7 @@ mod tests {
 
             println!("-- [m1 & m2 changes] larger data");
             let mut data = vec![0u8; 10 * 1024];
-            rand::rng().fill_bytes(&mut data);
+            rng.fill_bytes(&mut data);
             run_roundtrip(m1.clone(), m2.clone(), &data, ExpectedLoss::YeahSure).await;
             run_roundtrip(m2.clone(), m1.clone(), &data, ExpectedLoss::YeahSure).await;
         }
diff --git a/iroh/src/magicsock/node_map.rs b/iroh/src/magicsock/node_map.rs
index 1f3b4dce2de..b0e70168606 100644
--- a/iroh/src/magicsock/node_map.rs
+++ b/iroh/src/magicsock/node_map.rs
@@ -744,7 +744,7 @@ mod tests {
     async fn restore_from_vec() {
         let node_map = NodeMap::default();
 
-        let mut rng = rand::rng();
+        let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(0u64);
         let node_a = SecretKey::generate(&mut rng).public();
         let node_b = SecretKey::generate(&mut rng).public();
         let node_c = SecretKey::generate(&mut rng).public();

From 7ea038478291d52317c2fb79db98c3618c5734cf Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Mon, 6 Oct 2025 12:18:48 +0200
Subject: [PATCH 15/16] fixups

---
 iroh/src/endpoint.rs | 42 +++++++++++++++++++++++-------------------
 1 file changed, 23 insertions(+), 19 deletions(-)

diff --git a/iroh/src/endpoint.rs b/iroh/src/endpoint.rs
index 63cb738124e..d59bd41649e 100644
--- a/iroh/src/endpoint.rs
+++ b/iroh/src/endpoint.rs
@@ -2376,7 +2376,7 @@ mod tests {
             .bind()
             .await?;
         // Also make sure the server has a working relay connection
-        ep.home_relay().initialized().await;
+        ep.online().await;
 
         info!(time = ?test_start.elapsed(), "test setup done");
 
@@ -2496,7 +2496,7 @@ mod tests {
             }
         });
 
-        let addr = server.node_addr().initialized().await;
+        let addr = server.watch_node_addr().initialized().await;
         let conn = client.connect(addr, TEST_ALPN).await?;
         let (mut send, mut recv) = conn.open_bi().await.e()?;
         send.write_all(b"Hello, world!").await.e()?;
@@ -2528,8 +2528,8 @@ mod tests {
 
         let ep2 = ep2.bind().await?;
 
-        let ep1_nodeaddr = ep1.node_addr().initialized().await;
-        let ep2_nodeaddr = ep2.node_addr().initialized().await;
+        let ep1_nodeaddr = ep1.watch_node_addr().initialized().await;
+        let ep2_nodeaddr = ep2.watch_node_addr().initialized().await;
         ep1.add_node_addr(ep2_nodeaddr.clone())?;
         ep2.add_node_addr(ep1_nodeaddr.clone())?;
         let ep1_nodeid = ep1.node_id();
@@ -2654,7 +2654,7 @@ mod tests {
         let ep1_nodeid = ep1.node_id();
         let ep2_nodeid = ep2.node_id();
 
-        let ep1_nodeaddr = ep1.node_addr().initialized().await;
+        let ep1_nodeaddr = ep1.watch_node_addr().initialized().await;
         tracing::info!(
             "node id 1 {ep1_nodeid}, relay URL {:?}",
             ep1_nodeaddr.relay_url()
@@ -2704,7 +2704,7 @@ mod tests {
             .bind()
             .await?;
 
-        tokio::time::timeout(Duration::from_secs(10), ep.direct_addresses().initialized())
+        tokio::time::timeout(Duration::from_secs(10), ep.watch_node_addr().initialized())
             .await
             .e()?;
         Ok(())
@@ -2813,9 +2813,10 @@ mod tests {
             .await?;
         let server = spawn_0rtt_server(SecretKey::generate(&mut rng), info_span!("server")).await?;
 
-        connect_client_0rtt_expect_err(&client, server.node_addr().initialized().await).await?;
+        connect_client_0rtt_expect_err(&client, server.watch_node_addr().initialized().await)
+            .await?;
         // The second 0rtt attempt should work
-        connect_client_0rtt_expect_ok(&client, server.node_addr().initialized().await, true)
+        connect_client_0rtt_expect_ok(&client, server.watch_node_addr().initialized().await, true)
             .await?;
 
         client.close().await;
@@ -2837,16 +2838,18 @@ mod tests {
             .await?;
         let server = spawn_0rtt_server(SecretKey::generate(&mut rng), info_span!("server")).await?;
 
-        connect_client_0rtt_expect_err(&client, server.node_addr().initialized().await).await?;
+        connect_client_0rtt_expect_err(&client, server.watch_node_addr().initialized().await)
+            .await?;
 
