chore(deps): Bump hkdf from 0.12.4 to 0.13.0

[dependabot]

Bumps hkdf from 0.12.4 to 0.13.0.

Commits

• bfb3b20 hkdf v0.13.0 (#195)
• 8834f33 Workspace-level lint configuration (#194)
• b802abc Add Trusted Publishing config (#193)
• 9d0a675 hkdf v0.13.0-rc.6 (#192)
• c46732a Bump hmac to v0.13 (#191)
• 29c07ab Bump digest to v0.11 (#190)
• ef4a3ac build(deps): bump the all-deps group across 1 directory with 9 updates (#189)
• a163784 Bump dependencies (#183)
• 2919db3 build(deps): bump the all-deps group with 2 updates (#182)
• 450a0db hkdf v0.13.0-rc.4 (#181)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[kerberosmansour]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[kerberosmansour]

This cannot merge on its own — it needs a coordinated RustCrypto bump

Diagnosed against the fresh run after a base refresh (run 30525143941, job 90814224998, 08:07:39Z today), not the stale 05-11 run this PR had been carrying.

cargo doc (deny warnings) fails with 10 compile errors in secure_data:

error[E0277]: the trait bound `CoreWrapper<CtVariableCoreWrapper<Sha256VarCore, ...>>: CoreProxy` is not satisfied
  --> crates/secure_data/src/envelope.rs:677:14
677 |     let hk = Hkdf::<Sha256>::new(None, seed_material);
    |              ^^^^^^^^^^^^^^ unsatisfied trait bound

note: there are multiple different versions of crate `digest` in the dependency graph
  --> digest-0.11.3/src/block_api.rs:155:1     this is the expected trait
  ::: digest-0.10.7/src/core_api/wrapper.rs:266:1   this is the found trait

Root cause: hkdf 0.13.0 moved to the digest 0.11 line, but this workspace's sha2 is still on the digest 0.10 line. So Sha256 cannot satisfy the traits Hkdf now requires, and both digest versions end up in the graph. Bumping hkdf alone is not a valid upgrade.

The upgrade is available, but it is a set, not a single crate — checked crates.io just now:

crate	max stable	line
hkdf	0.13.0	digest 0.11
hmac	0.13.0	digest 0.11
sha2	0.11.0	digest 0.11
digest	0.11.3	—

So hkdf 0.13 + hmac 0.13 + sha2 0.11 must move together. That is a RustCrypto 0.10 → 0.11 API migration inside a security library (27 code hits for Hkdf across the repo), with real API changes — not a dependency-bump merge.

Recommendation: do not merge or force this PR. Track the coordinated digest 0.11 migration as its own piece of work with tests, and let dependabot close/reopen this once the workspace is on the 0.11 line.

The second red, Supply-Chain Security, is a separate and pre-existing matter — see the cargo vet unvetted-dependency situation also affecting #102.

Read-only diagnosis by linux-agent; no edit, force-push, or merge taken on this PR.