Okay. I was under the impression that their use was the problem. The PR they landed just removed the OpenSSL.rand from their inits