build(deps): bump dryoc from 0.8.0 to 0.9.0

[dependabot]

Bumps dryoc from 0.8.0 to 0.9.0.

Release notes

Sourced from dryoc's releases.

v0.9.0

dryoc v0.9.0

dryoc 0.9.0 expands libsodium-compatible coverage with AEAD, direct HMAC, HKDF, SHA-2/SHA-3 hashing, and Ed25519 key extraction helpers. It also makes protected memory available on stable Rust for supported targets, improves wasm coverage, reduces the normal dependency surface, and tunes several hot paths.

Full Changelog: brndnmtthws/dryoc@v0.8.0...v0.9.0

Breaking Changes / Compatibility Notes

• dryocstream::Tag now uses a local compatibility implementation instead of the external bitflags type. The public constants, methods, operators, formatting, and iteration behavior are preserved for normal use, but code depending on bitflags-specific trait impls or concrete iterator types may need adjustment.
• The legacy gen / r#gen generation APIs are deprecated because gen is reserved in Rust 2024. Existing callers remain source-compatible; prefer the generate replacements, including the new protected-memory key generation helpers.
• Default features are now base64, u64_backend, and protected. Protected-memory APIs are available on stable Rust for Unix and Windows targets, and unsupported targets such as wasm32-unknown-unknown do not expose the protected-memory module.

Highlights Since v0.8.0

Cryptographic APIs

• Added libsodium-compatible crypto_aead_xchacha20poly1305_ietf_* APIs plus the Rustaceous dryocaead API for XChaCha20-Poly1305-IETF, including explicit-nonce boxes, generated-nonce envelopes, protected aliases, serde/wincode support, tests, and fuzz coverage.
• Added direct HMAC variants for SHA-256, SHA-512, and SHA-512/256, plus HKDF-SHA-256 and HKDF-SHA-512 APIs in both Classic and Rustaceous forms.
• Added SHA-256 Classic hashing support and SHA-3-256/SHA-3-512 Classic and Rustaceous hashing APIs.
• Added Ed25519 secret-key extraction helpers for seed and embedded public-key extraction, matching libsodium's signing-key layout.

Protected Memory And Platform Support

• Moved protected memory off the nightly allocator API for the stable storage path while keeping the nightly allocator implementation available behind nightly.
• Added wasm32-unknown-unknown compatibility coverage, target-specific randomness setup, and wasm-bindgen tests for core Rustaceous encryption and hashing paths.
• Clarified protected-memory tradeoffs, platform behavior, and default feature guidance in the README, rustdoc, and repository guidance.

Performance And Dependency Surface

• Removed normal dependencies on base64, bitflags, and lazy_static by replacing them with local or standard-library implementations while keeping the base64 feature as a compatibility flag.
• Uses the soft Poly1305 backend on AArch64 under simd_backend,nightly, where profiling showed it outperforming the portable-SIMD Poly1305 path.
• Removed redundant software Poly1305 state stores.
• Optimized detached crypto_secretbox seal/open paths to avoid full-buffer pre-copying. Detached open now leaves the output buffer unchanged when authentication fails.

Maintenance

• Added a cargo-deny advisory check to CI.
• Updated the README libsodium coverage audit against libsodium 1.0.22 and narrowed the crate-level compatibility wording to supported APIs and wire formats.
• Fixed new chunks_exact clippy lints while preserving existing remainder handling.

Upgrade Guidance

cargo update -p dryoc

• Replace r#gen() calls with generate() where practical. Existing gen APIs are deprecated, not removed.
• If you relied on the previous default feature set, pin features explicitly, for example:

... (truncated)

Commits

• 6ece7f8 docs: clarify libsodium compatibility scope (#135)
• 53b9c93 feat: add SHA-3 hash variants (#134)
• c90fabf feat(sign): add Ed25519 key extraction helpers (#133)
• 84872a4 ci: enforce cargo-deny advisory checks (#131)
• 46667ea fix: address chunks_exact clippy lints (#132)
• 49379fa docs: update default feature guidance (#130)
• 9d12bfe feat: deprecate gen generation APIs (#129)
• 431f86e feat: add libsodium HMAC and HKDF APIs (#128)
• 9075837 docs: clarify protected memory tradeoffs (#127)
• 0069dc6 chore: bump version (#126)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[loadingalias]

Closing the transient routine Cargo version PR. Cargo updates are now coordinated across root, fuzz, scoped fuzz, and tool lockfiles through just update; Dependabot remains enabled for security updates.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.