build(deps): Bump hkdf from 0.12.4 to 0.13.0

[dependabot]

Bumps hkdf from 0.12.4 to 0.13.0.

Commits

• bfb3b20 hkdf v0.13.0 (#195)
• 8834f33 Workspace-level lint configuration (#194)
• b802abc Add Trusted Publishing config (#193)
• 9d0a675 hkdf v0.13.0-rc.6 (#192)
• c46732a Bump hmac to v0.13 (#191)
• 29c07ab Bump digest to v0.11 (#190)
• ef4a3ac build(deps): bump the all-deps group across 1 directory with 9 updates (#189)
• a163784 Bump dependencies (#183)
• 2919db3 build(deps): bump the all-deps group with 2 updates (#182)
• 450a0db hkdf v0.13.0-rc.4 (#181)
• Additional commits viewable in compare view

[github-actions]

Thanks for the contribution! Before this can be merged, please confirm you've read and agree to the Contributor License Agreement by replying to this comment with exactly:

I have read the CLA Document and I hereby sign the CLA

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[Fossferous]

Cannot be taken on its own.

hkdf 0.13 pulls the RustCrypto trait stack forward (digest, crypto-common), and the sha2/hmac versions here no longer satisfy it — 5 trait-bound errors at the HKDF construction, e.g.

error[E0277]: the trait bound `CoreWrapper<CtVariableCoreWrapper<Sha256VarCore, ...>>: CoreProxy` is not satisfied

It has to move as one piece with sha2 0.11, hmac 0.13 and aes-gcm 0.11 — and then be proved to derive byte-identical keys, because every existing account's identity and session material depends on it. A passing test suite does not show that; only a fixture built from old material does.

Recorded in docs/DEPENDENCY_UPDATES.md.

[dependabot]

Superseded by #32.