v4.5.0

Deprecations

• The rand feature has been deprecated in favor of getrandom_04 and getrandom_03.
• The rng feature has been deprecated in favor of the rapidrand crate.

Additions

• getrandom_04 feature: opt-in seeding of the hasher seeds and secrets from OS/platform entropy via the getrandom crate, without requiring std nor rand crate. This replaces the rand feature and enables true HashDoS resistance on targets with no ambient entropy or ASLR:
  • wasm32-wasip1/wasm32-wasip2: enabling the feature is sufficient; entropy comes from the WASI host.
  • wasm32-unknown-unknown (browser/node): additionally requires getrandom's wasm_js backend, enabled by the top-level binary. Building without the backend is a compile error rather than a silent fallback to deterministic seeding.
  • Embedded/no_std targets with a hardware RNG: register a getrandom custom backend. On targets without atomic pointer support (e.g. thumbv6m-none-eabi), each RandomState draws a fresh random seed per instance, restoring minimal HashDoS resistance where there previously was none.
• getrandom_03 feature: the same as the getrandom_04 feature, but using getrandom v0.3 to preserve the rapidhash MSRV 1.71.

Fixes

• RandomState no longer produces duplicate seeds across threads whose stacks are recycled by the OS. Each thread's seed counter is now initialized from a global thread counter mixed with the process-wide random seed, instead of relying on the (frequently re-used) stack address alone.
• Better randomness handling and documentation for wasm targets, no_std targets, and targets without atomics.

What's Changed

• Overhaul RandomState and GlobalState entropy logic by @hoxxep in #98
• Deprecate RapidRng in favour of rapidrand by @hoxxep in #99

Full Changelog: v4.4.2...v4.5.0