build(deps): bump rapidhash from 4.4.1 to 4.5.1

[dependabot]

Bumps rapidhash from 4.4.1 to 4.5.1.

Release notes

Sourced from rapidhash's releases.

v4.5.1

What's Changed

• Fix size tests for s390x architectures with 8-byte alignment for u128 by @​hoxxep in hoxxep/rapidhash#101
• Fix new thread seeding for std but no-atomic targets by @​hoxxep in hoxxep/rapidhash#102

Full Changelog: hoxxep/rapidhash@v4.5.0...v4.5.1

v4.5.0

Deprecations

• The rand feature has been deprecated in favor of getrandom_04 and getrandom_03.
• The rng feature has been deprecated in favor of the rapidrand crate.

Additions

• getrandom_04 feature: opt-in seeding of the hasher seeds and secrets from OS/platform entropy via the getrandom crate, without requiring std nor rand crate. This replaces the rand feature and enables true HashDoS resistance on targets with no ambient entropy or ASLR:
  • wasm32-wasip1/wasm32-wasip2: enabling the feature is sufficient; entropy comes from the WASI host.
  • wasm32-unknown-unknown (browser/node): additionally requires getrandom's wasm_js backend, enabled by the top-level binary. Building without the backend is a compile error rather than a silent fallback to deterministic seeding.
  • Embedded/no_std targets with a hardware RNG: register a getrandom custom backend. On targets without atomic pointer support (e.g. thumbv6m-none-eabi), each RandomState draws a fresh random seed per instance, restoring minimal HashDoS resistance where there previously was none.
• getrandom_03 feature: the same as the getrandom_04 feature, but using getrandom v0.3 to preserve the rapidhash MSRV 1.71.

Fixes

• RandomState no longer produces duplicate seeds across threads whose stacks are recycled by the OS. Each thread's seed counter is now initialized from a global thread counter mixed with the process-wide random seed, instead of relying on the (frequently re-used) stack address alone.
• Better randomness handling and documentation for wasm targets, no_std targets, and targets without atomics.

What's Changed

• Overhaul RandomState and GlobalState entropy logic by @​hoxxep in hoxxep/rapidhash#98
• Deprecate RapidRng in favour of rapidrand by @​hoxxep in hoxxep/rapidhash#99

Full Changelog: hoxxep/rapidhash@v4.4.2...v4.5.0

v4.4.2

What's Changed

• Add 32-bit tests and test fixes by @​hoxxep in hoxxep/rapidhash#94
• Update readme to include used by note by @​hoxxep in hoxxep/rapidhash#95
• Fix documentation errors, link seed-independent collision article by @​hoxxep in hoxxep/rapidhash#96

Full Changelog: hoxxep/rapidhash@v4.4.1...v4.4.2

Changelog

Sourced from rapidhash's changelog.

4.5.1 (20260704)

Fixes

• Fixed an edge case where targets with std but no atomics could see the same seed repeatedly on RandomState on new threads. (hoxxep/rapidhash#102)
• Fixed struct size tests for Debian packaging. (hoxxep/rapidhash#90)

4.5.0 (20260703)

Deprecations

• The rand feature has been deprecated in favor of getrandom_04 and getrandom_03.
• The rng feature has been deprecated in favor of the rapidrand crate.

Additions

• getrandom_04 feature: opt-in seeding of the hasher seeds and secrets from OS/platform entropy via the getrandom crate, without requiring std nor rand crate. This replaces the rand feature and enables true HashDoS resistance on targets with no ambient entropy or ASLR:
  • wasm32-wasip1/wasm32-wasip2: enabling the feature is sufficient; entropy comes from the WASI host.
  • wasm32-unknown-unknown (browser/node): additionally requires getrandom's wasm_js backend, enabled by the top-level binary. Building without the backend is a compile error rather than a silent fallback to deterministic seeding.
  • Embedded/no_std targets with a hardware RNG: register a getrandom custom backend. On targets without atomic pointer support (e.g. thumbv6m-none-eabi), each RandomState draws a fresh random seed per instance, restoring minimal HashDoS resistance where there previously was none.
• getrandom_03 feature: the same as the getrandom_04 feature, but using getrandom v0.3 to preserve the rapidhash MSRV 1.71.

Fixes

• RandomState no longer produces duplicate seeds across threads whose stacks are recycled by the OS. Each thread's seed counter is now initialized from a global thread counter mixed with the process-wide random seed, instead of relying on the (frequently re-used) stack address alone.
• Better randomness handling and documentation for wasm targets, no_std targets, and targets without atomics.

4.4.2 (20260627)

Fixes

• Fixed documentation errors across the codebase.
• Fixed unit tests on 32-bit platforms. No library or CLI code changes were required.

Commits

• 7eb3402 Prepare v4.5.1 release
• 4e78be6 Merge pull request #102 from hoxxep/thread-seeding-fix
• 8fcaf14 Fix branch for std but no-atomic targets
• 798dc07 Merge pull request #101 from hoxxep/s390x-size-test-fix
• ed41656 Struct size tests for a range of targets
• c82999a Fix size tests for s390x architectures with 8-byte alignment for u128
• 9fe63fe Merge pull request #100 from hoxxep/deprecate-rng
• 1755d27 Small cargo clippy cleanup
• e3db1f9 Simplify rapidrand initialization in tests
• 57854a9 Prepare the v4.5.0 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)