deps: bump xxhash from 3.8.1 to 4.0.1 - #532

Sourced from xxhash's releases.

v4.0.1

• Clean up _parse_init_args keyword handling so the defensive check for a duplicate data keyword raises a proper error message
• Add _xxhash module docstring

Full Changelog: ifduyue/python-xxhash@v4.0.0...v4.0.1

v4.0.0

• Breaking change: Drop support for Python 3.8, require Python >= 3.9
• Breaking change: Remove deprecated xxhash.VERSION_TUPLE
• Breaking change: The input keyword argument is renamed to data across constructors, update(), and one-shot functions
• Breaking change: str input is no longer accepted and raises TypeError: Strings must be encoded before hashing; encode to bytes before hashing
• Upgrade xxHash from v0.8.2 to v0.8.3. Note: on GCC/Clang source builds that target AVX2 (e.g. -march=x86-64-v3), upstream v0.8.3 autovectorizes XXH64_update() and makes the xxh64 streaming path about 2x slower. The shipped wheels are built for baseline x86-64 and are unaffected. Source builds can work around it by adding -fno-tree-vectorize to the compiler flags.
• Add per-object locking for thread safety, with sub-interpreter and free-threaded (no-GIL) Python support
• Speed up hash constructors by switching them to tp_vectorcall.
• Build pyodide wasm32 wheels
• Add s390x big-endian test job
• Add Python 3.15 classifier
• CI: shard the PyPI upload into parallel groups and create the GitHub Release automatically

Sourced from xxhash's changelog.

v4.0.1 2026-08-17

- Clean up ``_parse_init_args`` keyword handling so the defensive check
  for a duplicate ``data`` keyword raises a proper error message
- Add ``_xxhash`` module docstring
v4.0.0 2026-08-12

• Breaking change: Drop support for Python 3.8, require Python >= 3.9
• Breaking change: Remove deprecated xxhash.VERSION_TUPLE
• Breaking change: The input keyword argument is renamed to data in constructors and one-shot functions. update() additionally gains a data keyword argument (it accepted no keyword arguments before).
• Breaking change: str input is no longer accepted and raises TypeError: Strings must be encoded before hashing; encode to bytes before hashing
• Upgrade xxHash from v0.8.2 to v0.8.3. Note: on GCC/Clang source builds that target AVX2 (e.g. -march=x86-64-v3), upstream v0.8.3 autovectorizes XXH64_update() and makes the xxh64 streaming path about 2x slower. The shipped wheels are built for baseline x86-64 and are unaffected. Source builds can work around it by adding -fno-tree-vectorize to the compiler flags.
• Add per-object locking for thread safety, with sub-interpreter and free-threaded (no-GIL) Python support. The GIL is now released only while hashing inputs larger than 64 KiB; previously update() released it unconditionally and one-shot functions always held it.
• Speed up hash constructors by switching them to tp_vectorcall.
• Build pyodide wasm32 wheels
• Add s390x big-endian test job
• Add Python 3.15 classifier
• CI: shard the PyPI upload into parallel groups and create the GitHub Release automatically

• e2c1bcf Release v4.0.1
• 669a69c Clean up _parse_init_args keyword handling
• 4a6136d build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1
• aa26ed6 Bump version to 4.0.1.dev0
• d774e2a Add _xxhash module docstring
• c8d9a0e Clarify changelog: update() keyword and GIL release threshold
• 80d42d2 Mention exact str rejection error in changelog
• befdf3b Update changelog: note str input rejection
• 5c5e42f Release v4.0.0
• 88fe191 Bump version to 4.0.0.dev8
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)