chore(deps): unify duplicate crate versions

[duncanista]

DRAFT — stacked on #1271 (jordan.gonzalez/cold-start-instrumentation/feature). Review/merge #1271 first; this PR targets that branch as its base, not main.

Jira: none yet — add before marking ready.

Overview

Dependency-hygiene change (Confluence H12): bump our direct dependencies in bottlecap/Cargo.toml to match the versions the transitive graph already pulls in, collapsing duplicate compiled crate versions. Fewer duplicate crates means a smaller dependency graph and faster, lighter builds.

Bumps landed:

Crate	Before	After	Source changes
nix	0.26	0.29	none — sysconf/SysconfVar/statfs paths & signatures unchanged. Also eliminates the duplicate bitflags 1.x (nix 0.26 pulled bitflags 1; nix 0.29 uses bitflags 2).
thiserror	1.0	2.0	none — drop-in.
opentelemetry-semantic-conventions	0.30	0.31	none — all constants used in src/otlp/transform.rs are unchanged.
rand	0.8	0.9	src/lifecycle/invocation/mod.rs: thread_rng()->rng(), Rng::gen()->Rng::random(), and OsRng now implements TryRngCore instead of RngCore (use try_next_u64() with a thread-RNG fallback instead of next_u64()).

No bumps were skipped — all four landed cleanly.

Files / call-sites changed

• bottlecap/Cargo.toml — four version bumps (nix, thiserror, rand, opentelemetry-semantic-conventions).
• bottlecap/Cargo.lock — regenerated by cargo build.
• bottlecap/src/lifecycle/invocation/mod.rs — generate_span_id() updated for the rand 0.9 API (only source file needing changes).

Note on remaining rand/thiserror duplicates

cargo tree -d still lists rand 0.8 and thiserror 1.x after this change. Those copies are not reachable from our direct deps anymore — they are pulled exclusively by upstream Datadog git crates (dd-trace-rs / datadog-opentelemetry, serverless-components / dogstatsd + datadog-agent-config, and the libdatadog libdd-* crates), plus multipart for rand. They can only be collapsed by bumping those upstream crates, which is out of scope here. The duplicates this PR's direct deps fully control — nix (+ bitflags 1.x) and opentelemetry-semantic-conventions — are eliminated.

Testing

• cargo fmt --manifest-path bottlecap/Cargo.toml — clean.
• cargo clippy --manifest-path bottlecap/Cargo.toml --bin bottlecap --no-deps — clean (crate denies clippy::all + pedantic + unwrap_used). Also ran --all-targets (lib + tests) clean. Only output is the pre-existing buf_redux/multipart future-incompat warning.
• cargo build --bin bottlecap — succeeds.

cargo tree -d evidence (targeted crates)

Before:

bitflags v1.3.2
bitflags v2.11.0
nix v0.26.4
nix v0.29.0
opentelemetry-semantic-conventions v0.30.0
opentelemetry-semantic-conventions v0.31.0
rand v0.8.6
rand v0.9.4
thiserror v1.0.69
thiserror v2.0.18

After:

rand v0.8.6        (transitive-only: dd-trace-rs / serverless-components / libdatadog / multipart)
rand v0.9.4
thiserror v1.0.69  (transitive-only: dd-trace-rs / serverless-components / libdatadog)
thiserror v2.0.18

bitflags 1.3.2, nix 0.26.4, and opentelemetry-semantic-conventions 0.30.0 are gone (3 duplicate compiled crates eliminated). The Cargo.lock now lists a single version each of nix (0.29.0), opentelemetry-semantic-conventions (0.31.0), and bitflags (2.11.0).

[datadog-official]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 8 Pipeline jobs failed

DataDog/datadog-lambda-extension | integration-suite: [otlp]     

DataDog/datadog-lambda-extension | integration-suite: [payload-size]     

DataDog/datadog-lambda-extension | bottlecap (amd64, fips)     

View all 8 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: a5a3a5d | Docs | Datadog PR Page | Give us feedback!}