## Added
- Binary GCD algorithm (#755)
- `RandomMod::try_random_mod` and `Random::try_random` methods (#770)
- `Monty::div_by_2_assign()` (#777)
- `BoxedUint::inv_mod2k_vartime()` (#777)
- `BoxedUint::inv_mod2k()` (#777)
- `Monty::Multiplier` (#777)
- `serde` support for BoxedUint (#789)
- `Binary`, `LowerHex`, and `UpperHex` bounds for `Integer` (#792)
- `DivVartime` trait (#800)
- `PartialOrd<Uint>` impl for `BoxedUint` (#803)
- `UintRef` type (#806, #1114)
- `Resize` trait (#809)
- `Invert::invert_vartime` method (#814)
- `From<Odd>` for `NonZero` impl (#821)
- `BoxedUint::{to_be_bytes_trimmed, to_le_bytes_trimmed}` (#824)
- `BoxedUint::{from_be_slice_vartime, from_le_slice_vartime}` (#833)
- `Int::to_uint` and `Uint::to_int` (#837)
- `NonZero` and `Odd` type aliases (#844)
  - `NonZeroUint`/`OddUint`
  - `NonZeroBoxedUint`/`OddBoxedUint`
  - `NonZeroInt`/`OddInt` (#845)
- `NonZeroInt::new_unwrap` (#857)
- Classic Binary Extended GCD algorithm (#854)
- `Xgcd` trait (#855)
- `Uint::rem_wide` (#896)
- `Reduce` trait (#887, #906)
- `SquareMod` trait (#915)
- `JacobiSymbol` calculation (#927)
- `NonZero::<Uint>::{from_be_hex, from_le_hex}` (#928)
- `Signed` and `Unsigned` marker traits (#942)
- `Int::wrapping_mul` (#946)
- `One` trait ala `Zero` (#947)
- `MontyParams::{one, r2}` accessor methods (#948)
- Optimized Binary Extended GCD a.k.a. binxgcd (#945)
- `ConstMontyForm::MODULUS` constant (#982)
- `Uint::lcm` method (#1028)
- `getrandom` feature with `Random` trait support (#1057)
- `NonZero::get_copy`/`Odd::get_copy` (#1072)
- Checked and wrapping exponentiation methods for `Uint` (#1081)
- `CheckedSquareRoot` trait (#1083)
- `BoxedUint::pow_mod` method (#1084)
- `BoxedUint::concatenating_add` method ([1090)
- `BoxedUint::overflowing_add` method (#1091)
- Extra sizes `U8320` and `U12288` (#1101)
- `Limb::array_as_(mut_)words`/`slice_as_(mut_)words` (#1103)
- `Uint::{floor_root_vartime, checked_root_vartime}` (#1089)
- `(Const)MontyForm::pow_vartime` (#1118)
- `(Const)MontyForm::square_repeat_vartime` method (#1122)
- `ToOwned<Owned = BoxedUint>` impl for `UintRef` (#1128)
- `BoxedUint` exponentiation methods: `wrapping_pow`,
  `wrapping_pow_bounded_exp`, `wrapped_pow_vartime` as well as
  `checked_*`/`saturating_*` equivalents (#1159)
- Division and remainder operations for `Limb` (#1162)
- Implement `Integer` and `Unsigned` for `Limb` (#1174)
- Mixed-size comparisons for `Integer` types (#1184)
- `MontyParams` getter methods (#1188)
- `Uint::resize_checked` method (#1194)
- `const_prime_monty_params!` macro and `PrimeParams` trait (#1139)
- `ConcatenatingSquare` trait (#1208)

