Relax crypton bounds and bump release versions

[freizl]

Summary

• relax crypton upper bounds in hoauth2 and hoauth2-providers to allow 1.1.x
• update cabal.project index-state to a current Hackage state
• bump package versions to hoauth2-2.15.1 and hoauth2-providers-0.9.1
• follow up from the revert on main; this is the actual fix on a feature branch

Context

Stackage comment: commercialhaskell/stackage#7929 (comment)

That comment reports hoauth2-2.15.0 as out of bounds for crypton-1.1.0 because the package currently required crypton <1.1.

Validation

• cabal update
• cabal build hoauth2 hoauth2-providers --dry-run

[juhp]

This would help with commercialhaskell/stackage#7929

[juhp]

I am using this local hoauth2/hoauth2/stack.yaml file to build:

snapshot: nightly-2026-06-27

extra-deps:
- crypton-1.1.4
- crypton-x509-1.9.1
- crypton-x509-validation-1.9.1
- crypton-x509-store-1.9.0
- crypton-x509-system-1.9.0
- http-client-tls-0.4.0
- tls-2.4.3
- mlkem-0.2.1.0
- hpke-0.1.0
- crypton-connection-0.4.6

(Though I guess cabal build would give similar results)

Then following seems to work for me with Stackage Nightly:

diff --git a/hoauth2/hoauth2.cabal b/hoauth2/hoauth2.cabal
index 4c215df..21d58e2 100644
--- a/hoauth2/hoauth2.cabal
+++ b/hoauth2/hoauth2.cabal
@@ -81,7 +81,7 @@ library
     , exceptions            >=0.8.3  && <0.11
     , http-conduit          >=2.1    && <2.4
     , http-types            >=0.11   && <0.13
-    , memory                ^>=0.18
+    , ram
     , microlens             >=0.4 && <0.6
     , text                  >=2.0    && <2.3
     , transformers          >=0.4    && <0.7
diff --git a/hoauth2/src/Network/OAuth2/Experiment/Pkce.hs b/hoauth2/src/Network/OAuth2/Experiment/Pkce.hs
index 57351df..166eb5c 100644
--- a/hoauth2/src/Network/OAuth2/Experiment/Pkce.hs
+++ b/hoauth2/src/Network/OAuth2/Experiment/Pkce.hs
@@ -43,7 +43,7 @@ mkPkceParam = do
       }
 
 encodeCodeVerifier :: BS.ByteString -> Text
-encodeCodeVerifier = B64.extractBase64 . B64.encodeBase64Unpadded . BS.pack . ByteArray.unpack . hashSHA256
+encodeCodeVerifier = B64.extractBase64 . B64.encodeBase64Unpadded . hashSHA256
 
 genCodeVerifier :: MonadIO m => m BS.ByteString
 genCodeVerifier = liftIO $ getBytesInternal BS.empty
@@ -64,8 +64,9 @@ getBytesInternal ba
       let bsUnreserved = ba `BS.append` BS.filter isUnreversed bs
       getBytesInternal bsUnreserved
 
-hashSHA256 :: BS.ByteString -> H.Digest H.SHA256
-hashSHA256 = H.hash
+hashSHA256 :: BS.ByteString -> BS.ByteString
+hashSHA256 bs =
+  ByteArray.convert (H.hash bs :: H.Digest H.SHA256)
 
 isUnreversed :: Word8 -> Bool
 isUnreversed w = w `BS.elem` unreverseBS

I have not tested it though.