`getrandom` 0.3 breaks existing code due to changed js treatment. `ahash` should not bump `getrandom` unless it bumps to `0.9`.