## Changed
- Bump `der` to v0.8 (#763, #1206)
- Bump edition to 2024; MSRV 1.85 (#772)
- Bound `Monty` on `Retrieve` (#797)
- `Uint::div`/`Int::div` now accept differently sized denominators (#799)
- Rename `as_(limbs|words)_mut` => `as_mut_(limbs|words)` (#805)
- Inversion method naming: (#816)
  - `inv()` -> `invert()`,
  - `inv_mod()` -> `invert_mod()`,
  - `InvMod` -> `InvertMod`
  - `inv_odd_mod()` -> `invert_odd_mod()`
  - `inv_mod2k()` -> `invert_mod2k()`
- Adopt `core` naming conventions for bigint methods (#817)
- Rename `WideningMul`->`ConcatenatingMul`, `widening_mul()`->`concatenating_mul()`
  - Rename `mul_wide()`/`split_mul()` -> `widening_mul()`
  - Rename `adc()` -> `carrying_add()`
  - Rename `sbb()` -> `borrowing_sub()`
- Rename `mac()` -> `carrying_mul_add()` and change the order of
  arguments to match `core`
- Rename `impl_modulus!` => `const_monty_params!` (#861)
- Unify `ConstMontyParams` and `MontyParams` (#873)
- `BoxedUint::div_rem` now accepts mixed sized inputs (#902)
- `const_monty_form!` now defines a type alias (#909)
- Modular operations now accept a `NonZero` modulus (#914)
- Simplify `Uint::add_mod`, `Uint::double_mod` (#917)
- `Uint::double_mod` now requires a `NonZero` modulus (#917)
- Bump `hybrid-array` to v0.4 (#934)
- Implement `Encoding` for all `Uint`s (#1016, #1064)
- Rename `random_mod` -> `random_mod_vartime` (#1030)
- Replace `subtle` with `ctutils`:
  - Replace `ConstChoice` with `ctutils::Choice` (#1035)
  - Replace `ConstCtOption` with `ctutils::CtOption` (#1040)
  - Replace `ConstantTimeSelect` with `ctutils::CtSelect` (#1043)
  - Replace `ConstantTimeEq` with `CtEq` in trait bounds (#1048)
  - Bound `Integer` on `CtGt`/`CtLt` ([1049)
- Rename `rand` feature to `rand_core` (#1058)
- Have `BoxedMontyForm::new` auto-`Clone` its params (#1087)
- Rename `SquareRoot` trait to `FloorSquareRoot` (#1083)
- Use `core` convention for mixed-sign op names (#1092)
  - `{unsigned}::*_signed` for ops that take `{signed}` RHS operand
  - `{signed}::*_unsigned` for ops that take `{unsigned}` RHS operand
- Make vartime bit shifts return an `Option` instead of `CtOption` (#1096)
- Make vartime inversion return an `Option` instead of `CtOption` (#1097)
- Unified `MontyParams` (#1107)
- Have `Monty::zero` and `Monty::one` borrow params (#1140)
- Rename `MontyForm` -> `FixedMontyForm` (#1145)
- Split `UnsignedWithMontyForm` out of `Unsigned` (#1156, #1189)
- Bump `rand_core` to v0.10 (#1165)
- Wrapping shifts renamed to unbounded shifts to follow `core` semantics (#1160)
- Replace `nlimbs!` macro with `const fn nlimbs()` (#1169)
- Use `cpubits` crate for 32-bit vs 64-bit selection (#1170)
- More flexible `BoxedUint` addition, subtraction, multiplication (#1177)
- Lighter-weight support for `Uint` concat/split operations (#1191)
- Deprecate `Uint:{square, square_wide}` in favor of `concatenating_square` (#1207)
- Deprecate `BoxedUint::{mul, square}` in favor of concatenating
  mul/square (#1208)

## Fixed
- Make `random_bits_core` platform independent (#781, #1010, #1026)
- `Default` impl for `Odd` (#1071)
- `NonZero::from_le_byte_array` (#1211)

## Removed
- `PrecomputedInverter` and `Inverter` traits (#894)
- `BoxedMontyFormInverter` (#897)
- `*SafeGcdInverter` (#898)
- `modular::montgomery_reduction` (#900)
- `ConstMontyParams::inverter` (#907)
- `ConstMontyFormInverter` (#908)