deps: bump hmac 0.13 and sha2 0.11 together

CHANGELOG.md

@@ -37,6 +37,15 @@ before 1.0).
 
 ### Changed
 
+- **Tor cookie HMAC uses `hmac` 0.13 and `sha2` 0.11** (digest 0.11).
+  Node `getrandom` is 0.4, matching the rest of the workspace. `bitcoin`
+  requirement is 0.32.102. Compatible lock bumps include `bitflags` 2.13.2,
+  `cc` 1.4.7, `hex-conservative` 0.2.3 / 1.3.0, `hyper` 1.11.1,
+  `smallvec` 1.16.1, `syn` 3.0.6, and `zerocopy` 0.8.57.
+  `bitcoin_hashes` stays 0.14 (`bitcoin` 0.32 requires it).
+  `tokio-tungstenite` stays 0.29 (axum 0.8). `getrandom` 0.2 and 0.3
+  stay for `rand_core`.
+
 - **Pruned SH materialize is two-pass extract:** each collect worker owns a
   contiguous create-fk span and unsized maps capped at 1.5 GiB
   (`SH_EXTRACT_WORKER_RAM_BYTES`; 64 B/key pass 1, `80n+8f` pass 2). After

Cargo.toml

@@ -51,7 +51,7 @@ tower = { version = "0.5", features = ["limit"] }
 tower-http = { version = "0.7", features = ["limit", "timeout"] }
 # rust-bitcoin stack
 # No `bitcoinconsensus` feature — we verify scripts in pure Rust (see rbitcoin-consensus::script).
-bitcoin = { version = "0.32.101", default-features = true }
+bitcoin = { version = "0.32.102", default-features = true }
 bitcoin_hashes = "0.14.101"
 # BIP324 v2 encrypted P2P transport (tokio async ProtocolReader/Writer).
 bip324 = { version = "0.11", default-features = true, features = ["tokio"] }

crates/rbitcoin-node/Cargo.toml

@@ -26,9 +26,9 @@ bitcoin = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
 mimalloc = { workspace = true }
-hmac = "0.12"
-sha2 = "0.10"
-getrandom = "0.3"
+hmac = "0.13"
+sha2 = "0.11"
+getrandom = "0.4"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"

crates/rbitcoin-node/src/tor_control.rs

@@ -2,7 +2,7 @@
 
 use crate::error::NodeError;
 use bitcoin::hex::DisplayHex;
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit, Mac};
 use sha2::Sha256;
 use std::io::Write;
 use std::net::SocketAddr;