Replace GPL licensed Random with MIT licensed PCG random

[adinauer]

📜 Description

Replace GPL licensed Random with MIT licensed PCG random

Here's benchmark results for generating UUIDs with different versions of Random:

Test Method	Score (ops/s)	Error (±)	Percentage
java.security.SecureRandom	4,808,226.84	66,637.448	100.00%
java.util.Random	54,039,882.59	295,434.243	1,123.90%
PCG based Random	56,856,180.40	362,533.183	1,182.48%

This shows the new PCG based Random is similar in single threaded performance to java.util.Random which the old implementation was a subset of.

💡 Motivation and Context

Avoid GPL licensed code in SDK

💚 How did you test it?

📝 Checklist

• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.

🔮 Next steps

[adinauer]

• Replace GPL licensed Random with MIT licensed PCG random #4664 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	380.04 ms	434.35 ms	54.31 ms
Size	1.58 MiB	2.10 MiB	533.44 KiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
ee747ae	405.43 ms	485.70 ms	80.28 ms
3699cd5	423.60 ms	495.52 ms	71.92 ms
ee747ae	400.46 ms	423.61 ms	23.15 ms
ee747ae	554.98 ms	611.50 ms	56.52 ms
ee747ae	374.71 ms	455.18 ms	80.47 ms
ee747ae	382.73 ms	435.41 ms	52.68 ms
ee747ae	396.82 ms	441.67 ms	44.86 ms
ee747ae	358.21 ms	389.41 ms	31.20 ms
7314dbe	437.83 ms	505.64 ms	67.81 ms
ee747ae	415.92 ms	470.15 ms	54.23 ms

App size

Revision	Plain	With Sentry	Diff
ee747ae	1.58 MiB	2.10 MiB	530.95 KiB
3699cd5	1.58 MiB	2.10 MiB	533.45 KiB
ee747ae	1.58 MiB	2.10 MiB	530.95 KiB
ee747ae	1.58 MiB	2.10 MiB	530.95 KiB
ee747ae	1.58 MiB	2.10 MiB	530.95 KiB
ee747ae	1.58 MiB	2.10 MiB	530.95 KiB
ee747ae	1.58 MiB	2.10 MiB	530.95 KiB
ee747ae	1.58 MiB	2.10 MiB	530.95 KiB
7314dbe	1.58 MiB	2.10 MiB	533.45 KiB
ee747ae	1.58 MiB	2.10 MiB	530.95 KiB

Previous results on branch: 08-26-replace_gpl_licensed_random_with_mit_licensed_pcg_random

Startup times

Revision	Plain	With Sentry	Diff
d0d3ea6	376.63 ms	416.78 ms	40.14 ms

App size

Revision	Plain	With Sentry	Diff
d0d3ea6	1.58 MiB	2.10 MiB	531.08 KiB

[cursor]

Bug: Input Validation Flaws in Random Number Methods

The nextInt(int n) method is missing validation for n <= 0, which can cause an ArithmeticException (for n=0) or lead to unpredictable behavior and potential infinite loops (for n < 0). Similarly, nextLong(long n) only validates n == 0; negative n values can also cause unpredictable behavior or infinite loops. A stray semicolon at line 183 serves no purpose.

Additional Locations (1)

• sentry/src/main/java/io/sentry/util/Random.java#L168-L183

 

[cursor]

Bug: Random Class Regression Causes Thread Safety Issues

The Random class introduced a thread safety regression. It switched from AtomicLong and synchronized methods to unsynchronized plain long fields (state, inc). This creates race conditions, which can corrupt the internal state and degrade random number quality in concurrent use. The setSeed method, previously synchronized, now also lacks protection, as indicated by a TODO.

Additional Locations (1)

• sentry/src/main/java/io/sentry/util/Random.java#L53-L57