Bump `bdk_esplora` once it picks up `esplora-client` 0.13.0

[va-an]

Tracking issue, promised in #281. Nothing to fix here yet - the fix has to land upstream first.

cargo audit on master is still red: three advisories against rustls-webpki 0.101.7, pulled in transitively through minreq 2.14.1.

The 0.103.x occurrence is already gone from the lockfile, fixed by #242; #281 proposed the same bump and was closed as superseded once rebasing left an empty diff. The 0.101.7 one was never addressed, hence this issue.

---

$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1173 security advisories (from /home/v/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (431 crate dependencies)
Crate:     rustls-webpki
Version:   0.101.7
Title:     Reachable panic in certificate revocation list parsing
Date:      2026-04-22
ID:        RUSTSEC-2026-0104
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0104
Solution:  Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7

Crate:     rustls-webpki
Version:   0.101.7
Title:     Name constraints for URI names were incorrectly accepted
Date:      2026-04-14
ID:        RUSTSEC-2026-0098
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0098
Solution:  Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6

Crate:     rustls-webpki
Version:   0.101.7
Title:     Name constraints were accepted for certificates asserting a wildcard name
Date:      2026-04-14
ID:        RUSTSEC-2026-0099
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0099
Solution:  Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6

error: 3 vulnerabilities found!

$ cargo tree --all-features -i rustls-webpki@0.101.7
rustls-webpki v0.101.7
├── minreq v2.14.1
│   ├── esplora-client v0.12.3
│   │   └── bdk_esplora v0.22.2
│   │       └── bdk-cli v4.0.0 (/home/v/src/bitcoindevkit/bdk-cli)
│   └── jsonrpc v0.18.0
│       └── bitcoincore-rpc v0.19.0
│           ├── bdk_bitcoind_rpc v0.22.0
│           │   └── bdk-cli v4.0.0 (/home/v/src/bitcoindevkit/bdk-cli)
│           └── bitcoind v0.36.1
│               └── electrsd v0.28.0
│                   └── bdk_testenv v0.13.1
│                       [dev-dependencies]
│                       └── bdk-cli v4.0.0 (/home/v/src/bitcoindevkit/bdk-cli)
├── minreq v2.14.1
│   [build-dependencies]
│   ├── bitcoind v0.36.1 (*)
│   └── electrsd v0.28.0 (*)
└── rustls v0.21.12
    ├── minreq v2.14.1 (*)
    └── minreq v2.14.1 (*)

Three independent paths lead to minreq, and this issue tracks only the first:

1. esplora-client -> bdk_esplora.
2. jsonrpc -> bitcoincore-rpc -> bdk_bitcoind_rpc - waiting on the corepc-client migration upstream, rust-bitcoincore-rpc being archived.
3. bitcoind / electrsd -> bdk_testenv, as dev- and build-dependency - independent of both.

So the bump will not turn cargo audit green on its own: it clears one path of three, and the same three advisories keep being reported through the other two. Each needs its own upstream fix.

Upstream status

• esplora-client dropped minreq in favour of bitreq in v0.13.0 - refactor(client)!: use bitreq for both BlockingClient and AsyncClient rust-esplora-client#137.
• bdk_esplora has not picked that up yet. Latest release is 0.22.2, still on esplora-client 0.12.x.
• The bump lives in Bump esplora-client to v0.13.0 bdk#2189, still open. It is deliberately held back: bitreq does not properly support a WASM transport yet, and the plan discussed there is to wait for a 0.13.x point release that fixes it.