# Collapse the duplicate getrandom versions in the dependency graph

- **Status**: Todo
- **Kind**: Chore
- **Authors**: jp
- **Date**: 2026-09-14
- **Label**: domain=tooling
- **Label**: package=jp_conversation
- **Label**: type=task

`.clippy.toml` exempts `getrandom` from `allowed-duplicate-crates`, because the
graph carries both 0.2 and 0.3:

- `ring` depends on 0.2.
- `rand_core` and `jp_conversation` (for `EventId::random`) depend on 0.3.

Nothing in the workspace can collapse this today: `ring` reaches us transitively
and pins 0.2 itself.

Drop the exemption once the transitive dependencies converge on one version.
Checking whether they have is a matter of running `cargo tree --invert --package
getrandom` and seeing whether anything still pulls 0.2.

The exemption is cheap and correct, so this is bookkeeping rather than a
problem.
It is filed so the entry does not outlive the reason for it.