[Security] Bump pyjwt and rand for remaining GHSAs (#59427)

Signed-off-by: Juan Pérez de Algaba <jperezde@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

requirements/test/cuda.in

@@ -86,7 +86,7 @@ plotly # required for perf comparison html report
 # Skipped (no patched release yet): sqlitedict, accelerate, lmcache, nltk GHSA-8mgp-746c-j5xp.
 urllib3>=2.7.0
 cryptography>=50.0.0
-pyjwt>=2.13.0
+pyjwt>=2.14.0
 pyasn1>=0.6.4
 python-multipart>=0.0.31
 anyio>=4.14.2

requirements/test/rocm.in

@@ -84,7 +84,7 @@ plotly # required for perf comparison html report
 # Skipped (no patched release yet): sqlitedict, accelerate, lmcache, nltk GHSA-8mgp-746c-j5xp.
 urllib3>=2.7.0
 cryptography>=50.0.0
-pyjwt>=2.13.0
+pyjwt>=2.14.0
 pyasn1>=0.6.4
 python-multipart>=0.0.31
 anyio>=4.14.2

requirements/test/xpu.in

@@ -65,7 +65,7 @@ cohere>=7.0.0 # required for cohere chat v2 api tests (protocol/serving import c
 # Dependabot GHSA floors for transitive test deps (excl. dependabot.yml ignores).
 urllib3>=2.7.0
 cryptography>=50.0.0
-pyjwt>=2.13.0
+pyjwt>=2.14.0
 pyasn1>=0.6.4
 python-multipart>=0.0.31
 anyio>=4.14.2

requirements/test/xpu.txt

@@ -809,7 +809,7 @@ pygments==2.21.0
     #   -r requirements/test/xpu.in
     #   pytest
     #   rich
-pyjwt==2.13.0
+pyjwt==2.15.1
     # via
     #   -r requirements/test/xpu.in
     #   mcp

rust/Cargo.lock

@@ -197,7 +197,7 @@ dependencies = [
  "getrandom 0.3.4",
  "hex",
  "hmac",
- "rand 0.9.2",
+ "rand 0.9.5",
  "reqwest 0.12.28",
  "reqwest-eventsource",
  "secrecy",
@@ -1727,7 +1727,7 @@ dependencies = [
  "log",
  "native-tls",
  "num_cpus",
- "rand 0.9.2",
+ "rand 0.9.5",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
@@ -2843,7 +2843,7 @@ checksum = "7b8d41ed865b7a26b6b2d2a519b774460e5ddc50eeeb4ac2a2409c8817ec2de9"
 dependencies = [
  "bitflags",
  "chrono",
- "rand 0.9.2",
+ "rand 0.9.5",
  "schemars 0.8.22",
  "serde",
  "serde_json",
@@ -3511,9 +3511,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
@@ -3564,7 +3564,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8615d50dcf34fa31f7ab52692afec947c4dd0ab803cc87cb3b0b4570ff7463"
 dependencies = [
  "num-traits",
- "rand 0.9.2",
+ "rand 0.9.5",
 ]
 
 [[package]]
@@ -5042,7 +5042,7 @@ dependencies = [
  "monostate",
  "onig",
  "paste",
- "rand 0.9.2",
+ "rand 0.9.5",
  "rayon",
  "rayon-cond",
  "regex",
@@ -5443,7 +5443,7 @@ checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
 dependencies = [
  "bytes",
  "log",
- "rand 0.9.2",
+ "rand 0.9.5",
  "thiserror 2.0.18",
  "utf-8",
 ]
@@ -5750,7 +5750,7 @@ dependencies = [
  "indicatif",
  "mimalloc",
  "parquet",
- "rand 0.9.2",
+ "rand 0.9.5",
  "rand_distr",
  "rayon",
  "reqwest 0.12.28",
@@ -5949,7 +5949,7 @@ dependencies = [
  "asynk-strim-attr",
  "clap",
  "futures",
- "rand 0.9.2",
+ "rand 0.9.5",
  "rmpv",
  "serde",
  "tokio",
@@ -6734,7 +6734,7 @@ dependencies = [
  "num-traits",
  "once_cell",
  "parking_lot",
- "rand 0.9.2",
+ "rand 0.9.5",
  "regex",
  "scc 3.6.9",
  "thiserror 1.0.69",

rust/Cargo.toml

@@ -80,7 +80,7 @@ prost-types = "0.14.3"
 protox = "0.9.1"
 pyo3 = "0.29.0"
 pythonize = "0.29.0"
-rand = "0.9.2"
+rand = "0.9.3"
 rand_distr = "0.5.1"
 rayon = "1.11.0"
 reasoning-parser = "1.2.2"