         // connecting with another endpoint should not interfere with our
         // TLS session ticket cache for the first endpoint:
         let another =
             spawn_0rtt_server(SecretKey::generate(&mut rng), info_span!("another")).await?;
-        connect_client_0rtt_expect_err(&client, another.node_addr().initialized().await).await?;
+        connect_client_0rtt_expect_err(&client, another.watch_node_addr().initialized().await)
+            .await?;
         another.close().await;
 
-        connect_client_0rtt_expect_ok(&client, server.node_addr().initialized().await, true)
+        connect_client_0rtt_expect_ok(&client, server.watch_node_addr().initialized().await, true)
             .await?;
 
         client.close().await;
@@ -2867,8 +2870,9 @@ mod tests {
         let server_key = SecretKey::generate(&mut rng);
         let server = spawn_0rtt_server(server_key.clone(), info_span!("server-initial")).await?;
 
-        connect_client_0rtt_expect_err(&client, server.node_addr().initialized().await).await?;
-        connect_client_0rtt_expect_ok(&client, server.node_addr().initialized().await, true)
+        connect_client_0rtt_expect_err(&client, server.watch_node_addr().initialized().await)
+            .await?;
+        connect_client_0rtt_expect_ok(&client, server.watch_node_addr().initialized().await, true)
             .await?;
 
         server.close().await;
@@ -2878,7 +2882,7 @@ mod tests {
         // we expect the client to *believe* it can 0-RTT connect to the server (hence expect_ok),
         // but the server will reject the early data because it discarded necessary state
         // to decrypt it when restarting.
-        connect_client_0rtt_expect_ok(&client, server.node_addr().initialized().await, false)
+        connect_client_0rtt_expect_ok(&client, server.watch_node_addr().initialized().await, false)
             .await?;
 
         client.close().await;
@@ -2895,7 +2899,7 @@ mod tests {
             .alpns(vec![TEST_ALPN.to_vec()])
             .bind()
             .await?;
-        let server_addr = server.node_addr().initialized().await;
+        let server_addr = server.watch_node_addr().initialized().await;
         let server_task = tokio::spawn(async move {
             let incoming = server.accept().await.e()?;
             let conn = incoming.await.e()?;
@@ -2945,7 +2949,7 @@ mod tests {
             .alpns(vec![TEST_ALPN.to_vec()])
             .bind()
             .await?;
-        let server_addr = server.node_addr().initialized().await;
+        let server_addr = server.watch_node_addr().initialized().await;
         let server_task = tokio::task::spawn(async move {
             let conn = server.accept().await.e()?.accept().e()?.await.e()?;
             let mut uni = conn.accept_uni().await.e()?;
@@ -3006,7 +3010,7 @@ mod tests {
             .alpns(accept_alpns)
             .bind()
             .await?;
-        let server_addr = server.node_addr().initialized().await;
+        let server_addr = server.watch_node_addr().initialized().await;
         let server_task = tokio::spawn({
             let server = server.clone();
             async move {
@@ -3130,7 +3134,7 @@ mod tests {
                 .bind()
                 .await
                 .e()?;
-            let addr = endpoint.node_addr().initialized().await;
+            let addr = endpoint.watch_node_addr().initialized().await;
             let router = Router::builder(endpoint).accept(NOOP_ALPN, Noop).spawn();
             Ok((router, addr))
         }
@@ -3159,7 +3163,7 @@ mod tests {
         // wait for the endpoint to be initialized. This should not be needed,
         // but we don't want to measure endpoint init time but connection time
         // from a fully initialized endpoint.
-        endpoint.node_addr().initialized().await;
+        endpoint.watch_node_addr().initialized().await;
         let t0 = Instant::now();
         for id in &ids {
             let conn = endpoint.connect(*id, NOOP_ALPN).await?;

From 3d37d624838c522d59673b81b1f4b2ea0c4d5ab2 Mon Sep 17 00:00:00 2001
From: dignifiedquire <me@dignifiedquire.com>
Date: Mon, 6 Oct 2025 12:19:50 +0200
Subject: [PATCH 16/16] fixup

---
 iroh/src/endpoint.rs | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/iroh/src/endpoint.rs b/iroh/src/endpoint.rs
index d59bd41649e..79cede25d88 100644
--- a/iroh/src/endpoint.rs
+++ b/iroh/src/endpoint.rs
@@ -2704,9 +2704,15 @@ mod tests {
             .bind()
             .await?;
 
-        tokio::time::timeout(Duration::from_secs(10), ep.watch_node_addr().initialized())
-            .await
-            .e()?;
+        tokio::time::timeout(
+            Duration::from_secs(10),
+            ep.watch_node_addr()
+                .map(|addr| addr.map(|addr| addr.direct_addresses))
+                .unwrap()
+                .initialized(),
+        )
+        .await
+        .e()?;
         Ok(())
     }